1 /* $OpenBSD: privsep.c,v 1.16 2006/10/25 20:55:04 moritz Exp $ */
4 * Copyright (c) 2003 Can Erkin Acar
5 * Copyright (c) 2003 Anil Madhavapeddy <anil@recoil.org>
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 #include <sys/cdefs.h>
21 __FBSDID("$FreeBSD$");
23 #include <sys/types.h>
25 #include <sys/socket.h>
44 /* XXX: pcap pollutes namespace with strlcpy if not present previously */
53 PRIV_SET_SNAPLEN, /* set the snaplength */
54 PRIV_MOVE_LOG, /* move logfile away */
55 PRIV_OPEN_LOG /* open logfile for appending */
58 static int priv_fd = -1;
59 static volatile pid_t child_pid = -1;
61 volatile sig_atomic_t gotsig_chld = 0;
63 static void sig_pass_to_chld(int);
64 static void sig_chld(int);
65 static int may_read(int, void *, size_t);
66 static void must_read(int, void *, size_t);
67 static void must_write(int, void *, size_t);
68 static int set_snaplen(int snap);
69 static int move_log(const char *name);
71 extern char *filename;
74 /* based on syslogd privsep */
78 int i, fd, socks[2], cmd;
79 int snaplen, ret, olderrno;
83 for (i = 1; i < NSIG; i++)
85 for (i = 1; i < _NSIG; i++)
90 if (socketpair(AF_LOCAL, SOCK_STREAM, PF_UNSPEC, socks) == -1)
91 err(1, "socketpair() failed");
93 pw = getpwnam("_pflogd");
95 errx(1, "unknown user _pflogd");
100 err(1, "fork() failed");
105 /* Child - drop privileges and return */
106 if (chroot(pw->pw_dir) != 0)
107 err(1, "unable to chroot");
109 err(1, "unable to chdir");
111 gidset[0] = pw->pw_gid;
112 if (setresgid(pw->pw_gid, pw->pw_gid, pw->pw_gid) == -1)
113 err(1, "setresgid() failed");
114 if (setgroups(1, gidset) == -1)
115 err(1, "setgroups() failed");
116 if (setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid) == -1)
117 err(1, "setresuid() failed");
124 /* Pass ALRM/TERM/HUP/INT/QUIT through to child, and accept CHLD */
125 signal(SIGALRM, sig_pass_to_chld);
126 signal(SIGTERM, sig_pass_to_chld);
127 signal(SIGHUP, sig_pass_to_chld);
128 signal(SIGINT, sig_pass_to_chld);
129 signal(SIGQUIT, sig_pass_to_chld);
130 signal(SIGCHLD, sig_chld);
132 setproctitle("[priv]");
135 while (!gotsig_chld) {
136 if (may_read(socks[0], &cmd, sizeof(int)))
139 case PRIV_SET_SNAPLEN:
141 "[priv]: msg PRIV_SET_SNAPLENGTH received");
142 must_read(socks[0], &snaplen, sizeof(int));
144 ret = set_snaplen(snaplen);
147 "[priv]: set_snaplen failed for snaplen %d",
151 must_write(socks[0], &ret, sizeof(int));
156 "[priv]: msg PRIV_OPEN_LOG received");
157 /* create or append logs but do not follow symlinks */
159 O_RDWR|O_CREAT|O_APPEND|O_NONBLOCK|O_NOFOLLOW,
162 send_fd(socks[0], fd);
165 "[priv]: failed to open %s: %s",
166 filename, strerror(olderrno));
173 "[priv]: msg PRIV_MOVE_LOG received");
174 ret = move_log(filename);
175 must_write(socks[0], &ret, sizeof(int));
179 logmsg(LOG_ERR, "[priv]: unknown command %d", cmd);
188 /* this is called from parent */
190 set_snaplen(int snap)
195 hpcap->snapshot = snap;
202 move_log(const char *name)
210 len = snprintf(ren, sizeof(ren), "%s.bad.%08x",
212 if (len >= sizeof(ren)) {
213 logmsg(LOG_ERR, "[priv] new name too long");
217 /* lock destinanion */
218 fd = open(ren, O_CREAT|O_EXCL, 0);
223 /* if file exists, try another name */
224 if (errno != EEXIST && errno != EINTR) {
225 logmsg(LOG_ERR, "[priv] failed to create new name: %s",
231 if (rename(name, ren)) {
232 logmsg(LOG_ERR, "[priv] failed to rename %s to %s: %s",
233 name, ren, strerror(errno));
238 "[priv]: log file %s moved to %s", name, ren);
244 * send the snaplength to privileged process
247 priv_set_snaplen(int snaplen)
252 errx(1, "%s: called from privileged portion", __func__);
254 cmd = PRIV_SET_SNAPLEN;
256 must_write(priv_fd, &cmd, sizeof(int));
257 must_write(priv_fd, &snaplen, sizeof(int));
259 must_read(priv_fd, &ret, sizeof(int));
261 /* also set hpcap->snapshot in child */
263 hpcap->snapshot = snaplen;
275 errx(1, "%s: called from privileged portion", __func__);
278 must_write(priv_fd, &cmd, sizeof(int));
279 fd = receive_fd(priv_fd);
283 /* Move-away and reopen log-file */
290 errx(1, "%s: called from privileged portion\n", __func__);
293 must_write(priv_fd, &cmd, sizeof(int));
294 must_read(priv_fd, &ret, sizeof(int));
299 /* If priv parent gets a TERM or HUP, pass it through to child instead */
301 sig_pass_to_chld(int sig)
306 kill(child_pid, sig);
310 /* if parent gets a SIGCHLD, it will exit */
317 /* Read all data or return 1 for error. */
319 may_read(int fd, void *buf, size_t n)
322 ssize_t res, pos = 0;
325 res = read(fd, s + pos, n - pos);
328 if (errno == EINTR || errno == EAGAIN)
339 /* Read data with the assertion that it all must come through, or
340 * else abort the process. Based on atomicio() from openssh. */
342 must_read(int fd, void *buf, size_t n)
345 ssize_t res, pos = 0;
348 res = read(fd, s + pos, n - pos);
351 if (errno == EINTR || errno == EAGAIN)
361 /* Write data with the assertion that it all has to be written, or
362 * else abort the process. Based on atomicio() from openssh. */
364 must_write(int fd, void *buf, size_t n)
367 ssize_t res, pos = 0;
370 res = write(fd, s + pos, n - pos);
373 if (errno == EINTR || errno == EAGAIN)