src/common/runas.c

   1 /*
   2  * Copyright (C) 2011 - David Goulet <david.goulet@polymtl.ca>
   3  *                      Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License, version 2 only,
   7  * as published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12  * more details.
  13  *
  14  * You should have received a copy of the GNU General Public License along
  15  * with this program; if not, write to the Free Software Foundation, Inc.,
  16  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  17  */
  18
  19 #define _GNU_SOURCE
  20 #define _LGPL_SOURCE
  21 #include <errno.h>
  22 #include <limits.h>
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/wait.h>
  27 #include <sys/types.h>
  28 #include <sys/stat.h>
  29 #include <unistd.h>
  30 #include <fcntl.h>
  31 #include <sched.h>
  32 #include <sys/signal.h>
  33
  34 #include <common/common.h>
  35 #include <common/utils.h>
  36 #include <common/compat/mman.h>
  37 #include <common/compat/clone.h>
  38 #include <common/compat/getenv.h>
  39
  40 #include "runas.h"
  41
  42 #define RUNAS_CHILD_STACK_SIZE  10485760
  43
  44 #ifndef MAP_STACK
  45 #define MAP_STACK               0
  46 #endif
  47
  48 #ifdef __FreeBSD__
  49 /* FreeBSD MAP_STACK always return -ENOMEM */
  50 #define LTTNG_MAP_STACK         0
  51 #else
  52 #define LTTNG_MAP_STACK         MAP_STACK
  53 #endif
  54
  55 #ifndef MAP_GROWSDOWN
  56 #define MAP_GROWSDOWN           0
  57 #endif
  58
  59 #ifndef MAP_ANONYMOUS
  60 #define MAP_ANONYMOUS           MAP_ANON
  61 #endif
  62
  63 struct run_as_data {
  64         int (*cmd)(void *data);
  65         void *data;
  66         uid_t uid;
  67         gid_t gid;
  68         int retval_pipe;
  69 };
  70
  71 struct run_as_mkdir_data {
  72         const char *path;
  73         mode_t mode;
  74 };
  75
  76 struct run_as_open_data {
  77         const char *path;
  78         int flags;
  79         mode_t mode;
  80 };
  81
  82 struct run_as_unlink_data {
  83         const char *path;
  84 };
  85
  86 struct run_as_recursive_rmdir_data {
  87         const char *path;
  88 };
  89
  90 #ifdef VALGRIND
  91 static
  92 int use_clone(void)
  93 {
  94         return 0;
  95 }
  96 #else
  97 static
  98 int use_clone(void)
  99 {
 100         return !lttng_secure_getenv("LTTNG_DEBUG_NOCLONE");
 101 }
 102 #endif
 103
 104 LTTNG_HIDDEN
 105 int _utils_mkdir_recursive_unsafe(const char *path, mode_t mode);
 106
 107 /*
 108  * Create recursively directory using the FULL path.
 109  */
 110 static
 111 int _mkdir_recursive(void *_data)
 112 {
 113         struct run_as_mkdir_data *data = _data;
 114         const char *path;
 115         mode_t mode;
 116
 117         path = data->path;
 118         mode = data->mode;
 119
 120         /* Safe to call as we have transitioned to the requested uid/gid. */
 121         return _utils_mkdir_recursive_unsafe(path, mode);
 122 }
 123
 124 static
 125 int _mkdir(void *_data)
 126 {
 127         int ret;
 128         struct run_as_mkdir_data *data = _data;
 129
 130         ret = mkdir(data->path, data->mode);
 131         if (ret < 0) {
 132                 ret = -errno;
 133         }
 134
 135         return ret;
 136 }
 137
 138 static
 139 int _open(void *_data)
 140 {
 141         struct run_as_open_data *data = _data;
 142         return open(data->path, data->flags, data->mode);
 143 }
 144
 145 static
 146 int _unlink(void *_data)
 147 {
 148         int ret;
 149         struct run_as_unlink_data *data = _data;
 150
 151         ret = unlink(data->path);
 152         if (ret < 0) {
 153                 ret = -errno;
 154         }
 155
 156         return ret;
 157 }
 158
 159 static
 160 int _recursive_rmdir(void *_data)
 161 {
 162         int ret;
 163         struct run_as_recursive_rmdir_data *data = _data;
 164
 165         ret = utils_recursive_rmdir(data->path);
 166         if (ret < 0) {
 167                 ret = -errno;
 168         }
 169
 170         return ret;
 171 }
 172
 173 static
 174 int child_run_as(void *_data)
 175 {
 176         int ret;
 177         struct run_as_data *data = _data;
 178         ssize_t writelen;
 179         int sendret;
 180
 181         /*
 182          * Child: it is safe to drop egid and euid while sharing the
 183          * file descriptors with the parent process, since we do not
 184          * drop "uid": therefore, the user we are dropping egid/euid to
 185          * cannot attach to this process with, e.g. ptrace, nor map this
 186          * process memory.
 187          */
 188         if (data->gid != getegid()) {
 189                 ret = setegid(data->gid);
 190                 if (ret < 0) {
 191                         PERROR("setegid");
 192                         sendret = -1;
 193                         goto write_return;
 194                 }
 195         }
 196         if (data->uid != geteuid()) {
 197                 ret = seteuid(data->uid);
 198                 if (ret < 0) {
 199                         PERROR("seteuid");
 200                         sendret = -1;
 201                         goto write_return;
 202                 }
 203         }
 204         /*
 205          * Also set umask to 0 for mkdir executable bit.
 206          */
 207         umask(0);
 208         sendret = (*data->cmd)(data->data);
 209
 210 write_return:
 211         /* send back return value */
 212         writelen = lttng_write(data->retval_pipe, &sendret, sizeof(sendret));
 213         if (writelen < sizeof(sendret)) {
 214                 PERROR("lttng_write error");
 215                 return EXIT_FAILURE;
 216         } else {
 217                 return EXIT_SUCCESS;
 218         }
 219 }
 220
 221 static
 222 int run_as_clone(int (*cmd)(void *data), void *data, uid_t uid, gid_t gid)
 223 {
 224         struct run_as_data run_as_data;
 225         int ret = 0;
 226         ssize_t readlen;
 227         int status;
 228         pid_t pid;
 229         int retval_pipe[2];
 230         void *child_stack;
 231         int retval;
 232
 233         /*
 234          * If we are non-root, we can only deal with our own uid.
 235          */
 236         if (geteuid() != 0) {
 237                 if (uid != geteuid()) {
 238                         ERR("Client (%d)/Server (%d) UID mismatch (and sessiond is not root)",
 239                                 uid, geteuid());
 240                         return -EPERM;
 241                 }
 242         }
 243
 244         ret = pipe(retval_pipe);
 245         if (ret < 0) {
 246                 PERROR("pipe");
 247                 retval = ret;
 248                 goto end;
 249         }
 250         run_as_data.data = data;
 251         run_as_data.cmd = cmd;
 252         run_as_data.uid = uid;
 253         run_as_data.gid = gid;
 254         run_as_data.retval_pipe = retval_pipe[1];       /* write end */
 255         child_stack = mmap(NULL, RUNAS_CHILD_STACK_SIZE,
 256                 PROT_WRITE | PROT_READ,
 257                 MAP_PRIVATE | MAP_GROWSDOWN | MAP_ANONYMOUS | LTTNG_MAP_STACK,
 258                 -1, 0);
 259         if (child_stack == MAP_FAILED) {
 260                 PERROR("mmap");
 261                 retval = -ENOMEM;
 262                 goto close_pipe;
 263         }
 264         /*
 265          * Pointing to the middle of the stack to support architectures
 266          * where the stack grows up (HPPA).
 267          */
 268         pid = lttng_clone_files(child_run_as, child_stack + (RUNAS_CHILD_STACK_SIZE / 2),
 269                 &run_as_data);
 270         if (pid < 0) {
 271                 PERROR("clone");
 272                 retval = pid;
 273                 goto unmap_stack;
 274         }
 275         /* receive return value */
 276         readlen = lttng_read(retval_pipe[0], &retval, sizeof(retval));
 277         if (readlen < sizeof(retval)) {
 278                 ret = -1;
 279         }
 280
 281         /*
 282          * Parent: wait for child to return, in which case the
 283          * shared memory map will have been created.
 284          */
 285         pid = waitpid(pid, &status, 0);
 286         if (pid < 0 || !WIFEXITED(status) || WEXITSTATUS(status) != 0) {
 287                 PERROR("wait");
 288                 retval = -1;
 289         }
 290 unmap_stack:
 291         ret = munmap(child_stack, RUNAS_CHILD_STACK_SIZE);
 292         if (ret < 0) {
 293                 PERROR("munmap");
 294                 retval = ret;
 295         }
 296 close_pipe:
 297         ret = close(retval_pipe[0]);
 298         if (ret) {
 299                 PERROR("close");
 300         }
 301         ret = close(retval_pipe[1]);
 302         if (ret) {
 303                 PERROR("close");
 304         }
 305 end:
 306         return retval;
 307 }
 308
 309 /*
 310  * To be used on setups where gdb has issues debugging programs using
 311  * clone/rfork. Note that this is for debuging ONLY, and should not be
 312  * considered secure.
 313  */
 314 static
 315 int run_as_noclone(int (*cmd)(void *data), void *data, uid_t uid, gid_t gid)
 316 {
 317         int ret;
 318         mode_t old_mask;
 319
 320         old_mask = umask(0);
 321         ret = cmd(data);
 322         umask(old_mask);
 323
 324         return ret;
 325 }
 326
 327 static
 328 int run_as(int (*cmd)(void *data), void *data, uid_t uid, gid_t gid)
 329 {
 330         if (use_clone()) {
 331                 int ret;
 332
 333                 DBG("Using run_as_clone");
 334                 pthread_mutex_lock(&lttng_libc_state_lock);
 335                 ret = run_as_clone(cmd, data, uid, gid);
 336                 pthread_mutex_unlock(&lttng_libc_state_lock);
 337                 return ret;
 338         } else {
 339                 DBG("Using run_as_noclone");
 340                 return run_as_noclone(cmd, data, uid, gid);
 341         }
 342 }
 343
 344 LTTNG_HIDDEN
 345 int run_as_mkdir_recursive(const char *path, mode_t mode, uid_t uid, gid_t gid)
 346 {
 347         struct run_as_mkdir_data data;
 348
 349         DBG3("mkdir() recursive %s with mode %d for uid %d and gid %d",
 350                         path, mode, uid, gid);
 351         data.path = path;
 352         data.mode = mode;
 353         return run_as(_mkdir_recursive, &data, uid, gid);
 354 }
 355
 356 LTTNG_HIDDEN
 357 int run_as_mkdir(const char *path, mode_t mode, uid_t uid, gid_t gid)
 358 {
 359         struct run_as_mkdir_data data;
 360
 361         DBG3("mkdir() %s with mode %d for uid %d and gid %d",
 362                         path, mode, uid, gid);
 363         data.path = path;
 364         data.mode = mode;
 365         return run_as(_mkdir, &data, uid, gid);
 366 }
 367
 368 /*
 369  * Note: open_run_as is currently not working. We'd need to pass the fd
 370  * opened in the child to the parent.
 371  */
 372 LTTNG_HIDDEN
 373 int run_as_open(const char *path, int flags, mode_t mode, uid_t uid, gid_t gid)
 374 {
 375         struct run_as_open_data data;
 376
 377         DBG3("open() %s with flags %X mode %d for uid %d and gid %d",
 378                         path, flags, mode, uid, gid);
 379         data.path = path;
 380         data.flags = flags;
 381         data.mode = mode;
 382         return run_as(_open, &data, uid, gid);
 383 }
 384
 385 LTTNG_HIDDEN
 386 int run_as_unlink(const char *path, uid_t uid, gid_t gid)
 387 {
 388         struct run_as_unlink_data data;
 389
 390         DBG3("unlink() %s with for uid %d and gid %d",
 391                         path, uid, gid);
 392         data.path = path;
 393         return run_as(_unlink, &data, uid, gid);
 394 }
 395
 396 LTTNG_HIDDEN
 397 int run_as_recursive_rmdir(const char *path, uid_t uid, gid_t gid)
 398 {
 399         struct run_as_recursive_rmdir_data data;
 400
 401         DBG3("recursive_rmdir() %s with for uid %d and gid %d",
 402                         path, uid, gid);
 403         data.path = path;
 404         return run_as(_recursive_rmdir, &data, uid, gid);
 405 }