gotwebd/sockets.c

   1 /*
   2  * Copyright (c) 2016, 2019, 2020-2021 Tracey Emery <tracey@traceyemery.net>
   3  * Copyright (c) 2015 Mike Larkin <mlarkin@openbsd.org>
   4  * Copyright (c) 2013 David Gwynne <dlg@openbsd.org>
   5  * Copyright (c) 2013 Florian Obser <florian@openbsd.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include "got_compat.h"
  21
  22 #include <sys/param.h>
  23 #include <sys/ioctl.h>
  24 #include <sys/queue.h>
  25 #include <sys/wait.h>
  26 #include <sys/uio.h>
  27 #include <sys/resource.h>
  28 #include <sys/socket.h>
  29 #include <sys/stat.h>
  30 #include <sys/time.h>
  31 #include <sys/types.h>
  32 #include <sys/mman.h>
  33 #include <sys/un.h>
  34
  35 #include <net/if.h>
  36 #include <netinet/in.h>
  37
  38 #include <errno.h>
  39 #include <event.h>
  40 #include <fcntl.h>
  41 #include <ifaddrs.h>
  42 #include <limits.h>
  43 #include <netdb.h>
  44 #include <poll.h>
  45 #include <pwd.h>
  46 #include <stddef.h>
  47 #include <stdio.h>
  48 #include <stdlib.h>
  49 #include <string.h>
  50 #include <unistd.h>
  51
  52 #include "got_error.h"
  53 #include "got_opentemp.h"
  54 #include "got_repository.h"
  55
  56 #include "proc.h"
  57 #include "gotwebd.h"
  58 #include "tmpl.h"
  59
  60 #define SOCKS_BACKLOG 5
  61 #define MAXIMUM(a, b)   (((a) > (b)) ? (a) : (b))
  62
  63
  64 volatile int client_cnt;
  65
  66 static struct timeval   timeout = { TIMEOUT_DEFAULT, 0 };
  67
  68 static void      sockets_sighdlr(int, short, void *);
  69 static void      sockets_run(struct privsep *, struct privsep_proc *, void *);
  70 static void      sockets_launch(void);
  71 static void      sockets_purge(struct gotwebd *);
  72 static void      sockets_accept_paused(int, short, void *);
  73 static void      sockets_rlimit(int);
  74
  75 static int       sockets_dispatch_gotwebd(int, struct privsep_proc *,
  76                     struct imsg *);
  77 static int       sockets_unix_socket_listen(struct privsep *, struct socket *);
  78 static int       sockets_create_socket(struct address *, in_port_t);
  79 static int       sockets_accept_reserve(int, struct sockaddr *, socklen_t *,
  80                     int, volatile int *);
  81
  82 static struct socket *sockets_conf_new_socket_unix(struct gotwebd *,
  83                     struct server *, int);
  84 static struct socket *sockets_conf_new_socket_fcgi(struct gotwebd *,
  85                     struct server *, int, struct address *);
  86
  87 int cgi_inflight = 0;
  88
  89 static struct privsep_proc procs[] = {
  90         { "gotwebd",    PROC_GOTWEBD,   sockets_dispatch_gotwebd  },
  91 };
  92
  93 void
  94 sockets(struct privsep *ps, struct privsep_proc *p)
  95 {
  96         proc_run(ps, p, procs, nitems(procs), sockets_run, NULL);
  97 }
  98
  99 static void
 100 sockets_run(struct privsep *ps, struct privsep_proc *p, void *arg)
 101 {
 102         if (config_init(ps->ps_env) == -1)
 103                 fatal("failed to initialize configuration");
 104
 105         p->p_shutdown = sockets_shutdown;
 106
 107         sockets_rlimit(-1);
 108
 109         signal_del(&ps->ps_evsigchld);
 110         signal_set(&ps->ps_evsigchld, SIGCHLD, sockets_sighdlr, ps);
 111         signal_add(&ps->ps_evsigchld, NULL);
 112
 113 #ifndef PROFILE
 114         if (pledge("stdio rpath wpath cpath inet recvfd proc exec sendfd",
 115             NULL) == -1)
 116                 fatal("pledge");
 117 #endif
 118 }
 119
 120 void
 121 sockets_parse_sockets(struct gotwebd *env)
 122 {
 123         struct server *srv;
 124         struct address *a;
 125         struct socket *new_sock = NULL;
 126         int sock_id = 1;
 127
 128         TAILQ_FOREACH(srv, &env->servers, entry) {
 129                 if (srv->unix_socket) {
 130                         new_sock = sockets_conf_new_socket_unix(env, srv,
 131                             sock_id);
 132                         if (new_sock) {
 133                                 sock_id++;
 134                                 TAILQ_INSERT_TAIL(&env->sockets, new_sock,
 135                                     entry);
 136                         }
 137                 }
 138
 139                 if (srv->fcgi_socket) {
 140                         if (TAILQ_EMPTY(&srv->al)) {
 141                                 fatalx("%s: server %s has no IP addresses to "
 142                                     "listen for FCGI connections", __func__,
 143                                     srv->name);
 144                         }
 145                         TAILQ_FOREACH(a, &srv->al, entry) {
 146                                 if (a->ss.ss_family != AF_INET &&
 147                                     a->ss.ss_family != AF_INET6)
 148                                         continue;
 149                                 new_sock = sockets_conf_new_socket_fcgi(env,
 150                                     srv, sock_id, a);
 151                                 if (new_sock) {
 152                                         sock_id++;
 153                                         TAILQ_INSERT_TAIL(&env->sockets,
 154                                             new_sock, entry);
 155                                 }
 156                         }
 157                 }
 158         }
 159 }
 160
 161 static struct socket *
 162 sockets_conf_new_socket_unix(struct gotwebd *env, struct server *srv, int id)
 163 {
 164         struct socket *sock;
 165         int n;
 166
 167         if ((sock = calloc(1, sizeof(*sock))) == NULL)
 168                 fatalx("%s: calloc", __func__);
 169
 170         sock->conf.id = id;
 171         sock->fd = -1;
 172         sock->conf.af_type = AF_UNIX;
 173
 174         if (strlcpy(sock->conf.unix_socket_name,
 175             srv->unix_socket_name,
 176             sizeof(sock->conf.unix_socket_name)) >=
 177             sizeof(sock->conf.unix_socket_name)) {
 178                 free(sock);
 179                 fatalx("%s: strlcpy", __func__);
 180         }
 181
 182         n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_parent",
 183             srv->name);
 184         if (n < 0 || (size_t)n >= GOTWEBD_MAXTEXT) {
 185                 free(sock);
 186                 fatalx("%s: snprintf", __func__);
 187         }
 188
 189         if (strlcpy(sock->conf.srv_name, srv->name,
 190             sizeof(sock->conf.srv_name)) >= sizeof(sock->conf.srv_name)) {
 191                 free(sock);
 192                 fatalx("%s: strlcpy", __func__);
 193         }
 194
 195         return sock;
 196 }
 197
 198 static struct socket *
 199 sockets_conf_new_socket_fcgi(struct gotwebd *env, struct server *srv, int id,
 200     struct address *a)
 201 {
 202         struct socket *sock;
 203         struct address *acp;
 204         int n;
 205
 206         if ((sock = calloc(1, sizeof(*sock))) == NULL)
 207                 fatalx("%s: calloc", __func__);
 208
 209         sock->conf.id = id;
 210         sock->fd = -1;
 211         sock->conf.af_type = a->ss.ss_family;
 212
 213         sock->conf.fcgi_socket_port = a->port;
 214
 215         n = snprintf(sock->conf.name, GOTWEBD_MAXTEXT, "%s_parent",
 216             srv->name);
 217         if (n < 0 || (size_t)n >= GOTWEBD_MAXTEXT) {
 218                 free(sock);
 219                 fatalx("%s: snprintf", __func__);
 220         }
 221
 222         if (strlcpy(sock->conf.srv_name, srv->name,
 223             sizeof(sock->conf.srv_name)) >= sizeof(sock->conf.srv_name)) {
 224                 free(sock);
 225                 fatalx("%s: strlcpy", __func__);
 226         }
 227
 228         acp = &sock->conf.addr;
 229
 230         memcpy(&acp->ss, &a->ss, sizeof(acp->ss));
 231         acp->ipproto = a->ipproto;
 232         acp->prefixlen = a->prefixlen;
 233         acp->port = a->port;
 234         if (strlen(a->ifname) != 0) {
 235                 if (strlcpy(acp->ifname, a->ifname,
 236                     sizeof(acp->ifname)) >= sizeof(acp->ifname)) {
 237                         fatalx("%s: interface name truncated",
 238                             __func__);
 239                 }
 240         }
 241
 242         return (sock);
 243 }
 244
 245 static void
 246 sockets_launch(void)
 247 {
 248         struct socket *sock;
 249
 250         TAILQ_FOREACH(sock, &gotwebd_env->sockets, entry) {
 251                 log_debug("%s: configuring socket %d (%d)", __func__,
 252                     sock->conf.id, sock->fd);
 253
 254                 event_set(&sock->ev, sock->fd, EV_READ | EV_PERSIST,
 255                     sockets_socket_accept, sock);
 256
 257                 if (event_add(&sock->ev, NULL))
 258                         fatalx("event add sock");
 259
 260                 evtimer_set(&sock->pause, sockets_accept_paused, sock);
 261
 262                 log_debug("%s: running socket listener %d", __func__,
 263                     sock->conf.id);
 264         }
 265 }
 266
 267 static void
 268 sockets_purge(struct gotwebd *env)
 269 {
 270         struct socket *sock, *tsock;
 271
 272         /* shutdown and remove sockets */
 273         TAILQ_FOREACH_SAFE(sock, &env->sockets, entry, tsock) {
 274                 if (event_initialized(&sock->ev))
 275                         event_del(&sock->ev);
 276                 if (evtimer_initialized(&sock->evt))
 277                         evtimer_del(&sock->evt);
 278                 if (evtimer_initialized(&sock->pause))
 279                         evtimer_del(&sock->pause);
 280                 if (sock->fd != -1)
 281                         close(sock->fd);
 282                 TAILQ_REMOVE(&env->sockets, sock, entry);
 283         }
 284 }
 285
 286 static int
 287 sockets_dispatch_gotwebd(int fd, struct privsep_proc *p, struct imsg *imsg)
 288 {
 289         struct privsep *ps = p->p_ps;
 290         int res = 0, cmd = 0, verbose;
 291
 292         switch (imsg->hdr.type) {
 293         case IMSG_CFG_SRV:
 294                 config_getserver(gotwebd_env, imsg);
 295                 break;
 296         case IMSG_CFG_SOCK:
 297                 config_getsock(gotwebd_env, imsg);
 298                 break;
 299         case IMSG_CFG_FD:
 300                 config_getfd(gotwebd_env, imsg);
 301                 break;
 302         case IMSG_CFG_DONE:
 303                 config_getcfg(gotwebd_env, imsg);
 304                 break;
 305         case IMSG_CTL_START:
 306                 sockets_launch();
 307                 break;
 308         case IMSG_CTL_VERBOSE:
 309                 IMSG_SIZE_CHECK(imsg, &verbose);
 310                 memcpy(&verbose, imsg->data, sizeof(verbose));
 311                 log_setverbose(verbose);
 312                 break;
 313         default:
 314                 return -1;
 315         }
 316
 317         switch (cmd) {
 318         case 0:
 319                 break;
 320         default:
 321                 if (proc_compose_imsg(ps, PROC_GOTWEBD, -1, cmd,
 322                     imsg->hdr.peerid, -1, &res, sizeof(res)) == -1)
 323                         return -1;
 324                 break;
 325         }
 326
 327         return 0;
 328 }
 329
 330 static void
 331 sockets_sighdlr(int sig, short event, void *arg)
 332 {
 333         switch (sig) {
 334         case SIGHUP:
 335                 log_info("%s: ignoring SIGHUP", __func__);
 336                 break;
 337         case SIGPIPE:
 338                 log_info("%s: ignoring SIGPIPE", __func__);
 339                 break;
 340         case SIGUSR1:
 341                 log_info("%s: ignoring SIGUSR1", __func__);
 342                 break;
 343         case SIGCHLD:
 344                 break;
 345         default:
 346                 log_info("SIGNAL: %d", sig);
 347                 fatalx("unexpected signal");
 348         }
 349 }
 350
 351 void
 352 sockets_shutdown(void)
 353 {
 354         struct server *srv, *tsrv;
 355         struct socket *sock, *tsock;
 356         int i;
 357
 358         sockets_purge(gotwebd_env);
 359
 360         /* clean sockets */
 361         TAILQ_FOREACH_SAFE(sock, &gotwebd_env->sockets, entry, tsock) {
 362                 TAILQ_REMOVE(&gotwebd_env->sockets, sock, entry);
 363                 close(sock->fd);
 364                 free(sock);
 365         }
 366
 367         /* clean servers */
 368         TAILQ_FOREACH_SAFE(srv, &gotwebd_env->servers, entry, tsrv) {
 369                 for (i = 0; i < srv->ncached_repos; i++)
 370                         got_repo_close(srv->cached_repos[i].repo);
 371                 free(srv);
 372         }
 373
 374         free(gotwebd_env);
 375 }
 376
 377 int
 378 sockets_privinit(struct gotwebd *env, struct socket *sock)
 379 {
 380         struct privsep *ps = env->gotwebd_ps;
 381
 382         if (sock->conf.af_type == AF_UNIX) {
 383                 log_debug("%s: initializing unix socket %s", __func__,
 384                     sock->conf.unix_socket_name);
 385                 sock->fd = sockets_unix_socket_listen(ps, sock);
 386                 if (sock->fd == -1) {
 387                         log_warnx("%s: create unix socket failed", __func__);
 388                         return -1;
 389                 }
 390         }
 391
 392         if (sock->conf.af_type == AF_INET || sock->conf.af_type == AF_INET6) {
 393                 log_debug("%s: initializing %s FCGI socket on port %d for %s",
 394                     __func__, sock->conf.af_type == AF_INET ? "inet" : "inet6",
 395                     sock->conf.fcgi_socket_port, sock->conf.name);
 396                 sock->fd = sockets_create_socket(&sock->conf.addr,
 397                     sock->conf.fcgi_socket_port);
 398                 if (sock->fd == -1) {
 399                         log_warnx("%s: create FCGI socket failed", __func__);
 400                         return -1;
 401                 }
 402         }
 403
 404         return 0;
 405 }
 406
 407 static int
 408 sockets_unix_socket_listen(struct privsep *ps, struct socket *sock)
 409 {
 410         struct gotwebd *env = ps->ps_env;
 411         struct sockaddr_un sun;
 412         struct socket *tsock;
 413         int u_fd = -1;
 414         mode_t old_umask, mode;
 415
 416         TAILQ_FOREACH(tsock, &env->sockets, entry) {
 417                 if (strcmp(tsock->conf.unix_socket_name,
 418                     sock->conf.unix_socket_name) == 0 &&
 419                     tsock->fd != -1)
 420                         return (tsock->fd);
 421         }
 422
 423         /* TA: FIXME:  this needs upstreaming. */
 424         int socket_flags = SOCK_STREAM | SOCK_NONBLOCK;
 425 #ifdef SOCK_CLOEXEC
 426         socket_flags |= SOCK_CLOEXEC;
 427 #endif
 428         u_fd = socket(AF_UNIX, socket_flags, 0);
 429         if (u_fd == -1) {
 430                 log_warn("%s: socket", __func__);
 431                 return -1;
 432         }
 433
 434         sun.sun_family = AF_UNIX;
 435         if (strlcpy(sun.sun_path, sock->conf.unix_socket_name,
 436             sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
 437                 log_warn("%s: %s name too long", __func__,
 438                     sock->conf.unix_socket_name);
 439                 close(u_fd);
 440                 return -1;
 441         }
 442
 443         if (unlink(sock->conf.unix_socket_name) == -1) {
 444                 if (errno != ENOENT) {
 445                         log_warn("%s: unlink %s", __func__,
 446                             sock->conf.unix_socket_name);
 447                         close(u_fd);
 448                         return -1;
 449                 }
 450         }
 451
 452         old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
 453         mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP;
 454
 455         if (bind(u_fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
 456                 log_warn("%s: bind: %s", __func__, sock->conf.unix_socket_name);
 457                 close(u_fd);
 458                 (void)umask(old_umask);
 459                 return -1;
 460         }
 461
 462         (void)umask(old_umask);
 463
 464         if (chmod(sock->conf.unix_socket_name, mode) == -1) {
 465                 log_warn("%s: chmod", __func__);
 466                 close(u_fd);
 467                 (void)unlink(sock->conf.unix_socket_name);
 468                 return -1;
 469         }
 470
 471         if (chown(sock->conf.unix_socket_name, ps->ps_pw->pw_uid,
 472             ps->ps_pw->pw_gid) == -1) {
 473                 log_warn("%s: chown", __func__);
 474                 close(u_fd);
 475                 (void)unlink(sock->conf.unix_socket_name);
 476                 return -1;
 477         }
 478
 479         if (listen(u_fd, SOCKS_BACKLOG) == -1) {
 480                 log_warn("%s: listen", __func__);
 481                 return -1;
 482         }
 483
 484         return u_fd;
 485 }
 486
 487 static int
 488 sockets_create_socket(struct address *a, in_port_t port)
 489 {
 490         struct addrinfo hints;
 491         int fd = -1, o_val = 1, flags;
 492
 493         memset(&hints, 0, sizeof(hints));
 494         hints.ai_family = AF_UNSPEC;
 495         hints.ai_socktype = SOCK_STREAM;
 496         hints.ai_flags |= AI_PASSIVE;
 497
 498         switch (a->ss.ss_family) {
 499         case AF_INET:
 500                 ((struct sockaddr_in *)(&a->ss))->sin_port = htons(port);
 501                 break;
 502         case AF_INET6:
 503                 ((struct sockaddr_in6 *)(&a->ss))->sin6_port = htons(port);
 504                 break;
 505         default:
 506                 log_warnx("%s: unknown address family", __func__);
 507                 return -1;
 508         }
 509
 510         fd = socket(a->ss.ss_family, hints.ai_socktype, a->ipproto);
 511         if (fd == -1)
 512                 return -1;
 513
 514         log_debug("%s: opened socket (%d) for %s", __func__,
 515             fd, a->ifname);
 516
 517         if (setsockopt(fd, SOL_SOCKET, SO_REUSEPORT, &o_val,
 518             sizeof(int)) == -1) {
 519                 log_warn("%s: setsockopt error", __func__);
 520                 close(fd);
 521                 return -1;
 522         }
 523
 524         /* non-blocking */
 525         flags = fcntl(fd, F_GETFL);
 526         flags |= O_NONBLOCK;
 527         if (fcntl(fd, F_SETFL, flags) == -1) {
 528                 log_info("%s: could not enable non-blocking I/O", __func__);
 529                 close(fd);
 530                 return -1;
 531         }
 532
 533         if (bind(fd, (struct sockaddr *)&a->ss, SS_LEN(&a->ss)) == -1) {
 534                 close(fd);
 535                 log_info("%s: can't bind to port %d", __func__,
 536                     ntohs(port));
 537                 return -1;
 538         }
 539
 540         if (listen(fd, SOMAXCONN) == -1) {
 541                 log_warn("%s, unable to listen on socket", __func__);
 542                 close(fd);
 543                 return -1;
 544         }
 545
 546         return (fd);
 547 }
 548
 549 static int
 550 sockets_accept_reserve(int sockfd, struct sockaddr *addr, socklen_t *addrlen,
 551     int reserve, volatile int *counter)
 552 {
 553         int ret;
 554
 555         if (getdtablecount() + reserve +
 556             ((*counter + 1) * FD_NEEDED) >= getdtablesize()) {
 557                 log_debug("inflight fds exceeded");
 558                 errno = EMFILE;
 559                 return -1;
 560         }
 561 /* TA:  This needs fixing upstream. */
 562 #ifdef __APPLE__
 563         ret = accept(sockfd, addr, addrlen);
 564 #else
 565         ret = accept4(sockfd, addr, addrlen, SOCK_NONBLOCK | SOCK_CLOEXEC);
 566 #endif
 567
 568         if (ret > -1) {
 569                 (*counter)++;
 570                 log_debug("inflight incremented, now %d", *counter);
 571         }
 572
 573         return ret;
 574 }
 575
 576 static void
 577 sockets_accept_paused(int fd, short events, void *arg)
 578 {
 579         struct socket *sock = (struct socket *)arg;
 580
 581         event_add(&sock->ev, NULL);
 582 }
 583
 584 void
 585 sockets_socket_accept(int fd, short event, void *arg)
 586 {
 587         struct socket *sock = (struct socket *)arg;
 588         struct sockaddr_storage ss;
 589         struct timeval backoff;
 590         struct request *c = NULL;
 591         socklen_t len;
 592         int s;
 593
 594         backoff.tv_sec = 1;
 595         backoff.tv_usec = 0;
 596
 597         event_add(&sock->ev, NULL);
 598         if (event & EV_TIMEOUT)
 599                 return;
 600
 601         len = sizeof(ss);
 602
 603         s = sockets_accept_reserve(fd, (struct sockaddr *)&ss, &len,
 604             FD_RESERVE, &cgi_inflight);
 605
 606         if (s == -1) {
 607                 switch (errno) {
 608                 case EINTR:
 609                 case EWOULDBLOCK:
 610                 case ECONNABORTED:
 611                         return;
 612                 case EMFILE:
 613                 case ENFILE:
 614                         event_del(&sock->ev);
 615                         evtimer_add(&sock->pause, &backoff);
 616                         return;
 617                 default:
 618                         log_warn("%s: accept", __func__);
 619                 }
 620         }
 621
 622         if (client_cnt > GOTWEBD_MAXCLIENTS)
 623                 goto err;
 624
 625         c = calloc(1, sizeof(struct request));
 626         if (c == NULL) {
 627                 log_warn("%s", __func__);
 628                 close(s);
 629                 cgi_inflight--;
 630                 return;
 631         }
 632
 633         c->tp = template(c, fcgi_puts, fcgi_putc);
 634         if (c->tp == NULL) {
 635                 log_warn("%s", __func__);
 636                 close(s);
 637                 cgi_inflight--;
 638                 free(c);
 639                 return;
 640         }
 641
 642         c->fd = s;
 643         c->sock = sock;
 644         memcpy(c->priv_fd, sock->priv_fd, sizeof(c->priv_fd));
 645         c->buf_pos = 0;
 646         c->buf_len = 0;
 647         c->request_started = 0;
 648         c->sock->client_status = CLIENT_CONNECT;
 649
 650         event_set(&c->ev, s, EV_READ, fcgi_request, c);
 651         event_add(&c->ev, NULL);
 652
 653         evtimer_set(&c->tmo, fcgi_timeout, c);
 654         evtimer_add(&c->tmo, &timeout);
 655
 656         client_cnt++;
 657
 658         return;
 659 err:
 660         cgi_inflight--;
 661         close(s);
 662         if (c != NULL)
 663                 free(c);
 664 }
 665
 666 static void
 667 sockets_rlimit(int maxfd)
 668 {
 669         struct rlimit rl;
 670
 671         if (getrlimit(RLIMIT_NOFILE, &rl) == -1)
 672                 fatal("%s: failed to get resource limit", __func__);
 673         log_debug("%s: max open files %llu", __func__,
 674             (unsigned long long)rl.rlim_max);
 675
 676         /*
 677          * Allow the maximum number of open file descriptors for this
 678          * login class (which should be the class "daemon" by default).
 679          */
 680         if (maxfd == -1)
 681                 rl.rlim_cur = rl.rlim_max;
 682         else
 683                 rl.rlim_cur = MAXIMUM(rl.rlim_max, (rlim_t)maxfd);
 684         if (setrlimit(RLIMIT_NOFILE, &rl) == -1)
 685                 fatal("%s: failed to set resource limit", __func__);
 686 }