os.c revision 51e0ad287f1b345f0c3316f0633aab14d0e8bb65
/*
* Copyright (C) 1999, 2000 Internet Software Consortium.
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
* DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
* INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
* INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
* FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
* NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
* WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
/* $Id: os.c,v 1.32 2000/08/29 17:54:23 bwelling Exp $ */
#include <config.h>
#include <sys/stat.h>
#include <ctype.h>
#include <errno.h>
#include <fcntl.h>
#include <grp.h> /* Required for initgroups() on IRIX. */
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <syslog.h>
#include <unistd.h>
#include <isc/string.h>
#include <named/main.h>
#include <named/os.h>
static char *pidfile = NULL;
/*
* If there's no <linux/capability.h>, we don't care about <linux/prctl.h>
*/
#ifndef HAVE_LINUX_CAPABILITY_H
#undef HAVE_LINUX_PRCTL_H
#endif
/*
* Linux defines:
* (T) HAVE_LINUXTHREADS
* (C) HAVE_LINUX_CAPABILITY_H
* (P) HAVE_LINUX_PRCTL_H
* The possible cases are:
* none: setuid() normally
* T: no setuid()
* C: setuid() normally, drop caps (keep CAP_SETUID)
* T+C: no setuid(), drop caps (don't keep CAP_SETUID)
* T+C+P: setuid() early, drop caps (keep CAP_SETUID)
* C+P: setuid() normally, drop caps (keep CAP_SETUID)
* P: not possible
* T+P: not possible
*
* if (C)
* caps = BIND_SERVICE + CHROOT + SETGID
* if ((T && C && P) || !T)
* caps += SETUID
* endif
* capset(caps)
* endif
* if (T && C && P && -u)
* setuid()
* else if (T && -u)
* fail
* --> start threads
* if (!T && -u)
* setuid()
* if (C && (P || !-u))
* caps = BIND_SERVICE
* capset(caps)
* endif
*
* It will be nice when Linux threads work properly with setuid().
*/
#ifdef HAVE_LINUXTHREADS
static pid_t mainpid = 0;
#endif
static struct passwd *runas_pw = NULL;
static isc_boolean_t done_setuid = ISC_FALSE;
#ifdef HAVE_LINUX_CAPABILITY_H
static isc_boolean_t non_root = ISC_FALSE;
static isc_boolean_t non_root_caps = ISC_FALSE;
/*
* We define _LINUX_FS_H to prevent it from being included. We don't need
* anything from it, and the files it includes cause warnings with 2.2
* kernels, and compilation failures (due to conflicts between <linux/string.h>
* and <string.h>) on 2.3 kernels.
*/
#define _LINUX_FS_H
#include <sys/syscall.h> /* Required for syscall(). */
#include <linux/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
#ifdef HAVE_LINUX_PRCTL_H
#include <sys/prctl.h> /* Required for prctl(). */
/*
* If the value of PR_SET_KEEPCAPS is not in <linux/prctl.h>, define it
* here. This allows setuid() to work on systems running a new enough
* kernel but with /usr/include/linux pointing to "standard" kernel
* headers.
*/
#ifndef PR_SET_KEEPCAPS
#define PR_SET_KEEPCAPS 8
#endif
#endif /* HAVE_LINUX_PRCTL_H */
#ifndef SYS_capset
#define SYS_capset __NR_capset
#endif
static void
linux_setcaps(unsigned int caps) {
struct __user_cap_header_struct caphead;
struct __user_cap_data_struct cap;
if ((getuid() != 0 && !non_root_caps) || non_root)
return;
memset(&caphead, 0, sizeof caphead);
caphead.version = _LINUX_CAPABILITY_VERSION;
caphead.pid = 0;
memset(&cap, 0, sizeof cap);
cap.effective = caps;
cap.permitted = caps;
cap.inheritable = caps;
if (syscall(SYS_capset, &caphead, &cap) < 0)
ns_main_earlyfatal("capset failed: %s", strerror(errno));
}
static void
linux_initialprivs(void) {
unsigned int caps;
/*
* We don't need most privileges, so we drop them right away.
* Later on linux_minprivs() will be called, which will drop our
* capabilities to the minimum needed to run the server.
*/
caps = 0;
/*
* We need to be able to bind() to privileged ports, notably port 53!
*/
caps |= (1 << CAP_NET_BIND_SERVICE);
/*
* We need chroot() initially too.
*/
caps |= (1 << CAP_SYS_CHROOT);
#if defined(HAVE_LINUX_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
/*
* We can setuid() only if either the kernel supports keeping
* capabilities after setuid() (which we don't know until we've
* tried) or we're not using threads. If either of these is
* true, we want the setuid capability.
*/
caps |= (1 << CAP_SETUID);
#endif
/*
* Since we call initgroups, we need this.
*/
caps |= (1 << CAP_SETGID);
/*
* XXX We might want to add CAP_SYS_RESOURCE, though it's not
* clear it would work right given the way linuxthreads work.
*/
linux_setcaps(caps);
}
static void
linux_minprivs(void) {
unsigned int caps;
/*
* Drop all privileges except the ability to bind() to privileged
* ports.
*
* It's important that we drop CAP_SYS_CHROOT. If we didn't, it
* chroot() could be used to escape from the chrooted area.
*/
caps = 0;
caps |= (1 << CAP_NET_BIND_SERVICE);
linux_setcaps(caps);
}
#ifdef HAVE_LINUX_PRCTL_H
static void
linux_keepcaps(void) {
/*
* Ask the kernel to allow us to keep our capabilities after we
* setuid().
*/
if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
if (errno != EINVAL)
ns_main_earlyfatal("prctl() failed: %s",
strerror(errno));
} else {
non_root_caps = ISC_TRUE;
if (getuid() != 0)
non_root = ISC_TRUE;
}
}
#endif
#endif /* HAVE_LINUX_CAPABILITY_H */
static void
setup_syslog(const char *progname) {
int options;
options = LOG_PID;
#ifdef LOG_NDELAY
options |= LOG_NDELAY;
#endif
openlog(progname, options, LOG_DAEMON);
}
void
ns_os_init(const char *progname) {
setup_syslog(progname);
#ifdef HAVE_LINUX_CAPABILITY_H
linux_initialprivs();
#endif
#ifdef HAVE_LINUXTHREADS
mainpid = getpid();
#endif
}
void
ns_os_daemonize(void) {
pid_t pid;
int fd;
pid = fork();
if (pid == -1)
ns_main_earlyfatal("fork(): %s", strerror(errno));
if (pid != 0)
_exit(0);
/*
* We're the child.
*/
#ifdef HAVE_LINUXTHREADS
mainpid = getpid();
#endif
if (setsid() == -1)
ns_main_earlyfatal("setsid(): %s", strerror(errno));
/*
* Try to set stdin, stdout, and stderr to /dev/null, but press
* on even if it fails.
*
* XXXMLG The close() calls here are unneeded on all but NetBSD, but
* are harmless to include everywhere. dup2() is supposed to close
* the FD if it is in use, but unproven-pthreads-0.16 is broken
* and will end up closing the wrong FD. This will be fixed eventually,
* and these calls will be removed.
*/
fd = open("/dev/null", O_RDWR, 0);
if (fd != -1) {
close(STDIN_FILENO);
(void)dup2(fd, STDIN_FILENO);
close(STDOUT_FILENO);
(void)dup2(fd, STDOUT_FILENO);
close(STDERR_FILENO);
(void)dup2(fd, STDERR_FILENO);
if (fd != STDIN_FILENO &&
fd != STDOUT_FILENO &&
fd != STDERR_FILENO)
(void)close(fd);
}
}
static isc_boolean_t
all_digits(const char *s) {
if (*s == '\0')
return (ISC_FALSE);
while (*s != '\0') {
if (!isdigit((*s)&0xff))
return (ISC_FALSE);
s++;
}
return (ISC_TRUE);
}
void
ns_os_chroot(const char *root) {
if (root != NULL) {
if (chroot(root) < 0)
ns_main_earlyfatal("chroot(): %s", strerror(errno));
if (chdir("/") < 0)
ns_main_earlyfatal("chdir(/): %s", strerror(errno));
}
}
void
ns_os_inituserinfo(const char *username) {
if (username == NULL)
return;
if (all_digits(username))
runas_pw = getpwuid((uid_t)atoi(username));
else
runas_pw = getpwnam(username);
endpwent();
if (runas_pw == NULL)
ns_main_earlyfatal("user '%s' unknown", username);
if (getuid() == 0) {
if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0)
ns_main_earlyfatal("initgroups(): %s", strerror(errno));
}
}
void
ns_os_changeuser(void) {
if (runas_pw == NULL || done_setuid)
return;
done_setuid = ISC_TRUE;
#ifdef HAVE_LINUXTHREADS
#ifdef HAVE_LINUX_CAPABILITY_H
if (!non_root_caps)
#endif
ns_main_earlyfatal(
"-u not supported on Linux kernels older than "
"2.3.99-pre3 when using threads");
#endif
if (setgid(runas_pw->pw_gid) < 0)
ns_main_earlyfatal("setgid(): %s", strerror(errno));
if (setuid(runas_pw->pw_uid) < 0)
ns_main_earlyfatal("setuid(): %s", strerror(errno));
#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
void
ns_os_minprivs(void) {
#ifdef HAVE_LINUX_PRCTL_H
linux_keepcaps();
#endif
#ifdef HAVE_LINUXTHREADS
ns_os_changeuser(); /* Call setuid() before threads are started */
#endif
#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
static int
safe_open(const char *filename) {
struct stat sb;
if (stat(filename, &sb) == -1) {
if (errno != ENOENT)
return (-1);
} else if ((sb.st_mode & S_IFREG) == 0)
return (-1);
(void)unlink(filename);
return (open(filename, O_WRONLY|O_CREAT|O_EXCL,
S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH));
}
static void
cleanup_pidfile(void) {
if (pidfile != NULL)
(void)unlink(pidfile);
free(pidfile);
pidfile = NULL;
}
void
ns_os_writepidfile(const char *filename) {
int fd;
FILE *lockfile;
size_t len;
pid_t pid;
/*
* The caller must ensure any required synchronization.
*/
cleanup_pidfile();
len = strlen(filename);
pidfile = malloc(len + 1);
if (pidfile == NULL)
ns_main_earlyfatal("couldn't malloc '%s': %s",
filename, strerror(errno));
/* This is safe. */
strcpy(pidfile, filename);
fd = safe_open(filename);
if (fd < 0)
ns_main_earlyfatal("couldn't open pid file '%s': %s",
filename, strerror(errno));
lockfile = fdopen(fd, "w");
if (lockfile == NULL)
ns_main_earlyfatal("could not fdopen() pid file '%s': %s",
filename, strerror(errno));
#ifdef HAVE_LINUXTHREADS
pid = mainpid;
#else
pid = getpid();
#endif
if (fprintf(lockfile, "%ld\n", (long)pid) < 0)
ns_main_earlyfatal("fprintf() to pid file '%s' failed",
filename);
if (fflush(lockfile) == EOF)
ns_main_earlyfatal("fflush() to pid file '%s' failed",
filename);
(void)fclose(lockfile);
}
void
ns_os_shutdown(void) {
closelog();
cleanup_pidfile();
}