src/common/runas.c

   1 /*
   2  * Copyright (C) 2011 - David Goulet <david.goulet@polymtl.ca>
   3  *                      Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License, version 2 only,
   7  * as published by the Free Software Foundation.
   8  *
   9  * This program is distributed in the hope that it will be useful, but WITHOUT
  10  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  11  * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  12  * more details.
  13  *
  14  * You should have received a copy of the GNU General Public License along
  15  * with this program; if not, write to the Free Software Foundation, Inc.,
  16  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
  17  */
  18
  19 #define _GNU_SOURCE
  20 #define _LGPL_SOURCE
  21 #include <errno.h>
  22 #include <limits.h>
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/wait.h>
  27 #include <sys/types.h>
  28 #include <sys/stat.h>
  29 #include <unistd.h>
  30 #include <fcntl.h>
  31 #include <sched.h>
  32 #include <sys/signal.h>
  33
  34 #include <common/common.h>
  35 #include <common/utils.h>
  36 #include <common/compat/mman.h>
  37 #include <common/compat/clone.h>
  38 #include <common/compat/getenv.h>
  39
  40 #include "runas.h"
  41
  42 #define RUNAS_CHILD_STACK_SIZE  10485760
  43
  44 #ifndef MAP_STACK
  45 #define MAP_STACK               0
  46 #endif
  47
  48 #ifdef __FreeBSD__
  49 /* FreeBSD MAP_STACK always return -ENOMEM */
  50 #define LTTNG_MAP_STACK         0
  51 #else
  52 #define LTTNG_MAP_STACK         MAP_STACK
  53 #endif
  54
  55 #ifndef MAP_GROWSDOWN
  56 #define MAP_GROWSDOWN           0
  57 #endif
  58
  59 #ifndef MAP_ANONYMOUS
  60 #define MAP_ANONYMOUS           MAP_ANON
  61 #endif
  62
  63 struct run_as_data {
  64         int (*cmd)(void *data);
  65         void *data;
  66         uid_t uid;
  67         gid_t gid;
  68         int retval_pipe;
  69 };
  70
  71 struct run_as_mkdir_data {
  72         const char *path;
  73         mode_t mode;
  74 };
  75
  76 struct run_as_open_data {
  77         const char *path;
  78         int flags;
  79         mode_t mode;
  80 };
  81
  82 struct run_as_unlink_data {
  83         const char *path;
  84 };
  85
  86 struct run_as_recursive_rmdir_data {
  87         const char *path;
  88 };
  89
  90 struct run_as_ret {
  91         int ret;
  92         int _errno;
  93 };
  94
  95 #ifdef VALGRIND
  96 static
  97 int use_clone(void)
  98 {
  99         return 0;
 100 }
 101 #else
 102 static
 103 int use_clone(void)
 104 {
 105         return !lttng_secure_getenv("LTTNG_DEBUG_NOCLONE");
 106 }
 107 #endif
 108
 109 LTTNG_HIDDEN
 110 int _utils_mkdir_recursive_unsafe(const char *path, mode_t mode);
 111
 112 /*
 113  * Create recursively directory using the FULL path.
 114  */
 115 static
 116 int _mkdir_recursive(void *_data)
 117 {
 118         struct run_as_mkdir_data *data = _data;
 119         const char *path;
 120         mode_t mode;
 121
 122         path = data->path;
 123         mode = data->mode;
 124
 125         /* Safe to call as we have transitioned to the requested uid/gid. */
 126         return _utils_mkdir_recursive_unsafe(path, mode);
 127 }
 128
 129 static
 130 int _mkdir(void *_data)
 131 {
 132         struct run_as_mkdir_data *data = _data;
 133
 134         return mkdir(data->path, data->mode);
 135 }
 136
 137 static
 138 int _open(void *_data)
 139 {
 140         struct run_as_open_data *data = _data;
 141
 142         return open(data->path, data->flags, data->mode);
 143 }
 144
 145 static
 146 int _unlink(void *_data)
 147 {
 148         struct run_as_unlink_data *data = _data;
 149
 150         return unlink(data->path);
 151 }
 152
 153 static
 154 int _recursive_rmdir(void *_data)
 155 {
 156         struct run_as_recursive_rmdir_data *data = _data;
 157
 158         return utils_recursive_rmdir(data->path);
 159 }
 160
 161 static
 162 int child_run_as(void *_data)
 163 {
 164         int ret;
 165         struct run_as_data *data = _data;
 166         ssize_t writelen;
 167         struct run_as_ret sendret;
 168
 169         /*
 170          * Child: it is safe to drop egid and euid while sharing the
 171          * file descriptors with the parent process, since we do not
 172          * drop "uid": therefore, the user we are dropping egid/euid to
 173          * cannot attach to this process with, e.g. ptrace, nor map this
 174          * process memory.
 175          */
 176         if (data->gid != getegid()) {
 177                 ret = setegid(data->gid);
 178                 if (ret < 0) {
 179                         PERROR("setegid");
 180                         goto write_return;
 181                 }
 182         }
 183         if (data->uid != geteuid()) {
 184                 ret = seteuid(data->uid);
 185                 if (ret < 0) {
 186                         PERROR("seteuid");
 187                         goto write_return;
 188                 }
 189         }
 190         /*
 191          * Also set umask to 0 for mkdir executable bit.
 192          */
 193         umask(0);
 194         ret = (*data->cmd)(data->data);
 195
 196 write_return:
 197         sendret.ret = ret;
 198         sendret._errno = errno;
 199         /* send back return value */
 200         writelen = lttng_write(data->retval_pipe, &sendret, sizeof(sendret));
 201         if (writelen < sizeof(sendret)) {
 202                 PERROR("lttng_write error");
 203                 return EXIT_FAILURE;
 204         } else {
 205                 return EXIT_SUCCESS;
 206         }
 207 }
 208
 209 static
 210 int run_as_clone(int (*cmd)(void *data), void *data, uid_t uid, gid_t gid)
 211 {
 212         struct run_as_data run_as_data;
 213         int ret = 0;
 214         ssize_t readlen;
 215         int status;
 216         pid_t pid;
 217         int retval_pipe[2];
 218         void *child_stack;
 219         struct run_as_ret recvret;
 220
 221         /*
 222          * If we are non-root, we can only deal with our own uid.
 223          */
 224         if (geteuid() != 0) {
 225                 if (uid != geteuid()) {
 226                         recvret.ret = -1;
 227                         recvret._errno = EPERM;
 228                         ERR("Client (%d)/Server (%d) UID mismatch (and sessiond is not root)",
 229                                 uid, geteuid());
 230                         goto end;
 231                 }
 232         }
 233
 234         ret = pipe(retval_pipe);
 235         if (ret < 0) {
 236                 recvret.ret = -1;
 237                 recvret._errno = errno;
 238                 PERROR("pipe");
 239                 goto end;
 240         }
 241         run_as_data.data = data;
 242         run_as_data.cmd = cmd;
 243         run_as_data.uid = uid;
 244         run_as_data.gid = gid;
 245         run_as_data.retval_pipe = retval_pipe[1];       /* write end */
 246         child_stack = mmap(NULL, RUNAS_CHILD_STACK_SIZE,
 247                 PROT_WRITE | PROT_READ,
 248                 MAP_PRIVATE | MAP_GROWSDOWN | MAP_ANONYMOUS | LTTNG_MAP_STACK,
 249                 -1, 0);
 250         if (child_stack == MAP_FAILED) {
 251                 recvret.ret = -1;
 252                 recvret._errno = ENOMEM;
 253                 PERROR("mmap");
 254                 goto close_pipe;
 255         }
 256         /*
 257          * Pointing to the middle of the stack to support architectures
 258          * where the stack grows up (HPPA).
 259          */
 260         pid = lttng_clone_files(child_run_as, child_stack + (RUNAS_CHILD_STACK_SIZE / 2),
 261                 &run_as_data);
 262         if (pid < 0) {
 263                 recvret.ret = -1;
 264                 recvret._errno = errno;
 265                 PERROR("clone");
 266                 goto unmap_stack;
 267         }
 268         /* receive return value */
 269         readlen = lttng_read(retval_pipe[0], &recvret, sizeof(recvret));
 270         if (readlen < sizeof(recvret)) {
 271                 recvret.ret = -1;
 272                 recvret._errno = errno;
 273         }
 274
 275         /*
 276          * Parent: wait for child to return, in which case the
 277          * shared memory map will have been created.
 278          */
 279         pid = waitpid(pid, &status, 0);
 280         if (pid < 0 || !WIFEXITED(status) || WEXITSTATUS(status) != 0) {
 281                 recvret.ret = -1;
 282                 recvret._errno = errno;
 283                 PERROR("wait");
 284         }
 285 unmap_stack:
 286         ret = munmap(child_stack, RUNAS_CHILD_STACK_SIZE);
 287         if (ret < 0) {
 288                 recvret.ret = -1;
 289                 recvret._errno = errno;
 290                 PERROR("munmap");
 291         }
 292 close_pipe:
 293         ret = close(retval_pipe[0]);
 294         if (ret) {
 295                 recvret.ret = -1;
 296                 recvret._errno = errno;
 297                 PERROR("close");
 298         }
 299         ret = close(retval_pipe[1]);
 300         if (ret) {
 301                 recvret.ret = -1;
 302                 recvret._errno = errno;
 303                 PERROR("close");
 304         }
 305 end:
 306         errno = recvret._errno;
 307         return recvret.ret;
 308 }
 309
 310 /*
 311  * To be used on setups where gdb has issues debugging programs using
 312  * clone/rfork. Note that this is for debuging ONLY, and should not be
 313  * considered secure.
 314  */
 315 static
 316 int run_as_noclone(int (*cmd)(void *data), void *data, uid_t uid, gid_t gid)
 317 {
 318         int ret, saved_errno;
 319         mode_t old_mask;
 320
 321         old_mask = umask(0);
 322         ret = cmd(data);
 323         saved_errno = errno;
 324         umask(old_mask);
 325         errno = saved_errno;
 326
 327         return ret;
 328 }
 329
 330 static
 331 int run_as(int (*cmd)(void *data), void *data, uid_t uid, gid_t gid)
 332 {
 333         if (use_clone()) {
 334                 int ret;
 335
 336                 DBG("Using run_as_clone");
 337                 pthread_mutex_lock(&lttng_libc_state_lock);
 338                 ret = run_as_clone(cmd, data, uid, gid);
 339                 pthread_mutex_unlock(&lttng_libc_state_lock);
 340                 return ret;
 341         } else {
 342                 DBG("Using run_as_noclone");
 343                 return run_as_noclone(cmd, data, uid, gid);
 344         }
 345 }
 346
 347 LTTNG_HIDDEN
 348 int run_as_mkdir_recursive(const char *path, mode_t mode, uid_t uid, gid_t gid)
 349 {
 350         struct run_as_mkdir_data data;
 351
 352         DBG3("mkdir() recursive %s with mode %d for uid %d and gid %d",
 353                         path, mode, uid, gid);
 354         data.path = path;
 355         data.mode = mode;
 356         return run_as(_mkdir_recursive, &data, uid, gid);
 357 }
 358
 359 LTTNG_HIDDEN
 360 int run_as_mkdir(const char *path, mode_t mode, uid_t uid, gid_t gid)
 361 {
 362         struct run_as_mkdir_data data;
 363
 364         DBG3("mkdir() %s with mode %d for uid %d and gid %d",
 365                         path, mode, uid, gid);
 366         data.path = path;
 367         data.mode = mode;
 368         return run_as(_mkdir, &data, uid, gid);
 369 }
 370
 371 /*
 372  * Note: open_run_as is currently not working. We'd need to pass the fd
 373  * opened in the child to the parent.
 374  */
 375 LTTNG_HIDDEN
 376 int run_as_open(const char *path, int flags, mode_t mode, uid_t uid, gid_t gid)
 377 {
 378         struct run_as_open_data data;
 379
 380         DBG3("open() %s with flags %X mode %d for uid %d and gid %d",
 381                         path, flags, mode, uid, gid);
 382         data.path = path;
 383         data.flags = flags;
 384         data.mode = mode;
 385         return run_as(_open, &data, uid, gid);
 386 }
 387
 388 LTTNG_HIDDEN
 389 int run_as_unlink(const char *path, uid_t uid, gid_t gid)
 390 {
 391         struct run_as_unlink_data data;
 392
 393         DBG3("unlink() %s with for uid %d and gid %d",
 394                         path, uid, gid);
 395         data.path = path;
 396         return run_as(_unlink, &data, uid, gid);
 397 }
 398
 399 LTTNG_HIDDEN
 400 int run_as_recursive_rmdir(const char *path, uid_t uid, gid_t gid)
 401 {
 402         struct run_as_recursive_rmdir_data data;
 403
 404         DBG3("recursive_rmdir() %s with for uid %d and gid %d",
 405                         path, uid, gid);
 406         data.path = path;
 407         return run_as(_recursive_rmdir, &data, uid, gid);
 408 }