Fix: assert() on null index_file in lttng_index_file_write()
[lttng-tools.git] / src / common / runas.c
1 /*
2 * Copyright (C) 2011 - David Goulet <david.goulet@polymtl.ca>
3 * Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License, version 2 only,
7 * as published by the Free Software Foundation.
8 *
9 * This program is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
12 * more details.
13 *
14 * You should have received a copy of the GNU General Public License along
15 * with this program; if not, write to the Free Software Foundation, Inc.,
16 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
17 */
18
19 #define _LGPL_SOURCE
20 #include <errno.h>
21 #include <limits.h>
22 #include <stdio.h>
23 #include <stdlib.h>
24 #include <string.h>
25 #include <sys/wait.h>
26 #include <sys/types.h>
27 #include <sys/stat.h>
28 #include <unistd.h>
29 #include <fcntl.h>
30 #include <sched.h>
31 #include <signal.h>
32 #include <assert.h>
33 #include <signal.h>
34
35 #include <common/common.h>
36 #include <common/utils.h>
37 #include <common/compat/getenv.h>
38 #include <common/compat/prctl.h>
39 #include <common/unix.h>
40 #include <common/defaults.h>
41
42 #include "runas.h"
43
44 struct run_as_data;
45 typedef int (*run_as_fct)(struct run_as_data *data);
46
47 struct run_as_mkdir_data {
48 char path[PATH_MAX];
49 mode_t mode;
50 };
51
52 struct run_as_open_data {
53 char path[PATH_MAX];
54 int flags;
55 mode_t mode;
56 };
57
58 struct run_as_unlink_data {
59 char path[PATH_MAX];
60 };
61
62 struct run_as_rmdir_recursive_data {
63 char path[PATH_MAX];
64 };
65
66 enum run_as_cmd {
67 RUN_AS_MKDIR,
68 RUN_AS_OPEN,
69 RUN_AS_UNLINK,
70 RUN_AS_RMDIR_RECURSIVE,
71 RUN_AS_MKDIR_RECURSIVE,
72 };
73
74 struct run_as_data {
75 enum run_as_cmd cmd;
76 union {
77 struct run_as_mkdir_data mkdir;
78 struct run_as_open_data open;
79 struct run_as_unlink_data unlink;
80 struct run_as_rmdir_recursive_data rmdir_recursive;
81 } u;
82 uid_t uid;
83 gid_t gid;
84 };
85
86 struct run_as_ret {
87 int ret;
88 int _errno;
89 };
90
91 struct run_as_worker {
92 pid_t pid; /* Worker PID. */
93 int sockpair[2];
94 char *procname;
95 };
96
97 /* Single global worker per process (for now). */
98 static struct run_as_worker *global_worker;
99 /* Lock protecting the worker. */
100 static pthread_mutex_t worker_lock = PTHREAD_MUTEX_INITIALIZER;
101
102 #ifdef VALGRIND
103 static
104 int use_clone(void)
105 {
106 return 0;
107 }
108 #else
109 static
110 int use_clone(void)
111 {
112 return !lttng_secure_getenv("LTTNG_DEBUG_NOCLONE");
113 }
114 #endif
115
116 LTTNG_HIDDEN
117 int _utils_mkdir_recursive_unsafe(const char *path, mode_t mode);
118
119 /*
120 * Create recursively directory using the FULL path.
121 */
122 static
123 int _mkdir_recursive(struct run_as_data *data)
124 {
125 const char *path;
126 mode_t mode;
127
128 path = data->u.mkdir.path;
129 mode = data->u.mkdir.mode;
130
131 /* Safe to call as we have transitioned to the requested uid/gid. */
132 return _utils_mkdir_recursive_unsafe(path, mode);
133 }
134
135 static
136 int _mkdir(struct run_as_data *data)
137 {
138 return mkdir(data->u.mkdir.path, data->u.mkdir.mode);
139 }
140
141 static
142 int _open(struct run_as_data *data)
143 {
144 return open(data->u.open.path, data->u.open.flags, data->u.open.mode);
145 }
146
147 static
148 int _unlink(struct run_as_data *data)
149 {
150 return unlink(data->u.unlink.path);
151 }
152
153 static
154 int _rmdir_recursive(struct run_as_data *data)
155 {
156 return utils_recursive_rmdir(data->u.rmdir_recursive.path);
157 }
158
159 static
160 run_as_fct run_as_enum_to_fct(enum run_as_cmd cmd)
161 {
162 switch (cmd) {
163 case RUN_AS_MKDIR:
164 return _mkdir;
165 case RUN_AS_OPEN:
166 return _open;
167 case RUN_AS_UNLINK:
168 return _unlink;
169 case RUN_AS_RMDIR_RECURSIVE:
170 return _rmdir_recursive;
171 case RUN_AS_MKDIR_RECURSIVE:
172 return _mkdir_recursive;
173 default:
174 ERR("Unknown command %d", (int) cmd);
175 return NULL;
176 }
177 }
178
179 static
180 int do_send_fd(struct run_as_worker *worker,
181 enum run_as_cmd cmd, int fd)
182 {
183 ssize_t len;
184
185 switch (cmd) {
186 case RUN_AS_OPEN:
187 break;
188 default:
189 return 0;
190 }
191 if (fd < 0) {
192 return 0;
193 }
194 len = lttcomm_send_fds_unix_sock(worker->sockpair[1], &fd, 1);
195 if (len < 0) {
196 PERROR("lttcomm_send_fds_unix_sock");
197 return -1;
198 }
199 if (close(fd) < 0) {
200 PERROR("close");
201 return -1;
202 }
203 return 0;
204 }
205
206 static
207 int do_recv_fd(struct run_as_worker *worker,
208 enum run_as_cmd cmd, int *fd)
209 {
210 ssize_t len;
211
212 switch (cmd) {
213 case RUN_AS_OPEN:
214 break;
215 default:
216 return 0;
217 }
218 if (*fd < 0) {
219 return 0;
220 }
221 len = lttcomm_recv_fds_unix_sock(worker->sockpair[0], fd, 1);
222 if (!len) {
223 return -1;
224 } else if (len < 0) {
225 PERROR("lttcomm_recv_fds_unix_sock");
226 return -1;
227 }
228 return 0;
229 }
230
231 /*
232 * Return < 0 on error, 0 if OK, 1 on hangup.
233 */
234 static
235 int handle_one_cmd(struct run_as_worker *worker)
236 {
237 int ret = 0;
238 struct run_as_data data;
239 ssize_t readlen, writelen;
240 struct run_as_ret sendret;
241 run_as_fct cmd;
242 uid_t prev_euid;
243
244 /* Read data */
245 readlen = lttcomm_recv_unix_sock(worker->sockpair[1], &data,
246 sizeof(data));
247 if (readlen == 0) {
248 /* hang up */
249 ret = 1;
250 goto end;
251 }
252 if (readlen < sizeof(data)) {
253 PERROR("lttcomm_recv_unix_sock error");
254 ret = -1;
255 goto end;
256 }
257
258 cmd = run_as_enum_to_fct(data.cmd);
259 if (!cmd) {
260 ret = -1;
261 goto end;
262 }
263
264 prev_euid = getuid();
265 if (data.gid != getegid()) {
266 ret = setegid(data.gid);
267 if (ret < 0) {
268 PERROR("setegid");
269 goto write_return;
270 }
271 }
272 if (data.uid != prev_euid) {
273 ret = seteuid(data.uid);
274 if (ret < 0) {
275 PERROR("seteuid");
276 goto write_return;
277 }
278 }
279 /*
280 * Also set umask to 0 for mkdir executable bit.
281 */
282 umask(0);
283 ret = (*cmd)(&data);
284
285 write_return:
286 sendret.ret = ret;
287 sendret._errno = errno;
288 /* send back return value */
289 writelen = lttcomm_send_unix_sock(worker->sockpair[1], &sendret,
290 sizeof(sendret));
291 if (writelen < sizeof(sendret)) {
292 PERROR("lttcomm_send_unix_sock error");
293 ret = -1;
294 goto end;
295 }
296 ret = do_send_fd(worker, data.cmd, ret);
297 if (ret) {
298 PERROR("do_send_fd error");
299 ret = -1;
300 goto end;
301 }
302 if (seteuid(prev_euid) < 0) {
303 PERROR("seteuid");
304 ret = -1;
305 goto end;
306 }
307 ret = 0;
308 end:
309 return ret;
310 }
311
312 static
313 int run_as_worker(struct run_as_worker *worker)
314 {
315 int ret;
316 ssize_t writelen;
317 struct run_as_ret sendret;
318 size_t proc_orig_len;
319
320 /*
321 * Initialize worker. Set a different process cmdline.
322 */
323 proc_orig_len = strlen(worker->procname);
324 memset(worker->procname, 0, proc_orig_len);
325 strncpy(worker->procname, DEFAULT_RUN_AS_WORKER_NAME, proc_orig_len);
326
327 ret = lttng_prctl(PR_SET_NAME,
328 (unsigned long) DEFAULT_RUN_AS_WORKER_NAME, 0, 0, 0);
329 if (ret && ret != -ENOSYS) {
330 /* Don't fail as this is not essential. */
331 PERROR("prctl PR_SET_NAME");
332 ret = 0;
333 }
334
335 sendret.ret = 0;
336 sendret._errno = 0;
337 writelen = lttcomm_send_unix_sock(worker->sockpair[1], &sendret,
338 sizeof(sendret));
339 if (writelen < sizeof(sendret)) {
340 PERROR("lttcomm_send_unix_sock error");
341 ret = EXIT_FAILURE;
342 goto end;
343 }
344
345 for (;;) {
346 ret = handle_one_cmd(worker);
347 if (ret < 0) {
348 ret = EXIT_FAILURE;
349 goto end;
350 } else if (ret > 0) {
351 break;
352 } else {
353 continue; /* Next command. */
354 }
355 }
356 ret = EXIT_SUCCESS;
357 end:
358 return ret;
359 }
360
361 static
362 int run_as_cmd(struct run_as_worker *worker,
363 enum run_as_cmd cmd,
364 struct run_as_data *data,
365 uid_t uid, gid_t gid)
366 {
367 ssize_t readlen, writelen;
368 struct run_as_ret recvret;
369
370 /*
371 * If we are non-root, we can only deal with our own uid.
372 */
373 if (geteuid() != 0) {
374 if (uid != geteuid()) {
375 recvret.ret = -1;
376 recvret._errno = EPERM;
377 ERR("Client (%d)/Server (%d) UID mismatch (and sessiond is not root)",
378 (int) uid, (int) geteuid());
379 goto end;
380 }
381 }
382
383 data->cmd = cmd;
384 data->uid = uid;
385 data->gid = gid;
386
387 writelen = lttcomm_send_unix_sock(worker->sockpair[0], data,
388 sizeof(*data));
389 if (writelen < sizeof(*data)) {
390 PERROR("Error writing message to run_as");
391 recvret.ret = -1;
392 recvret._errno = errno;
393 goto end;
394 }
395
396 /* receive return value */
397 readlen = lttcomm_recv_unix_sock(worker->sockpair[0], &recvret,
398 sizeof(recvret));
399 if (!readlen) {
400 ERR("Run-as worker has hung-up during run_as_cmd");
401 recvret.ret = -1;
402 recvret._errno = EIO;
403 goto end;
404 } else if (readlen < sizeof(recvret)) {
405 PERROR("Error reading response from run_as");
406 recvret.ret = -1;
407 recvret._errno = errno;
408 }
409 if (do_recv_fd(worker, cmd, &recvret.ret)) {
410 recvret.ret = -1;
411 recvret._errno = EIO;
412 }
413
414 end:
415 errno = recvret._errno;
416 return recvret.ret;
417 }
418
419 /*
420 * This is for debugging ONLY and should not be considered secure.
421 */
422 static
423 int run_as_noworker(enum run_as_cmd cmd,
424 struct run_as_data *data, uid_t uid, gid_t gid)
425 {
426 int ret, saved_errno;
427 mode_t old_mask;
428 run_as_fct fct;
429
430 fct = run_as_enum_to_fct(cmd);
431 if (!fct) {
432 errno = -ENOSYS;
433 ret = -1;
434 goto end;
435 }
436 old_mask = umask(0);
437 ret = fct(data);
438 saved_errno = errno;
439 umask(old_mask);
440 errno = saved_errno;
441 end:
442 return ret;
443 }
444
445 static
446 int run_as(enum run_as_cmd cmd, struct run_as_data *data, uid_t uid, gid_t gid)
447 {
448 int ret;
449
450 if (use_clone()) {
451 DBG("Using run_as worker");
452 pthread_mutex_lock(&worker_lock);
453 assert(global_worker);
454 ret = run_as_cmd(global_worker, cmd, data, uid, gid);
455 pthread_mutex_unlock(&worker_lock);
456
457 } else {
458 DBG("Using run_as without worker");
459 ret = run_as_noworker(cmd, data, uid, gid);
460 }
461 return ret;
462 }
463
464 LTTNG_HIDDEN
465 int run_as_mkdir_recursive(const char *path, mode_t mode, uid_t uid, gid_t gid)
466 {
467 struct run_as_data data;
468
469 DBG3("mkdir() recursive %s with mode %d for uid %d and gid %d",
470 path, (int) mode, (int) uid, (int) gid);
471 strncpy(data.u.mkdir.path, path, PATH_MAX - 1);
472 data.u.mkdir.path[PATH_MAX - 1] = '\0';
473 data.u.mkdir.mode = mode;
474 return run_as(RUN_AS_MKDIR_RECURSIVE, &data, uid, gid);
475 }
476
477 LTTNG_HIDDEN
478 int run_as_mkdir(const char *path, mode_t mode, uid_t uid, gid_t gid)
479 {
480 struct run_as_data data;
481
482 DBG3("mkdir() %s with mode %d for uid %d and gid %d",
483 path, (int) mode, (int) uid, (int) gid);
484 strncpy(data.u.mkdir.path, path, PATH_MAX - 1);
485 data.u.mkdir.path[PATH_MAX - 1] = '\0';
486 data.u.mkdir.mode = mode;
487 return run_as(RUN_AS_MKDIR, &data, uid, gid);
488 }
489
490 LTTNG_HIDDEN
491 int run_as_open(const char *path, int flags, mode_t mode, uid_t uid, gid_t gid)
492 {
493 struct run_as_data data;
494
495 DBG3("open() %s with flags %X mode %d for uid %d and gid %d",
496 path, flags, (int) mode, (int) uid, (int) gid);
497 strncpy(data.u.open.path, path, PATH_MAX - 1);
498 data.u.open.path[PATH_MAX - 1] = '\0';
499 data.u.open.flags = flags;
500 data.u.open.mode = mode;
501 return run_as(RUN_AS_OPEN, &data, uid, gid);
502 }
503
504 LTTNG_HIDDEN
505 int run_as_unlink(const char *path, uid_t uid, gid_t gid)
506 {
507 struct run_as_data data;
508
509 DBG3("unlink() %s with for uid %d and gid %d",
510 path, (int) uid, (int) gid);
511 strncpy(data.u.unlink.path, path, PATH_MAX - 1);
512 data.u.unlink.path[PATH_MAX - 1] = '\0';
513 return run_as(RUN_AS_UNLINK, &data, uid, gid);
514 }
515
516 LTTNG_HIDDEN
517 int run_as_rmdir_recursive(const char *path, uid_t uid, gid_t gid)
518 {
519 struct run_as_data data;
520
521 DBG3("rmdir_recursive() %s with for uid %d and gid %d",
522 path, (int) uid, (int) gid);
523 strncpy(data.u.rmdir_recursive.path, path, PATH_MAX - 1);
524 data.u.rmdir_recursive.path[PATH_MAX - 1] = '\0';
525 return run_as(RUN_AS_RMDIR_RECURSIVE, &data, uid, gid);
526 }
527
528 static
529 int reset_sighandler(void)
530 {
531 int sig;
532
533 DBG("Resetting run_as worker signal handlers to default");
534 for (sig = 1; sig <= 31; sig++) {
535 (void) signal(sig, SIG_DFL);
536 }
537 return 0;
538 }
539
540 static
541 void worker_sighandler(int sig)
542 {
543 const char *signame;
544
545 /*
546 * The worker will inherit its parent's signals since they are part of
547 * the same process group. However, in the case of SIGINT and SIGTERM,
548 * we want to give the worker a chance to teardown gracefully when its
549 * parent closes the command socket.
550 */
551 switch (sig) {
552 case SIGINT:
553 signame = "SIGINT";
554 break;
555 case SIGTERM:
556 signame = "SIGTERM";
557 break;
558 default:
559 signame = NULL;
560 }
561
562 if (signame) {
563 DBG("run_as worker received signal %s", signame);
564 } else {
565 DBG("run_as_worker received signal %d", sig);
566 }
567 }
568
569 static
570 int set_worker_sighandlers(void)
571 {
572 int ret = 0;
573 sigset_t sigset;
574 struct sigaction sa;
575
576 if ((ret = sigemptyset(&sigset)) < 0) {
577 PERROR("sigemptyset");
578 goto end;
579 }
580
581 sa.sa_handler = worker_sighandler;
582 sa.sa_mask = sigset;
583 sa.sa_flags = 0;
584 if ((ret = sigaction(SIGINT, &sa, NULL)) < 0) {
585 PERROR("sigaction SIGINT");
586 goto end;
587 }
588
589 if ((ret = sigaction(SIGTERM, &sa, NULL)) < 0) {
590 PERROR("sigaction SIGTERM");
591 goto end;
592 }
593
594 DBG("run_as signal handler set for SIGTERM and SIGINT");
595 end:
596 return ret;
597 }
598
599 LTTNG_HIDDEN
600 int run_as_create_worker(char *procname)
601 {
602 pid_t pid;
603 int i, ret = 0;
604 ssize_t readlen;
605 struct run_as_ret recvret;
606 struct run_as_worker *worker;
607
608 pthread_mutex_lock(&worker_lock);
609 assert(!global_worker);
610 if (!use_clone()) {
611 /*
612 * Don't initialize a worker, all run_as tasks will be performed
613 * in the current process.
614 */
615 ret = 0;
616 goto end;
617 }
618 worker = zmalloc(sizeof(*worker));
619 if (!worker) {
620 ret = -ENOMEM;
621 goto end;
622 }
623 worker->procname = procname;
624 /* Create unix socket. */
625 if (lttcomm_create_anon_unix_socketpair(worker->sockpair) < 0) {
626 ret = -1;
627 goto error_sock;
628 }
629 /* Fork worker. */
630 pid = fork();
631 if (pid < 0) {
632 PERROR("fork");
633 ret = -1;
634 goto error_fork;
635 } else if (pid == 0) {
636 /* Child */
637
638 reset_sighandler();
639
640 set_worker_sighandlers();
641
642 /* The child has no use for this lock. */
643 pthread_mutex_unlock(&worker_lock);
644 /* Just close, no shutdown. */
645 if (close(worker->sockpair[0])) {
646 PERROR("close");
647 exit(EXIT_FAILURE);
648 }
649 worker->sockpair[0] = -1;
650 ret = run_as_worker(worker);
651 if (lttcomm_close_unix_sock(worker->sockpair[1])) {
652 PERROR("close");
653 ret = -1;
654 }
655 worker->sockpair[1] = -1;
656 LOG(ret ? PRINT_ERR : PRINT_DBG, "run_as worker exiting (ret = %d)", ret);
657 exit(ret ? EXIT_FAILURE : EXIT_SUCCESS);
658 } else {
659 /* Parent */
660
661 /* Just close, no shutdown. */
662 if (close(worker->sockpair[1])) {
663 PERROR("close");
664 ret = -1;
665 goto error_fork;
666 }
667 worker->sockpair[1] = -1;
668 worker->pid = pid;
669 /* Wait for worker to become ready. */
670 readlen = lttcomm_recv_unix_sock(worker->sockpair[0],
671 &recvret, sizeof(recvret));
672 if (readlen < sizeof(recvret)) {
673 ERR("readlen: %zd", readlen);
674 PERROR("Error reading response from run_as at creation");
675 ret = -1;
676 goto error_fork;
677 }
678 global_worker = worker;
679 }
680 end:
681 pthread_mutex_unlock(&worker_lock);
682 return ret;
683
684 /* Error handling. */
685 error_fork:
686 for (i = 0; i < 2; i++) {
687 if (worker->sockpair[i] < 0) {
688 continue;
689 }
690 if (lttcomm_close_unix_sock(worker->sockpair[i])) {
691 PERROR("close");
692 }
693 worker->sockpair[i] = -1;
694 }
695 error_sock:
696 free(worker);
697 pthread_mutex_unlock(&worker_lock);
698 return ret;
699 }
700
701 LTTNG_HIDDEN
702 void run_as_destroy_worker(void)
703 {
704 struct run_as_worker *worker = global_worker;
705
706 DBG("Destroying run_as worker");
707 pthread_mutex_lock(&worker_lock);
708 if (!worker) {
709 goto end;
710 }
711 /* Close unix socket */
712 DBG("Closing run_as worker socket");
713 if (lttcomm_close_unix_sock(worker->sockpair[0])) {
714 PERROR("close");
715 }
716 worker->sockpair[0] = -1;
717 /* Wait for worker. */
718 for (;;) {
719 int status;
720 pid_t wait_ret;
721
722 wait_ret = waitpid(worker->pid, &status, 0);
723 if (wait_ret < 0) {
724 if (errno == EINTR) {
725 continue;
726 }
727 PERROR("waitpid");
728 break;
729 }
730
731 if (WIFEXITED(status)) {
732 LOG(WEXITSTATUS(status) == 0 ? PRINT_DBG : PRINT_ERR,
733 DEFAULT_RUN_AS_WORKER_NAME " terminated with status code %d",
734 WEXITSTATUS(status));
735 break;
736 } else if (WIFSIGNALED(status)) {
737 ERR(DEFAULT_RUN_AS_WORKER_NAME " was killed by signal %d",
738 WTERMSIG(status));
739 break;
740 }
741 }
742 free(worker);
743 global_worker = NULL;
744 end:
745 pthread_mutex_unlock(&worker_lock);
746 }
This page took 0.045011 seconds and 4 git commands to generate.