2 * Copyright (C) 2011 - David Goulet <david.goulet@polymtl.ca>
3 * Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License, version 2 only,
7 * as published by the Free Software Foundation.
9 * This program is distributed in the hope that it will be useful, but WITHOUT
10 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
14 * You should have received a copy of the GNU General Public License along
15 * with this program; if not, write to the Free Software Foundation, Inc.,
16 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
26 #include <sys/types.h>
31 #include <sys/signal.h>
35 #include <common/common.h>
36 #include <common/utils.h>
37 #include <common/compat/getenv.h>
38 #include <common/compat/prctl.h>
39 #include <common/sessiond-comm/unix.h>
44 typedef int (*run_as_fct
)(struct run_as_data
*data
);
46 struct run_as_mkdir_data
{
51 struct run_as_open_data
{
57 struct run_as_unlink_data
{
61 struct run_as_rmdir_recursive_data
{
69 RUN_AS_RMDIR_RECURSIVE
,
70 RUN_AS_MKDIR_RECURSIVE
,
76 struct run_as_mkdir_data mkdir
;
77 struct run_as_open_data open
;
78 struct run_as_unlink_data unlink
;
79 struct run_as_rmdir_recursive_data rmdir_recursive
;
90 struct run_as_worker
{
91 pid_t pid
; /* Worker PID. */
96 /* Single global worker per process (for now). */
97 static struct run_as_worker
*global_worker
;
98 /* Lock protecting the worker. */
99 static pthread_mutex_t worker_lock
= PTHREAD_MUTEX_INITIALIZER
;
111 return !lttng_secure_getenv("LTTNG_DEBUG_NOCLONE");
116 int _utils_mkdir_recursive_unsafe(const char *path
, mode_t mode
);
119 * Create recursively directory using the FULL path.
122 int _mkdir_recursive(struct run_as_data
*data
)
127 path
= data
->u
.mkdir
.path
;
128 mode
= data
->u
.mkdir
.mode
;
130 /* Safe to call as we have transitioned to the requested uid/gid. */
131 return _utils_mkdir_recursive_unsafe(path
, mode
);
135 int _mkdir(struct run_as_data
*data
)
137 return mkdir(data
->u
.mkdir
.path
, data
->u
.mkdir
.mode
);
141 int _open(struct run_as_data
*data
)
143 return open(data
->u
.open
.path
, data
->u
.open
.flags
, data
->u
.open
.mode
);
147 int _unlink(struct run_as_data
*data
)
149 return unlink(data
->u
.unlink
.path
);
153 int _rmdir_recursive(struct run_as_data
*data
)
155 return utils_recursive_rmdir(data
->u
.rmdir_recursive
.path
);
159 run_as_fct
run_as_enum_to_fct(enum run_as_cmd cmd
)
168 case RUN_AS_RMDIR_RECURSIVE
:
169 return _rmdir_recursive
;
170 case RUN_AS_MKDIR_RECURSIVE
:
171 return _mkdir_recursive
;
173 ERR("Unknown command %d", (int) cmd
)
179 int do_send_fd(struct run_as_worker
*worker
,
180 enum run_as_cmd cmd
, int fd
)
193 len
= lttcomm_send_fds_unix_sock(worker
->sockpair
[1], &fd
, 1);
195 PERROR("lttcomm_send_fds_unix_sock");
206 int do_recv_fd(struct run_as_worker
*worker
,
207 enum run_as_cmd cmd
, int *fd
)
220 len
= lttcomm_recv_fds_unix_sock(worker
->sockpair
[0], fd
, 1);
223 } else if (len
< 0) {
224 PERROR("lttcomm_recv_fds_unix_sock");
231 * Return < 0 on error, 0 if OK, 1 on hangup.
234 int handle_one_cmd(struct run_as_worker
*worker
)
237 struct run_as_data data
;
238 ssize_t readlen
, writelen
;
239 struct run_as_ret sendret
;
244 readlen
= lttcomm_recv_unix_sock(worker
->sockpair
[1], &data
,
251 if (readlen
< sizeof(data
)) {
252 PERROR("lttcomm_recv_unix_sock error");
257 cmd
= run_as_enum_to_fct(data
.cmd
);
263 prev_euid
= getuid();
264 if (data
.gid
!= getegid()) {
265 ret
= setegid(data
.gid
);
271 if (data
.uid
!= prev_euid
) {
272 ret
= seteuid(data
.uid
);
279 * Also set umask to 0 for mkdir executable bit.
286 sendret
._errno
= errno
;
287 /* send back return value */
288 writelen
= lttcomm_send_unix_sock(worker
->sockpair
[1], &sendret
,
290 if (writelen
< sizeof(sendret
)) {
291 PERROR("lttcomm_send_unix_sock error");
295 ret
= do_send_fd(worker
, data
.cmd
, ret
);
297 PERROR("do_send_fd error");
301 if (seteuid(prev_euid
) < 0) {
312 int run_as_worker(struct run_as_worker
*worker
)
316 struct run_as_ret sendret
;
317 size_t proc_orig_len
;
320 * Initialize worker. Set a different process cmdline.
322 proc_orig_len
= strlen(worker
->procname
);
323 memset(worker
->procname
, 0, proc_orig_len
);
324 strncpy(worker
->procname
, DEFAULT_RUN_AS_WORKER_NAME
, proc_orig_len
);
326 ret
= lttng_prctl(PR_SET_NAME
,
327 (unsigned long) DEFAULT_RUN_AS_WORKER_NAME
, 0, 0, 0);
328 if (ret
&& ret
!= -ENOSYS
) {
329 /* Don't fail as this is not essential. */
330 PERROR("prctl PR_SET_NAME");
336 writelen
= lttcomm_send_unix_sock(worker
->sockpair
[1], &sendret
,
338 if (writelen
< sizeof(sendret
)) {
339 PERROR("lttcomm_send_unix_sock error");
345 ret
= handle_one_cmd(worker
);
349 } else if (ret
> 0) {
352 continue; /* Next command. */
361 int run_as_cmd(struct run_as_worker
*worker
,
363 struct run_as_data
*data
,
364 uid_t uid
, gid_t gid
)
366 ssize_t readlen
, writelen
;
367 struct run_as_ret recvret
;
370 * If we are non-root, we can only deal with our own uid.
372 if (geteuid() != 0) {
373 if (uid
!= geteuid()) {
375 recvret
._errno
= EPERM
;
376 ERR("Client (%d)/Server (%d) UID mismatch (and sessiond is not root)",
377 (int) uid
, (int) geteuid());
386 writelen
= lttcomm_send_unix_sock(worker
->sockpair
[0], data
,
388 if (writelen
< sizeof(*data
)) {
389 PERROR("Error writing message to run_as");
391 recvret
._errno
= errno
;
395 /* receive return value */
396 readlen
= lttcomm_recv_unix_sock(worker
->sockpair
[0], &recvret
,
399 ERR("Run-as worker has hung-up during run_as_cmd");
401 recvret
._errno
= EIO
;
403 } else if (readlen
< sizeof(recvret
)) {
404 PERROR("Error reading response from run_as");
406 recvret
._errno
= errno
;
408 if (do_recv_fd(worker
, cmd
, &recvret
.ret
)) {
410 recvret
._errno
= EIO
;
414 errno
= recvret
._errno
;
419 * This is for debugging ONLY and should not be considered secure.
422 int run_as_noworker(enum run_as_cmd cmd
,
423 struct run_as_data
*data
, uid_t uid
, gid_t gid
)
425 int ret
, saved_errno
;
429 fct
= run_as_enum_to_fct(cmd
);
445 int run_as(enum run_as_cmd cmd
, struct run_as_data
*data
, uid_t uid
, gid_t gid
)
450 DBG("Using run_as worker");
451 pthread_mutex_lock(&worker_lock
);
452 assert(global_worker
);
453 ret
= run_as_cmd(global_worker
, cmd
, data
, uid
, gid
);
454 pthread_mutex_unlock(&worker_lock
);
457 DBG("Using run_as without worker");
458 ret
= run_as_noworker(cmd
, data
, uid
, gid
);
464 int run_as_mkdir_recursive(const char *path
, mode_t mode
, uid_t uid
, gid_t gid
)
466 struct run_as_data data
;
468 DBG3("mkdir() recursive %s with mode %d for uid %d and gid %d",
469 path
, (int) mode
, (int) uid
, (int) gid
);
470 strncpy(data
.u
.mkdir
.path
, path
, PATH_MAX
- 1);
471 data
.u
.mkdir
.path
[PATH_MAX
- 1] = '\0';
472 data
.u
.mkdir
.mode
= mode
;
473 return run_as(RUN_AS_MKDIR_RECURSIVE
, &data
, uid
, gid
);
477 int run_as_mkdir(const char *path
, mode_t mode
, uid_t uid
, gid_t gid
)
479 struct run_as_data data
;
481 DBG3("mkdir() %s with mode %d for uid %d and gid %d",
482 path
, (int) mode
, (int) uid
, (int) gid
);
483 strncpy(data
.u
.mkdir
.path
, path
, PATH_MAX
- 1);
484 data
.u
.mkdir
.path
[PATH_MAX
- 1] = '\0';
485 data
.u
.mkdir
.mode
= mode
;
486 return run_as(RUN_AS_MKDIR
, &data
, uid
, gid
);
490 * Note: open_run_as is currently not working. We'd need to pass the fd
491 * opened in the child to the parent.
494 int run_as_open(const char *path
, int flags
, mode_t mode
, uid_t uid
, gid_t gid
)
496 struct run_as_data data
;
498 DBG3("open() %s with flags %X mode %d for uid %d and gid %d",
499 path
, flags
, (int) mode
, (int) uid
, (int) gid
);
500 strncpy(data
.u
.open
.path
, path
, PATH_MAX
- 1);
501 data
.u
.open
.path
[PATH_MAX
- 1] = '\0';
502 data
.u
.open
.flags
= flags
;
503 data
.u
.open
.mode
= mode
;
504 return run_as(RUN_AS_OPEN
, &data
, uid
, gid
);
508 int run_as_unlink(const char *path
, uid_t uid
, gid_t gid
)
510 struct run_as_data data
;
512 DBG3("unlink() %s with for uid %d and gid %d",
513 path
, (int) uid
, (int) gid
);
514 strncpy(data
.u
.unlink
.path
, path
, PATH_MAX
- 1);
515 data
.u
.unlink
.path
[PATH_MAX
- 1] = '\0';
516 return run_as(RUN_AS_UNLINK
, &data
, uid
, gid
);
520 int run_as_rmdir_recursive(const char *path
, uid_t uid
, gid_t gid
)
522 struct run_as_data data
;
524 DBG3("rmdir_recursive() %s with for uid %d and gid %d",
525 path
, (int) uid
, (int) gid
);
526 strncpy(data
.u
.rmdir_recursive
.path
, path
, PATH_MAX
- 1);
527 data
.u
.rmdir_recursive
.path
[PATH_MAX
- 1] = '\0';
528 return run_as(RUN_AS_RMDIR_RECURSIVE
, &data
, uid
, gid
);
532 int reset_sighandler(void)
536 DBG("Resetting run_as worker signal handlers to default");
537 for (sig
= 1; sig
<= 31; sig
++) {
538 (void) signal(sig
, SIG_DFL
);
544 void worker_sighandler(int sig
)
549 * The worker will its parent's signals since they are part of the same
550 * process group. However, in the case of SIGINT and SIGTERM, we want
551 * to give the worker a chance to teardown gracefully when its parent
552 * closes the command socket.
565 DBG("run_as worker received signal %s", signame
);
569 int set_worker_sighandlers(void)
575 if ((ret
= sigemptyset(&sigset
)) < 0) {
576 PERROR("sigemptyset");
580 sa
.sa_handler
= worker_sighandler
;
583 if ((ret
= sigaction(SIGINT
, &sa
, NULL
)) < 0) {
584 PERROR("sigaction SIGINT");
588 if ((ret
= sigaction(SIGTERM
, &sa
, NULL
)) < 0) {
589 PERROR("sigaction SIGTERM");
593 DBG("run_as signal handler set for SIGTERM and SIGINT");
599 int run_as_create_worker(char *procname
)
604 struct run_as_ret recvret
;
605 struct run_as_worker
*worker
;
607 pthread_mutex_lock(&worker_lock
);
608 assert(!global_worker
);
611 * Don't initialize a worker, all run_as tasks will be performed
612 * in the current process.
617 worker
= zmalloc(sizeof(*worker
));
622 worker
->procname
= procname
;
623 /* Create unix socket. */
624 if (lttcomm_create_anon_unix_socketpair(worker
->sockpair
) < 0) {
634 } else if (pid
== 0) {
639 set_worker_sighandlers();
641 /* The child has no use for this lock. */
642 pthread_mutex_unlock(&worker_lock
);
643 /* Just close, no shutdown. */
644 if (close(worker
->sockpair
[0])) {
648 worker
->sockpair
[0] = -1;
649 ret
= run_as_worker(worker
);
650 if (lttcomm_close_unix_sock(worker
->sockpair
[1])) {
654 worker
->sockpair
[1] = -1;
655 LOG(ret
? PRINT_ERR
: PRINT_DBG
, "run_as worker exiting (ret = %d)", ret
);
656 exit(ret
? EXIT_FAILURE
: EXIT_SUCCESS
);
660 /* Just close, no shutdown. */
661 if (close(worker
->sockpair
[1])) {
666 worker
->sockpair
[1] = -1;
668 /* Wait for worker to become ready. */
669 readlen
= lttcomm_recv_unix_sock(worker
->sockpair
[0],
670 &recvret
, sizeof(recvret
));
671 if (readlen
< sizeof(recvret
)) {
672 ERR("readlen: %zd", readlen
);
673 PERROR("Error reading response from run_as at creation");
677 global_worker
= worker
;
680 pthread_mutex_unlock(&worker_lock
);
683 /* Error handling. */
685 for (i
= 0; i
< 2; i
++) {
686 if (worker
->sockpair
[i
] < 0) {
689 if (lttcomm_close_unix_sock(worker
->sockpair
[i
])) {
692 worker
->sockpair
[i
] = -1;
696 pthread_mutex_unlock(&worker_lock
);
701 void run_as_destroy_worker(void)
703 struct run_as_worker
*worker
= global_worker
;
705 DBG("Destroying run_as worker");
706 pthread_mutex_lock(&worker_lock
);
710 /* Close unix socket */
711 DBG("Closing run_as worker socket");
712 if (lttcomm_close_unix_sock(worker
->sockpair
[0])) {
715 worker
->sockpair
[0] = -1;
716 /* Wait for worker. */
721 wait_ret
= waitpid(worker
->pid
, &status
, 0);
723 if (errno
== EINTR
) {
730 if (WIFEXITED(status
)) {
731 LOG(WEXITSTATUS(status
) == 0 ? PRINT_DBG
: PRINT_ERR
,
732 DEFAULT_RUN_AS_WORKER_NAME
" terminated with status code %d",
733 WEXITSTATUS(status
));
735 } else if (WIFSIGNALED(status
)) {
736 ERR(DEFAULT_RUN_AS_WORKER_NAME
" was killed by signal %d",
742 global_worker
= NULL
;
744 pthread_mutex_unlock(&worker_lock
);