security/dirmngr/files/runDirmngr.c

   1 /*
   2    Spawns dirmngr with UID and GID with a specific UID and GID.
   3    The path for dirmngr is specified by the compiled-in definition
   4    DIRMNGR_USER, normally passed as a compiler argument:
   5
   6      `-D DIRMNGR_USER=DEFINITION'
   7
   8    The UID and GID are the uid and gid for user DIRMNGR_USER.
   9    DIRMNGR_USER is normally defined through a compiler argument
  10    also.
  11 */
  12
  13
  14 #include <unistd.h>
  15 #include <string.h>
  16 #include <stdio.h>
  17 #include <errno.h>
  18 #include <stdlib.h>
  19 #include <sys/wait.h>
  20 #include <pwd.h>
  21 #include <syslog.h>
  22
  23 #define MAX_ARGS 40
  24 #ifndef         TRUE
  25 #define         TRUE                            1
  26 #endif                          /* TRUE */
  27
  28 #ifndef         FALSE
  29 #define         FALSE                           0
  30 #endif                          /* FALSE */
  31
  32
  33 void error_sys(char *str)
  34
  35 {
  36     /* Output error message to syslog */
  37     char msg[1024];
  38     snprintf(msg, sizeof(msg), "runDirmngr : %s : %s", str, strerror(errno));
  39     syslog(LOG_ALERT, msg);
  40
  41 }
  42
  43
  44 int obtainUIDandGID(const char *name, uid_t *pw_uid, gid_t *pw_gid)
  45 {
  46     /* Obtain UID and GID from passwd entry identified by name */
  47     struct passwd *pw_entry;
  48     char msg[100];
  49
  50     if ((pw_entry = getpwnam(name)) == NULL)
  51     {
  52         snprintf(msg, sizeof(msg), "failed to get password entry for %s", name);
  53         error_sys(msg);
  54         return FALSE;
  55     }
  56     else
  57     {
  58         *pw_uid = pw_entry->pw_uid;
  59         *pw_gid = pw_entry->pw_gid;
  60         return TRUE;
  61
  62     }
  63 }
  64
  65
  66
  67
  68 int main (int argc, char **argv )
  69
  70 {
  71
  72     pid_t pid;
  73     uid_t UID;
  74     gid_t GID;
  75     pid_t pidwait;
  76     int waitstat;
  77
  78     /* Sanity check */
  79     if (argc > MAX_ARGS)
  80     {
  81         error_sys("arg buffer too small");
  82         exit(-1);
  83     }
  84 /*
  85     if (getpid() != 0)
  86     {
  87         error_sys("must be called by root");
  88         exit(-1);
  89     }
  90 */
  91
  92     /* fork child that will become dirmngr */
  93     if ((pid = fork()) < 0)
  94
  95         error_sys("fork error");
  96
  97     else
  98
  99     {
 100
 101         if (pid == 0)
 102
 103         {
 104
 105             /* We're the child */
 106             char *args[MAX_ARGS];
 107             unsigned int i;
 108
 109             if (!obtainUIDandGID(DIRMNGR_USER, &UID, &GID))
 110                 exit(-1);
 111
 112             /* Drop privileges immediately */
 113             if (setgid(GID) < 0)
 114             {
 115                 /* It is VERY important to check return
 116                    value and not continue if setgid fails
 117                 */
 118                 error_sys ("setgid failed");
 119                 exit (-1);
 120             }
 121
 122             if (setuid(UID) < 0)
 123             {
 124                 /* It is VERY important to check return
 125                    value and not continue if setuid fails
 126                 */
 127                 error_sys ("setuid failed");
 128                 exit (-1);
 129             }
 130
 131             /* Build calling argv */
 132             args[0] = DIRMNGR_PATH;
 133             for (i=1;i<argc;i++)
 134             {
 135                 args[i] = argv[i];
 136             }
 137             args[i++] = NULL;
 138
 139             /* Finally transform self into dirmngr */
 140             if (execvp(DIRMNGR_PATH, args) < 0)
 141                 error_sys("execve error");
 142             else
 143                 ; /* avoid if-then ambiguity */
 144         }
 145
 146         else
 147
 148         {
 149             /* We're the parent
 150                Wait for child to terminate
 151             */
 152             pidwait = waitpid(pid, &waitstat, 0);
 153             switch (pidwait) {
 154             case 0: exit(0);
 155             case -1:
 156                 perror(strerror(errno));
 157                 exit(-1);
 158             default:
 159                 if (WIFEXITED(waitstat)) {
 160                     exit(WEXITSTATUS(waitstat));
 161                 }
 162                 else
 163                 {
 164                     exit(-1);
 165                 }
 166             }
 167
 168         }
 169
 170     }
 171
 172 }