2 * Copyright (c) 2010 The FreeBSD Foundation
3 * Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>
6 * This software was developed by Pawel Jakub Dawidek under sponsorship from
7 * the FreeBSD Foundation.
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
35 #include <sys/capability.h>
37 #include <sys/param.h>
39 #include <sys/ioctl.h>
58 vsnprlcat(char *str, size_t size, const char *fmt, va_list ap)
63 return (vsnprintf(str + len, size - len, fmt, ap));
67 snprlcat(char *str, size_t size, const char *fmt, ...)
73 result = vsnprlcat(str, size, fmt, ap);
79 provinfo(struct hast_resource *res, bool dowrite)
83 PJDLOG_ASSERT(res->hr_localpath != NULL &&
84 res->hr_localpath[0] != '\0');
86 if (res->hr_localfd == -1) {
87 res->hr_localfd = open(res->hr_localpath,
88 dowrite ? O_RDWR : O_RDONLY);
89 if (res->hr_localfd < 0) {
90 KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to open %s",
95 if (fstat(res->hr_localfd, &sb) < 0) {
96 KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to stat %s",
100 if (S_ISCHR(sb.st_mode)) {
102 * If this is character device, it is most likely GEOM provider.
104 if (ioctl(res->hr_localfd, DIOCGMEDIASIZE,
105 &res->hr_local_mediasize) < 0) {
106 KEEP_ERRNO(pjdlog_errno(LOG_ERR,
107 "Unable obtain provider %s mediasize",
111 if (ioctl(res->hr_localfd, DIOCGSECTORSIZE,
112 &res->hr_local_sectorsize) < 0) {
113 KEEP_ERRNO(pjdlog_errno(LOG_ERR,
114 "Unable obtain provider %s sectorsize",
118 } else if (S_ISREG(sb.st_mode)) {
120 * We also support regular files for which we hardcode
121 * sector size of 512 bytes.
123 res->hr_local_mediasize = sb.st_size;
124 res->hr_local_sectorsize = 512;
127 * We support no other file types.
129 pjdlog_error("%s is neither GEOM provider nor regular file.",
144 case HAST_ROLE_PRIMARY:
146 case HAST_ROLE_SECONDARY:
147 return ("secondary");
153 drop_privs(struct hast_resource *res)
155 char jailhost[sizeof(res->hr_name) * 2];
158 uid_t ruid, euid, suid;
159 gid_t rgid, egid, sgid;
161 bool capsicum, jailed;
164 * According to getpwnam(3) we have to clear errno before calling the
165 * function to be able to distinguish between an error and missing
166 * entry (with is not treated as error by getpwnam(3)).
169 pw = getpwnam(HAST_USER);
172 KEEP_ERRNO(pjdlog_errno(LOG_ERR,
173 "Unable to find info about '%s' user", HAST_USER));
176 pjdlog_error("'%s' user doesn't exist.", HAST_USER);
182 bzero(&jailst, sizeof(jailst));
183 jailst.version = JAIL_API_VERSION;
184 jailst.path = pw->pw_dir;
186 (void)snprintf(jailhost, sizeof(jailhost), "hastctl");
188 (void)snprintf(jailhost, sizeof(jailhost), "hastd: %s (%s)",
189 res->hr_name, role2str(res->hr_role));
191 jailst.hostname = jailhost;
192 jailst.jailname = NULL;
197 if (jail(&jailst) >= 0) {
201 pjdlog_errno(LOG_WARNING,
202 "Unable to jail to directory to %s", pw->pw_dir);
203 if (chroot(pw->pw_dir) == -1) {
204 KEEP_ERRNO(pjdlog_errno(LOG_ERR,
205 "Unable to change root directory to %s",
210 PJDLOG_VERIFY(chdir("/") == 0);
211 gidset[0] = pw->pw_gid;
212 if (setgroups(1, gidset) == -1) {
213 KEEP_ERRNO(pjdlog_errno(LOG_ERR,
214 "Unable to set groups to gid %u",
215 (unsigned int)pw->pw_gid));
218 if (setgid(pw->pw_gid) == -1) {
219 KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to set gid to %u",
220 (unsigned int)pw->pw_gid));
223 if (setuid(pw->pw_uid) == -1) {
224 KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to set uid to %u",
225 (unsigned int)pw->pw_uid));
230 * Until capsicum doesn't allow ioctl(2) we cannot use it to sandbox
231 * primary and secondary worker processes, as primary uses GGATE
232 * ioctls and secondary uses ioctls to handle BIO_DELETE and BIO_FLUSH.
233 * For now capsicum is only used to sandbox hastctl.
237 capsicum = (cap_enter() == 0);
239 pjdlog_common(LOG_DEBUG, 1, errno,
240 "Unable to sandbox using capsicum");
247 * Better be sure that everything succeeded.
249 PJDLOG_VERIFY(getresuid(&ruid, &euid, &suid) == 0);
250 PJDLOG_VERIFY(ruid == pw->pw_uid);
251 PJDLOG_VERIFY(euid == pw->pw_uid);
252 PJDLOG_VERIFY(suid == pw->pw_uid);
253 PJDLOG_VERIFY(getresgid(&rgid, &egid, &sgid) == 0);
254 PJDLOG_VERIFY(rgid == pw->pw_gid);
255 PJDLOG_VERIFY(egid == pw->pw_gid);
256 PJDLOG_VERIFY(sgid == pw->pw_gid);
257 PJDLOG_VERIFY(getgroups(0, NULL) == 1);
258 PJDLOG_VERIFY(getgroups(1, gidset) == 1);
259 PJDLOG_VERIFY(gidset[0] == pw->pw_gid);
262 "Privileges successfully dropped using %s%s+setgid+setuid.",
263 capsicum ? "capsicum+" : "", jailed ? "jail" : "chroot");