Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	sbin/pflogd/privsep.c	Lines:	0	134	0.0 %
Date:	2016-12-06	Branches:	0	81	0.0 %


/*	$OpenBSD: privsep.c,v 1.22 2016/01/16 03:17:48 canacar Exp $	*/

/*
 * Copyright (c) 2003 Can Erkin Acar
 * Copyright (c) 2003 Anil Madhavapeddy <anil@recoil.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */
#include <sys/types.h>
#include <sys/time.h>
#include <sys/socket.h>
#include <sys/ioctl.h>

#include <net/if.h>
#include <net/bpf.h>

#include <err.h>
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
#include <pcap.h>
#include <pcap-int.h>
#include <pwd.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <syslog.h>
#include <unistd.h>
#include "pflogd.h"

enum cmd_types {
	PRIV_SET_SNAPLEN,	/* set the snaplength */
	PRIV_MOVE_LOG,		/* move logfile away */
	PRIV_OPEN_LOG,		/* open logfile for appending */
};

static int priv_fd = -1;
static volatile pid_t child_pid = -1;

volatile sig_atomic_t gotsig_chld = 0;

static void sig_pass_to_chld(int);
static void sig_chld(int);
static int  may_read(int, void *, size_t);
static void must_read(int, void *, size_t);
static void must_write(int, void *, size_t);
static int  set_snaplen(int snap);
static int  move_log(const char *name);

extern char *filename;
extern pcap_t *hpcap;

/* based on syslogd privsep */
int
priv_init(void)
{
	int i, bpfd = -1, socks[2], cmd;
	int snaplen, ret, olderrno;
	struct passwd *pw;

	for (i = 1; i < _NSIG; i++)
		signal(i, SIG_DFL);

	/* Create sockets */
	if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, socks) == -1)
		err(1, "socketpair() failed");

	pw = getpwnam("_pflogd");
	if (pw == NULL)
		errx(1, "unknown user _pflogd");
	endpwent();

	child_pid = fork();
	if (child_pid < 0)
		err(1, "fork() failed");

	if (!child_pid) {
		gid_t gidset[1];

		/* Child - drop privileges and return */
		if (chroot(pw->pw_dir) != 0)
			err(1, "unable to chroot");
		if (chdir("/") != 0)
			err(1, "unable to chdir");

		gidset[0] = pw->pw_gid;
		if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1)
			err(1, "setresgid() failed");
		if (setgroups(1, gidset) == -1)
			err(1, "setgroups() failed");
		if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1)
			err(1, "setresuid() failed");
		close(socks[0]);
		priv_fd = socks[1];
		return 0;
	}

	/* Father */
	/* Pass ALRM/TERM/HUP/INT/QUIT through to child, and accept CHLD */
	signal(SIGALRM, sig_pass_to_chld);
	signal(SIGTERM, sig_pass_to_chld);
	signal(SIGHUP,  sig_pass_to_chld);
	signal(SIGINT,  sig_pass_to_chld);
	signal(SIGQUIT, sig_pass_to_chld);
	signal(SIGCHLD, sig_chld);

	setproctitle("[priv]");
	close(socks[1]);


#if notyet
	/* This needs to do bpf ioctl */
	if (pledge("stdio rpath wpath cpath ioctl sendfd", NULL) == -1)
		err(1, "pledge");
#endif
	while (!gotsig_chld) {
		if (may_read(socks[0], &cmd, sizeof(int)))
			break;
		switch (cmd) {
		case PRIV_SET_SNAPLEN:
			logmsg(LOG_DEBUG,
			    "[priv]: msg PRIV_SET_SNAPLENGTH received");
			must_read(socks[0], &snaplen, sizeof(int));

			ret = set_snaplen(snaplen);
			if (ret) {
				logmsg(LOG_NOTICE,
				   "[priv]: set_snaplen failed for snaplen %d",
				   snaplen);
			}

			must_write(socks[0], &ret, sizeof(int));
			break;

		case PRIV_OPEN_LOG:
			logmsg(LOG_DEBUG,
			    "[priv]: msg PRIV_OPEN_LOG received");
			/* create or append logs but do not follow symlinks */
			if (bpfd != -1) {
				close(bpfd);
				bpfd = -1;
			}
			bpfd = open(filename,
			    O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_NOFOLLOW,
			    0600);
			olderrno = errno;
			send_fd(socks[0], bpfd);
			if (bpfd < 0)
				logmsg(LOG_NOTICE,
				    "[priv]: failed to open %s: %s",
				    filename, strerror(olderrno));
			break;

		case PRIV_MOVE_LOG:
			logmsg(LOG_DEBUG,
			    "[priv]: msg PRIV_MOVE_LOG received");
			ret = move_log(filename);
			must_write(socks[0], &ret, sizeof(int));
			break;

		default:
			logmsg(LOG_ERR, "[priv]: unknown command %d", cmd);
			_exit(1);
			/* NOTREACHED */
		}
	}

	_exit(1);
}

/* this is called from parent */
static int
set_snaplen(int snap)
{
	if (hpcap == NULL)
		return (1);

	hpcap->snapshot = snap;
	set_pcap_filter();

	return 0;
}

static int
move_log(const char *name)
{
	char ren[PATH_MAX];
	int len;

	for (;;) {
		int fd;

		len = snprintf(ren, sizeof(ren), "%s.bad.XXXXXXXX", name);
		if (len >= sizeof(ren)) {
			logmsg(LOG_ERR, "[priv] new name too long");
			return (1);
		}

		/* lock destination */
		fd = mkstemp(ren);
		if (fd >= 0) {
			close(fd);
			break;
		}
		if (errno != EINTR) {
			logmsg(LOG_ERR, "[priv] failed to create new name: %s",
			    strerror(errno));
			return (1);
		}
	}

	if (rename(name, ren)) {
		logmsg(LOG_ERR, "[priv] failed to rename %s to %s: %s",
		    name, ren, strerror(errno));
		unlink(ren);
		return (1);
	}

	logmsg(LOG_NOTICE,
	       "[priv]: log file %s moved to %s", name, ren);

	return (0);
}

/*
 * send the snaplength to privileged process
 */
int
priv_set_snaplen(int snaplen)
{
	int cmd, ret;

	if (priv_fd < 0)
		errx(1, "%s: called from privileged portion", __func__);

	cmd = PRIV_SET_SNAPLEN;

	must_write(priv_fd, &cmd, sizeof(int));
	must_write(priv_fd, &snaplen, sizeof(int));

	must_read(priv_fd, &ret, sizeof(int));

	/* also set hpcap->snapshot in child */
	if (ret == 0)
		hpcap->snapshot = snaplen;

	return (ret);
}

/* Open log-file */
int
priv_open_log(void)
{
	int cmd, fd;

	if (priv_fd < 0)
		errx(1, "%s: called from privileged portion", __func__);

	cmd = PRIV_OPEN_LOG;
	must_write(priv_fd, &cmd, sizeof(int));
	fd = receive_fd(priv_fd);

	return (fd);
}

/* Move-away and reopen log-file */
int
priv_move_log(void)
{
	int cmd, ret;

	if (priv_fd < 0)
		errx(1, "%s: called from privileged portion", __func__);

	cmd = PRIV_MOVE_LOG;
	must_write(priv_fd, &cmd, sizeof(int));
	must_read(priv_fd, &ret, sizeof(int));

	return (ret);
}

/* If priv parent gets a TERM or HUP, pass it through to child instead */
static void
sig_pass_to_chld(int sig)
{
	int oerrno = errno;

	if (child_pid != -1)
		kill(child_pid, sig);
	errno = oerrno;
}

/* if parent gets a SIGCHLD, it will exit */
static void
sig_chld(int sig)
{
	gotsig_chld = 1;
}

/* Read all data or return 1 for error.  */
static int
may_read(int fd, void *buf, size_t n)
{
	char *s = buf;
	ssize_t res, pos = 0;

	while (n > pos) {
		res = read(fd, s + pos, n - pos);
		switch (res) {
		case -1:
			if (errno == EINTR || errno == EAGAIN)
				continue;
		case 0:
			return (1);
		default:
			pos += res;
		}
	}
	return (0);
}

/* Read data with the assertion that it all must come through, or
 * else abort the process.  Based on atomicio() from openssh. */
static void
must_read(int fd, void *buf, size_t n)
{
	char *s = buf;
	ssize_t res, pos = 0;

	while (n > pos) {
		res = read(fd, s + pos, n - pos);
		switch (res) {
		case -1:
			if (errno == EINTR || errno == EAGAIN)
				continue;
		case 0:
			_exit(0);
		default:
			pos += res;
		}
	}
}

/* Write data with the assertion that it all has to be written, or
 * else abort the process.  Based on atomicio() from openssh. */
static void
must_write(int fd, void *buf, size_t n)
{
	char *s = buf;
	ssize_t res, pos = 0;

	while (n > pos) {
		res = write(fd, s + pos, n - pos);
		switch (res) {
		case -1:
			if (errno == EINTR || errno == EAGAIN)
				continue;
		case 0:
			_exit(0);
		default:
			pos += res;
		}
	}
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: privsep.c,v 1.22 2016/01/16 03:17:48 canacar Exp $ */
2
3			/*
4			* Copyright (c) 2003 Can Erkin Acar
5			* Copyright (c) 2003 Anil Madhavapeddy <anil@recoil.org>
6			*
7			* Permission to use, copy, modify, and distribute this software for any
8			* purpose with or without fee is hereby granted, provided that the above
9			* copyright notice and this permission notice appear in all copies.
10			*
11			* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12			* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13			* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14			* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15			* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16			* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17			* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18			*/
19			#include <sys/types.h>
20			#include <sys/time.h>
21			#include <sys/socket.h>
22			#include <sys/ioctl.h>
23
24			#include <net/if.h>
25			#include <net/bpf.h>
26
27			#include <err.h>
28			#include <errno.h>
29			#include <fcntl.h>
30			#include <limits.h>
31			#include <pcap.h>
32			#include <pcap-int.h>
33			#include <pwd.h>
34			#include <signal.h>
35			#include <stdio.h>
36			#include <stdlib.h>
37			#include <string.h>
38			#include <syslog.h>
39			#include <unistd.h>
40			#include "pflogd.h"
41
42			enum cmd_types {
43			PRIV_SET_SNAPLEN, /* set the snaplength */
44			PRIV_MOVE_LOG, /* move logfile away */
45			PRIV_OPEN_LOG, /* open logfile for appending */
46			};
47
48			static int priv_fd = -1;
49			static volatile pid_t child_pid = -1;
50
51			volatile sig_atomic_t gotsig_chld = 0;
52
53			static void sig_pass_to_chld(int);
54			static void sig_chld(int);
55			static int may_read(int, void *, size_t);
56			static void must_read(int, void *, size_t);
57			static void must_write(int, void *, size_t);
58			static int set_snaplen(int snap);
59			static int move_log(const char *name);
60
61			extern char *filename;
62			extern pcap_t *hpcap;
63
64			/* based on syslogd privsep */
65			int
66			priv_init(void)
67			{
68			int i, bpfd = -1, socks[2], cmd;
69			int snaplen, ret, olderrno;
70			struct passwd *pw;
71
72			for (i = 1; i < _NSIG; i++)
73			signal(i, SIG_DFL);
74
75			/* Create sockets */
76			if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, socks) == -1)
77			err(1, "socketpair() failed");
78
79			pw = getpwnam("_pflogd");
80			if (pw == NULL)
81			errx(1, "unknown user _pflogd");
82			endpwent();
83
84			child_pid = fork();
85			if (child_pid < 0)
86			err(1, "fork() failed");
87
88			if (!child_pid) {
89			gid_t gidset[1];
90
91			/* Child - drop privileges and return */
92			if (chroot(pw->pw_dir) != 0)
93			err(1, "unable to chroot");
94			if (chdir("/") != 0)
95			err(1, "unable to chdir");
96
97			gidset[0] = pw->pw_gid;
98			if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1)
99			err(1, "setresgid() failed");
100			if (setgroups(1, gidset) == -1)
101			err(1, "setgroups() failed");
102			if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1)
103			err(1, "setresuid() failed");
104			close(socks[0]);
105			priv_fd = socks[1];
106			return 0;
107			}
108
109			/* Father */
110			/* Pass ALRM/TERM/HUP/INT/QUIT through to child, and accept CHLD */
111			signal(SIGALRM, sig_pass_to_chld);
112			signal(SIGTERM, sig_pass_to_chld);
113			signal(SIGHUP, sig_pass_to_chld);
114			signal(SIGINT, sig_pass_to_chld);
115			signal(SIGQUIT, sig_pass_to_chld);
116			signal(SIGCHLD, sig_chld);
117
118			setproctitle("[priv]");
119			close(socks[1]);
120
121
122			#if notyet
123			/* This needs to do bpf ioctl */
124			if (pledge("stdio rpath wpath cpath ioctl sendfd", NULL) == -1)
125			err(1, "pledge");
126			#endif
127			while (!gotsig_chld) {
128			if (may_read(socks[0], &cmd, sizeof(int)))
129			break;
130			switch (cmd) {
131			case PRIV_SET_SNAPLEN:
132			logmsg(LOG_DEBUG,
133			"[priv]: msg PRIV_SET_SNAPLENGTH received");
134			must_read(socks[0], &snaplen, sizeof(int));
135
136			ret = set_snaplen(snaplen);
137			if (ret) {
138			logmsg(LOG_NOTICE,
139			"[priv]: set_snaplen failed for snaplen %d",
140			snaplen);
141			}
142
143			must_write(socks[0], &ret, sizeof(int));
144			break;
145
146			case PRIV_OPEN_LOG:
147			logmsg(LOG_DEBUG,
148			"[priv]: msg PRIV_OPEN_LOG received");
149			/* create or append logs but do not follow symlinks */
150			if (bpfd != -1) {
151			close(bpfd);
152			bpfd = -1;
153			}
154			bpfd = open(filename,
155			O_RDWR\|O_CREAT\|O_APPEND\|O_NONBLOCK\|O_NOFOLLOW,
156			0600);
157			olderrno = errno;
158			send_fd(socks[0], bpfd);
159			if (bpfd < 0)
160			logmsg(LOG_NOTICE,
161			"[priv]: failed to open %s: %s",
162			filename, strerror(olderrno));
163			break;
164
165			case PRIV_MOVE_LOG:
166			logmsg(LOG_DEBUG,
167			"[priv]: msg PRIV_MOVE_LOG received");
168			ret = move_log(filename);
169			must_write(socks[0], &ret, sizeof(int));
170			break;
171
172			default:
173			logmsg(LOG_ERR, "[priv]: unknown command %d", cmd);
174			_exit(1);
175			/* NOTREACHED */
176			}
177			}
178
179			_exit(1);
180			}
181
182			/* this is called from parent */
183			static int
184			set_snaplen(int snap)
185			{
186			if (hpcap == NULL)
187			return (1);
188
189			hpcap->snapshot = snap;
190			set_pcap_filter();
191
192			return 0;
193			}
194
195			static int
196			move_log(const char *name)
197			{
198			char ren[PATH_MAX];
199			int len;
200
201			for (;;) {
202			int fd;
203
204			len = snprintf(ren, sizeof(ren), "%s.bad.XXXXXXXX", name);
205			if (len >= sizeof(ren)) {
206			logmsg(LOG_ERR, "[priv] new name too long");
207			return (1);
208			}
209
210			/* lock destination */
211			fd = mkstemp(ren);
212			if (fd >= 0) {
213			close(fd);
214			break;
215			}
216			if (errno != EINTR) {
217			logmsg(LOG_ERR, "[priv] failed to create new name: %s",
218			strerror(errno));
219			return (1);
220			}
221			}
222
223			if (rename(name, ren)) {
224			logmsg(LOG_ERR, "[priv] failed to rename %s to %s: %s",
225			name, ren, strerror(errno));
226			unlink(ren);
227			return (1);
228			}
229
230			logmsg(LOG_NOTICE,
231			"[priv]: log file %s moved to %s", name, ren);
232
233			return (0);
234			}
235
236			/*
237			* send the snaplength to privileged process
238			*/
239			int
240			priv_set_snaplen(int snaplen)
241			{
242			int cmd, ret;
243
244			if (priv_fd < 0)
245			errx(1, "%s: called from privileged portion", __func__);
246
247			cmd = PRIV_SET_SNAPLEN;
248
249			must_write(priv_fd, &cmd, sizeof(int));
250			must_write(priv_fd, &snaplen, sizeof(int));
251
252			must_read(priv_fd, &ret, sizeof(int));
253
254			/* also set hpcap->snapshot in child */
255			if (ret == 0)
256			hpcap->snapshot = snaplen;
257
258			return (ret);
259			}
260
261			/* Open log-file */
262			int
263			priv_open_log(void)
264			{
265			int cmd, fd;
266
267			if (priv_fd < 0)
268			errx(1, "%s: called from privileged portion", __func__);
269
270			cmd = PRIV_OPEN_LOG;
271			must_write(priv_fd, &cmd, sizeof(int));
272			fd = receive_fd(priv_fd);
273
274			return (fd);
275			}
276
277			/* Move-away and reopen log-file */
278			int
279			priv_move_log(void)
280			{
281			int cmd, ret;
282
283			if (priv_fd < 0)
284			errx(1, "%s: called from privileged portion", __func__);
285
286			cmd = PRIV_MOVE_LOG;
287			must_write(priv_fd, &cmd, sizeof(int));
288			must_read(priv_fd, &ret, sizeof(int));
289
290			return (ret);
291			}
292
293			/* If priv parent gets a TERM or HUP, pass it through to child instead */
294			static void
295			sig_pass_to_chld(int sig)
296			{
297			int oerrno = errno;
298
299			if (child_pid != -1)
300			kill(child_pid, sig);
301			errno = oerrno;
302			}
303
304			/* if parent gets a SIGCHLD, it will exit */
305			static void
306			sig_chld(int sig)
307			{
308			gotsig_chld = 1;
309			}
310
311			/* Read all data or return 1 for error. */
312			static int
313			may_read(int fd, void *buf, size_t n)
314			{
315			char *s = buf;
316			ssize_t res, pos = 0;
317
318			while (n > pos) {
319			res = read(fd, s + pos, n - pos);
320			switch (res) {
321			case -1:
322			if (errno == EINTR \|\| errno == EAGAIN)
323			continue;
324			case 0:
325			return (1);
326			default:
327			pos += res;
328			}
329			}
330			return (0);
331			}
332
333			/* Read data with the assertion that it all must come through, or
334			* else abort the process. Based on atomicio() from openssh. */
335			static void
336			must_read(int fd, void *buf, size_t n)
337			{
338			char *s = buf;
339			ssize_t res, pos = 0;
340
341			while (n > pos) {
342			res = read(fd, s + pos, n - pos);
343			switch (res) {
344			case -1:
345			if (errno == EINTR \|\| errno == EAGAIN)
346			continue;
347			case 0:
348			_exit(0);
349			default:
350			pos += res;
351			}
352			}
353			}
354
355			/* Write data with the assertion that it all has to be written, or
356			* else abort the process. Based on atomicio() from openssh. */
357			static void
358			must_write(int fd, void *buf, size_t n)
359			{
360			char *s = buf;
361			ssize_t res, pos = 0;
362
363			while (n > pos) {
364			res = write(fd, s + pos, n - pos);
365			switch (res) {
366			case -1:
367			if (errno == EINTR \|\| errno == EAGAIN)
368			continue;
369			case 0:
370			_exit(0);
371			default:
372			pos += res;
373			}
374			}
375			}