/* vim: set expandtab ts=4 sw=4: */
/*
* You may redistribute this program and/or modify it under the terms of
* the GNU General Public License as published by the Free Software Foundation,
* either version 3 of the License, or (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see .
*/
#define _GNU_SOURCE // chroot(), MAP_ANONYMOUS
#include "benc/Dict.h"
#include "benc/String.h"
#include "exception/Except.h"
#include "util/log/Log.h"
#include "util/Security.h"
#include "util/Seccomp.h"
#include "memory/Allocator.h"
#include "util/Bits.h"
#include "util/Setuid.h"
#include "util/events/EventBase.h"
#include "util/events/Timeout.h"
#include
#include
#include
#include
#include
#include
#include
#include
#include
static const unsigned long cfgMaxMemoryBytes = 100000000;
Dict* Security_getUser(char* userName, struct Allocator* retAlloc)
{
struct passwd* pw;
if (userName) {
pw = getpwnam(userName);
} else {
pw = getpwuid(getuid());
}
Dict* ret = Dict_new(retAlloc);
if (!pw) {
Dict_putString(ret, String_new("error", retAlloc),
String_printf(retAlloc, "Could not find user [%s]", strerror(errno)),
retAlloc);
return ret;
}
Dict_putString(ret, String_new("error", retAlloc), String_new("none", retAlloc), retAlloc);
Dict_putString(ret, String_new("name", retAlloc), String_new(pw->pw_name, retAlloc), retAlloc);
Dict_putInt(ret, String_new("uid", retAlloc), pw->pw_uid, retAlloc);
return ret;
}
void Security_setUser(int uid,
bool keepNetAdmin,
struct Log* logger,
struct Except* eh,
struct Allocator* alloc)
{
if (keepNetAdmin) {
Setuid_preSetuid(alloc, eh);
}
int ret = setuid(uid);
if (keepNetAdmin) {
Setuid_postSetuid(alloc, eh);
}
if (ret) {
Except_throw(eh, "Failed to set UID [%s]", strerror(errno));
}
if (uid != (int) getuid()) {
Except_throw(eh, "Failed to set UID but seemed to succeed");
}
}
static int canOpenFiles()
{
int file = dup(0);
close(file);
return file >= 0;
}
void Security_nofiles(struct Except* eh)
{
#if !defined(RLIMIT_NOFILE) && defined(RLIMIT_OFILE)
#define RLIMIT_NOFILE RLIMIT_OFILE
#endif
if (!canOpenFiles()) {
Except_throw(eh, "Unable to dupe stdin");
}
if (setrlimit(RLIMIT_NOFILE, &(struct rlimit){ 0, 0 })) {
Except_throw(eh, "Failed to set open file limit to 0 [%s]", strerror(errno));
}
if (canOpenFiles()) {
Except_throw(eh, "Still able to dupe stdin after setting number of files to 0!");
}
}
void Security_noforks(struct Except* eh)
{
if (setrlimit(RLIMIT_NPROC, &(struct rlimit){ 0, 0 })) {
Except_throw(eh, "Failed to set fork limit to 0 [%s]", strerror(errno));
}
}
void Security_chroot(char* root, struct Except* eh)
{
if (chdir(root)) {
Except_throw(eh, "chdir(%s) -> [%s]", root, strerror(errno));
}
if (chroot(root)) {
Except_throw(eh, "chroot(%s) -> [%s]", root, strerror(errno));
}
}
void Security_seccomp(struct Allocator* tempAlloc, struct Log* logger, struct Except* eh)
{
Seccomp_dropPermissions(tempAlloc, logger, eh);
}
struct Security_pvt
{
struct Security pub;
struct Allocator* setupAlloc;
struct Log* log;
Identity
};
void Security_setupComplete(struct Security* security)
{
struct Security_pvt* sec = Identity_check((struct Security_pvt*) security);
sec->pub.setupComplete = 1;
Allocator_free(sec->setupAlloc);
}
static void fail(void* vSec)
{
struct Security_pvt* sec = Identity_check((struct Security_pvt*) vSec);
Log_critical(sec->log, "Security_setupComplete() not called in time, exiting");
exit(232);
}
struct Security* Security_new(struct Allocator* alloc, struct Log* log, struct EventBase* base)
{
struct Security_pvt* sec = Allocator_calloc(alloc, sizeof(struct Security_pvt), 1);
Identity_set(sec);
sec->setupAlloc = Allocator_child(alloc);
Timeout_setInterval(fail, sec, 20000, base, sec->setupAlloc);
sec->log = log;
return &sec->pub;
}
struct Security_Permissions* Security_checkPermissions(struct Allocator* alloc, struct Except* eh)
{
struct Security_Permissions* out =
Allocator_calloc(alloc, sizeof(struct Security_Permissions), 1);
out->noOpenFiles = !canOpenFiles();
out->seccompExists = Seccomp_exists();
out->seccompEnforcing = Seccomp_isWorking();
out->uid = getuid();
return out;
}