external/bsd/bind/dist/bin/named/unix/os.c

   1 /*      $NetBSD: os.c,v 1.8 2014/12/10 04:37:52 christos Exp $  */
   2
   3 /*
   4  * Copyright (C) 2004-2011, 2013, 2014  Internet Systems Consortium, Inc. ("ISC")
   5  * Copyright (C) 1999-2002  Internet Software Consortium.
   6  *
   7  * Permission to use, copy, modify, and/or distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
  12  * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
  13  * AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
  14  * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
  15  * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
  16  * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
  17  * PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 /* Id: os.c,v 1.107 2011/03/02 00:02:54 marka Exp  */
  21
  22 /*! \file */
  23
  24 #include <config.h>
  25 #include <stdarg.h>
  26
  27 #include <sys/types.h>  /* dev_t FreeBSD 2.1 */
  28 #include <sys/stat.h>
  29
  30 #include <ctype.h>
  31 #include <errno.h>
  32 #include <fcntl.h>
  33 #include <grp.h>                /* Required for initgroups() on IRIX. */
  34 #include <pwd.h>
  35 #include <stdio.h>
  36 #include <stdlib.h>
  37 #include <signal.h>
  38 #include <syslog.h>
  39 #ifdef HAVE_TZSET
  40 #include <time.h>
  41 #endif
  42 #include <unistd.h>
  43
  44 #include <isc/buffer.h>
  45 #include <isc/file.h>
  46 #include <isc/print.h>
  47 #include <isc/resource.h>
  48 #include <isc/result.h>
  49 #include <isc/strerror.h>
  50 #include <isc/string.h>
  51
  52 #include <named/main.h>
  53 #include <named/os.h>
  54 #ifdef HAVE_LIBSCF
  55 #include <named/ns_smf_globals.h>
  56 #endif
  57
  58 static char *pidfile = NULL;
  59 static int devnullfd = -1;
  60
  61 #ifndef ISC_FACILITY
  62 #define ISC_FACILITY LOG_DAEMON
  63 #endif
  64
  65 /*
  66  * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
  67  */
  68 #ifndef HAVE_LINUX_CAPABILITY_H
  69 #undef HAVE_SYS_PRCTL_H
  70 #endif
  71
  72 /*
  73  * Linux defines:
  74  *      (T) HAVE_LINUXTHREADS
  75  *      (C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H)
  76  *      (P) HAVE_SYS_PRCTL_H
  77  * The possible cases are:
  78  *      none:   setuid() normally
  79  *      T:      no setuid()
  80  *      C:      setuid() normally, drop caps (keep CAP_SETUID)
  81  *      T+C:    no setuid(), drop caps (don't keep CAP_SETUID)
  82  *      T+C+P:  setuid() early, drop caps (keep CAP_SETUID)
  83  *      C+P:    setuid() normally, drop caps (keep CAP_SETUID)
  84  *      P:      not possible
  85  *      T+P:    not possible
  86  *
  87  * if (C)
  88  *      caps = BIND_SERVICE + CHROOT + SETGID
  89  *      if ((T && C && P) || !T)
  90  *              caps += SETUID
  91  *      endif
  92  *      capset(caps)
  93  * endif
  94  * if (T && C && P && -u)
  95  *      setuid()
  96  * else if (T && -u)
  97  *      fail
  98  * --> start threads
  99  * if (!T && -u)
 100  *      setuid()
 101  * if (C && (P || !-u))
 102  *      caps = BIND_SERVICE
 103  *      capset(caps)
 104  * endif
 105  *
 106  * It will be nice when Linux threads work properly with setuid().
 107  */
 108
 109 #ifdef HAVE_LINUXTHREADS
 110 static pid_t mainpid = 0;
 111 #endif
 112
 113 static struct passwd *runas_pw = NULL;
 114 static isc_boolean_t done_setuid = ISC_FALSE;
 115 static int dfd[2] = { -1, -1 };
 116
 117 #ifdef HAVE_LINUX_CAPABILITY_H
 118
 119 static isc_boolean_t non_root = ISC_FALSE;
 120 static isc_boolean_t non_root_caps = ISC_FALSE;
 121
 122 #ifdef HAVE_SYS_CAPABILITY_H
 123 #include <sys/capability.h>
 124 #else
 125 #ifdef HAVE_LINUX_TYPES_H
 126 #include <linux/types.h>
 127 #endif
 128 /*%
 129  * We define _LINUX_FS_H to prevent it from being included.  We don't need
 130  * anything from it, and the files it includes cause warnings with 2.2
 131  * kernels, and compilation failures (due to conflicts between <linux/string.h>
 132  * and <string.h>) on 2.3 kernels.
 133  */
 134 #define _LINUX_FS_H
 135 #include <linux/capability.h>
 136 #include <syscall.h>
 137 #ifndef SYS_capset
 138 #ifndef __NR_capset
 139 #include <asm/unistd.h> /* Slackware 4.0 needs this. */
 140 #endif /* __NR_capset */
 141 #define SYS_capset __NR_capset
 142 #endif /* SYS_capset */
 143 #endif /* HAVE_SYS_CAPABILITY_H */
 144
 145 #ifdef HAVE_SYS_PRCTL_H
 146 #include <sys/prctl.h>          /* Required for prctl(). */
 147
 148 /*
 149  * If the value of PR_SET_KEEPCAPS is not in <sys/prctl.h>, define it
 150  * here.  This allows setuid() to work on systems running a new enough
 151  * kernel but with /usr/include/linux pointing to "standard" kernel
 152  * headers.
 153  */
 154 #ifndef PR_SET_KEEPCAPS
 155 #define PR_SET_KEEPCAPS 8
 156 #endif
 157
 158 #endif /* HAVE_SYS_PRCTL_H */
 159
 160 #ifdef HAVE_LIBCAP
 161 #define SETCAPS_FUNC "cap_set_proc "
 162 #else
 163 typedef unsigned int cap_t;
 164 #define SETCAPS_FUNC "syscall(capset) "
 165 #endif /* HAVE_LIBCAP */
 166
 167 static void
 168 linux_setcaps(cap_t caps) {
 169 #ifndef HAVE_LIBCAP
 170         struct __user_cap_header_struct caphead;
 171         struct __user_cap_data_struct cap;
 172 #endif
 173         char strbuf[ISC_STRERRORSIZE];
 174
 175         if ((getuid() != 0 && !non_root_caps) || non_root)
 176                 return;
 177 #ifndef HAVE_LIBCAP
 178         memset(&caphead, 0, sizeof(caphead));
 179         caphead.version = _LINUX_CAPABILITY_VERSION;
 180         caphead.pid = 0;
 181         memset(&cap, 0, sizeof(cap));
 182         cap.effective = caps;
 183         cap.permitted = caps;
 184         cap.inheritable = 0;
 185 #endif
 186 #ifdef HAVE_LIBCAP
 187         if (cap_set_proc(caps) < 0) {
 188 #else
 189         if (syscall(SYS_capset, &caphead, &cap) < 0) {
 190 #endif
 191                 isc__strerror(errno, strbuf, sizeof(strbuf));
 192                 ns_main_earlyfatal(SETCAPS_FUNC "failed: %s:"
 193                                    " please ensure that the capset kernel"
 194                                    " module is loaded.  see insmod(8)",
 195                                    strbuf);
 196         }
 197 }
 198
 199 #ifdef HAVE_LIBCAP
 200 #define SET_CAP(flag) \
 201         do { \
 202                 cap_flag_value_t curval; \
 203                 capval = (flag); \
 204                 err = cap_get_flag(curcaps, capval, CAP_PERMITTED, &curval); \
 205                 if (err != -1 && curval) { \
 206                         err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
 207                         if (err == -1) { \
 208                                 isc__strerror(errno, strbuf, sizeof(strbuf)); \
 209                                 ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 210                         } \
 211                         \
 212                         err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
 213                         if (err == -1) { \
 214                                 isc__strerror(errno, strbuf, sizeof(strbuf)); \
 215                                 ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 216                         } \
 217                 } \
 218         } while (/*CONSTCOND*/0)
 219 #define INIT_CAP \
 220         do { \
 221                 caps = cap_init(); \
 222                 if (caps == NULL) { \
 223                         isc__strerror(errno, strbuf, sizeof(strbuf)); \
 224                         ns_main_earlyfatal("cap_init failed: %s", strbuf); \
 225                 } \
 226                 curcaps = cap_get_proc(); \
 227                 if (curcaps == NULL) { \
 228                         isc__strerror(errno, strbuf, sizeof(strbuf)); \
 229                         ns_main_earlyfatal("cap_get_proc failed: %s", strbuf); \
 230                 } \
 231         } while (/*CONSTCOND*/0)
 232 #define FREE_CAP \
 233         { \
 234                 cap_free(caps); \
 235                 cap_free(curcaps); \
 236         } while (/*CONSTCOND*/0)
 237 #else
 238 #define SET_CAP(flag) do { caps |= (1 << (flag)); } while (/*CONSTCOND*/0)
 239 #define INIT_CAP do { caps = 0; } while (/*CONSTCOND*/0)
 240 #endif /* HAVE_LIBCAP */
 241
 242 static void
 243 linux_initialprivs(void) {
 244         cap_t caps;
 245 #ifdef HAVE_LIBCAP
 246         cap_t curcaps;
 247         cap_value_t capval;
 248         char strbuf[ISC_STRERRORSIZE];
 249         int err;
 250 #endif
 251
 252         /*%
 253          * We don't need most privileges, so we drop them right away.
 254          * Later on linux_minprivs() will be called, which will drop our
 255          * capabilities to the minimum needed to run the server.
 256          */
 257         INIT_CAP;
 258
 259         /*
 260          * We need to be able to bind() to privileged ports, notably port 53!
 261          */
 262         SET_CAP(CAP_NET_BIND_SERVICE);
 263
 264         /*
 265          * We need chroot() initially too.
 266          */
 267         SET_CAP(CAP_SYS_CHROOT);
 268
 269 #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
 270         /*
 271          * We can setuid() only if either the kernel supports keeping
 272          * capabilities after setuid() (which we don't know until we've
 273          * tried) or we're not using threads.  If either of these is
 274          * true, we want the setuid capability.
 275          */
 276         SET_CAP(CAP_SETUID);
 277 #endif
 278
 279         /*
 280          * Since we call initgroups, we need this.
 281          */
 282         SET_CAP(CAP_SETGID);
 283
 284         /*
 285          * Without this, we run into problems reading a configuration file
 286          * owned by a non-root user and non-world-readable on startup.
 287          */
 288         SET_CAP(CAP_DAC_READ_SEARCH);
 289
 290         /*
 291          * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
 292          *      clear it would work right given the way linuxthreads work.
 293          * XXXDCL But since we need to be able to set the maximum number
 294          * of files, the stack size, data size, and core dump size to
 295          * support named.conf options, this is now being added to test.
 296          */
 297         SET_CAP(CAP_SYS_RESOURCE);
 298
 299         /*
 300          * We need to be able to set the ownership of the containing
 301          * directory of the pid file when we create it.
 302          */
 303         SET_CAP(CAP_CHOWN);
 304
 305         linux_setcaps(caps);
 306
 307 #ifdef HAVE_LIBCAP
 308         FREE_CAP;
 309 #endif
 310 }
 311
 312 static void
 313 linux_minprivs(void) {
 314         cap_t caps;
 315 #ifdef HAVE_LIBCAP
 316         cap_t curcaps;
 317         cap_value_t capval;
 318         char strbuf[ISC_STRERRORSIZE];
 319         int err;
 320 #endif
 321
 322         INIT_CAP;
 323         /*%
 324          * Drop all privileges except the ability to bind() to privileged
 325          * ports.
 326          *
 327          * It's important that we drop CAP_SYS_CHROOT.  If we didn't, it
 328          * chroot() could be used to escape from the chrooted area.
 329          */
 330
 331         SET_CAP(CAP_NET_BIND_SERVICE);
 332
 333         /*
 334          * XXX  We might want to add CAP_SYS_RESOURCE, though it's not
 335          *      clear it would work right given the way linuxthreads work.
 336          * XXXDCL But since we need to be able to set the maximum number
 337          * of files, the stack size, data size, and core dump size to
 338          * support named.conf options, this is now being added to test.
 339          */
 340         SET_CAP(CAP_SYS_RESOURCE);
 341
 342         linux_setcaps(caps);
 343
 344 #ifdef HAVE_LIBCAP
 345         FREE_CAP;
 346 #endif
 347 }
 348
 349 #ifdef HAVE_SYS_PRCTL_H
 350 static void
 351 linux_keepcaps(void) {
 352         char strbuf[ISC_STRERRORSIZE];
 353         /*%
 354          * Ask the kernel to allow us to keep our capabilities after we
 355          * setuid().
 356          */
 357
 358         if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
 359                 if (errno != EINVAL) {
 360                         isc__strerror(errno, strbuf, sizeof(strbuf));
 361                         ns_main_earlyfatal("prctl() failed: %s", strbuf);
 362                 }
 363         } else {
 364                 non_root_caps = ISC_TRUE;
 365                 if (getuid() != 0)
 366                         non_root = ISC_TRUE;
 367         }
 368 }
 369 #endif
 370
 371 #endif  /* HAVE_LINUX_CAPABILITY_H */
 372
 373
 374 static void
 375 setup_syslog(const char *progname) {
 376         int options;
 377
 378         options = LOG_PID;
 379 #ifdef LOG_NDELAY
 380         options |= LOG_NDELAY;
 381 #endif
 382         openlog(isc_file_basename(progname), options, ISC_FACILITY);
 383 }
 384
 385 void
 386 ns_os_init(const char *progname) {
 387         setup_syslog(progname);
 388 #ifdef HAVE_LINUX_CAPABILITY_H
 389         linux_initialprivs();
 390 #endif
 391 #ifdef HAVE_LINUXTHREADS
 392         mainpid = getpid();
 393 #endif
 394 #ifdef SIGXFSZ
 395         signal(SIGXFSZ, SIG_IGN);
 396 #endif
 397 }
 398
 399 void
 400 ns_os_daemonize(void) {
 401         pid_t pid;
 402         char strbuf[ISC_STRERRORSIZE];
 403
 404         if (pipe(dfd) == -1) {
 405                 isc__strerror(errno, strbuf, sizeof(strbuf));
 406                 ns_main_earlyfatal("pipe(): %s", strbuf);
 407         }
 408
 409         pid = fork();
 410         if (pid == -1) {
 411                 isc__strerror(errno, strbuf, sizeof(strbuf));
 412                 ns_main_earlyfatal("fork(): %s", strbuf);
 413         }
 414         if (pid != 0) {
 415                 int n;
 416                 /*
 417                  * Wait for the child to finish loading for the first time.
 418                  * This would be so much simpler if fork() worked once we
 419                  * were multi-threaded.
 420                  */
 421                 (void)close(dfd[1]);
 422                 do {
 423                         char buf;
 424                         n = read(dfd[0], &buf, 1);
 425                         if (n == 1)
 426                                 _exit(0);
 427                 } while (n == -1 && errno == EINTR);
 428                 _exit(1);
 429         }
 430         (void)close(dfd[0]);
 431
 432         /*
 433          * We're the child.
 434          */
 435
 436 #ifdef HAVE_LINUXTHREADS
 437         mainpid = getpid();
 438 #endif
 439
 440         if (setsid() == -1) {
 441                 isc__strerror(errno, strbuf, sizeof(strbuf));
 442                 ns_main_earlyfatal("setsid(): %s", strbuf);
 443         }
 444
 445         /*
 446          * Try to set stdin, stdout, and stderr to /dev/null, but press
 447          * on even if it fails.
 448          *
 449          * XXXMLG The close() calls here are unneeded on all but NetBSD, but
 450          * are harmless to include everywhere.  dup2() is supposed to close
 451          * the FD if it is in use, but unproven-pthreads-0.16 is broken
 452          * and will end up closing the wrong FD.  This will be fixed eventually,
 453          * and these calls will be removed.
 454          */
 455         if (devnullfd != -1) {
 456                 if (devnullfd != STDIN_FILENO) {
 457                         (void)close(STDIN_FILENO);
 458                         (void)dup2(devnullfd, STDIN_FILENO);
 459                 }
 460                 if (devnullfd != STDOUT_FILENO) {
 461                         (void)close(STDOUT_FILENO);
 462                         (void)dup2(devnullfd, STDOUT_FILENO);
 463                 }
 464                 if (devnullfd != STDERR_FILENO) {
 465                         (void)close(STDERR_FILENO);
 466                         (void)dup2(devnullfd, STDERR_FILENO);
 467                 }
 468         }
 469 }
 470
 471 void
 472 ns_os_started(void) {
 473         char buf = 0;
 474
 475         /*
 476          * Signal to the parent that we started successfully.
 477          */
 478         if (dfd[0] != -1 && dfd[1] != -1) {
 479                 if (write(dfd[1], &buf, 1) != 1)
 480                         ns_main_earlyfatal("unable to signal parent that we "
 481                                            "otherwise started successfully.");
 482                 close(dfd[1]);
 483                 dfd[0] = dfd[1] = -1;
 484         }
 485 }
 486
 487 void
 488 ns_os_opendevnull(void) {
 489         devnullfd = open("/dev/null", O_RDWR, 0);
 490 }
 491
 492 void
 493 ns_os_closedevnull(void) {
 494         if (devnullfd != STDIN_FILENO &&
 495             devnullfd != STDOUT_FILENO &&
 496             devnullfd != STDERR_FILENO) {
 497                 close(devnullfd);
 498                 devnullfd = -1;
 499         }
 500 }
 501
 502 static isc_boolean_t
 503 all_digits(const char *s) {
 504         if (*s == '\0')
 505                 return (ISC_FALSE);
 506         while (*s != '\0') {
 507                 if (!isdigit((*s)&0xff))
 508                         return (ISC_FALSE);
 509                 s++;
 510         }
 511         return (ISC_TRUE);
 512 }
 513
 514 void
 515 ns_os_chroot(const char *root) {
 516         char strbuf[ISC_STRERRORSIZE];
 517 #ifdef HAVE_LIBSCF
 518         ns_smf_chroot = 0;
 519 #endif
 520         if (root != NULL) {
 521 #ifdef HAVE_CHROOT
 522                 if (chroot(root) < 0) {
 523                         isc__strerror(errno, strbuf, sizeof(strbuf));
 524                         ns_main_earlyfatal("chroot(): %s", strbuf);
 525                 }
 526 #else
 527                 ns_main_earlyfatal("chroot(): disabled");
 528 #endif
 529                 if (chdir("/") < 0) {
 530                         isc__strerror(errno, strbuf, sizeof(strbuf));
 531                         ns_main_earlyfatal("chdir(/): %s", strbuf);
 532                 }
 533 #ifdef HAVE_LIBSCF
 534                 /* Set ns_smf_chroot flag on successful chroot. */
 535                 ns_smf_chroot = 1;
 536 #endif
 537         }
 538 }
 539
 540 void
 541 ns_os_inituserinfo(const char *username) {
 542         char strbuf[ISC_STRERRORSIZE];
 543         if (username == NULL)
 544                 return;
 545
 546         if (all_digits(username))
 547                 runas_pw = getpwuid((uid_t)atoi(username));
 548         else
 549                 runas_pw = getpwnam(username);
 550         endpwent();
 551
 552         if (runas_pw == NULL)
 553                 ns_main_earlyfatal("user '%s' unknown", username);
 554
 555         if (getuid() == 0) {
 556                 if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0) {
 557                         isc__strerror(errno, strbuf, sizeof(strbuf));
 558                         ns_main_earlyfatal("initgroups(): %s", strbuf);
 559                 }
 560         }
 561
 562 }
 563
 564 void
 565 ns_os_changeuser(void) {
 566         char strbuf[ISC_STRERRORSIZE];
 567         if (runas_pw == NULL || done_setuid)
 568                 return;
 569
 570         done_setuid = ISC_TRUE;
 571
 572 #ifdef HAVE_LINUXTHREADS
 573 #ifdef HAVE_LINUX_CAPABILITY_H
 574         if (!non_root_caps)
 575                 ns_main_earlyfatal("-u with Linux threads not supported: "
 576                                    "requires kernel support for "
 577                                    "prctl(PR_SET_KEEPCAPS)");
 578 #else
 579         ns_main_earlyfatal("-u with Linux threads not supported: "
 580                            "no capabilities support or capabilities "
 581                            "disabled at build time");
 582 #endif
 583 #endif
 584
 585         if (setgid(runas_pw->pw_gid) < 0) {
 586                 isc__strerror(errno, strbuf, sizeof(strbuf));
 587                 ns_main_earlyfatal("setgid(): %s", strbuf);
 588         }
 589
 590         if (setuid(runas_pw->pw_uid) < 0) {
 591                 isc__strerror(errno, strbuf, sizeof(strbuf));
 592                 ns_main_earlyfatal("setuid(): %s", strbuf);
 593         }
 594
 595 #if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
 596         /*
 597          * Restore the ability of named to drop core after the setuid()
 598          * call has disabled it.
 599          */
 600         if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
 601                 isc__strerror(errno, strbuf, sizeof(strbuf));
 602                 ns_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
 603                                      strbuf);
 604         }
 605 #endif
 606 #if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
 607         linux_minprivs();
 608 #endif
 609 }
 610
 611 void
 612 ns_os_adjustnofile(void) {
 613 #ifdef HAVE_LINUXTHREADS
 614         isc_result_t result;
 615         isc_resourcevalue_t newvalue;
 616
 617         /*
 618          * Linux: max number of open files specified by one thread doesn't seem
 619          * to apply to other threads on Linux.
 620          */
 621         newvalue = ISC_RESOURCE_UNLIMITED;
 622
 623         result = isc_resource_setlimit(isc_resource_openfiles, newvalue);
 624         if (result != ISC_R_SUCCESS)
 625                 ns_main_earlywarning("couldn't adjust limit on open files");
 626 #endif
 627 }
 628
 629 void
 630 ns_os_minprivs(void) {
 631 #ifdef HAVE_SYS_PRCTL_H
 632         linux_keepcaps();
 633 #endif
 634
 635 #ifdef HAVE_LINUXTHREADS
 636         ns_os_changeuser(); /* Call setuid() before threads are started */
 637 #endif
 638
 639 #if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
 640         linux_minprivs();
 641 #endif
 642 }
 643
 644 static int
 645 safe_open(const char *filename, mode_t mode, isc_boolean_t append) {
 646         int fd;
 647         struct stat sb;
 648
 649         if (stat(filename, &sb) == -1) {
 650                 if (errno != ENOENT)
 651                         return (-1);
 652         } else if ((sb.st_mode & S_IFREG) == 0) {
 653                 errno = EOPNOTSUPP;
 654                 return (-1);
 655         }
 656
 657         if (append)
 658                 fd = open(filename, O_WRONLY|O_CREAT|O_APPEND, mode);
 659         else {
 660                 if (unlink(filename) < 0 && errno != ENOENT)
 661                         return (-1);
 662                 fd = open(filename, O_WRONLY|O_CREAT|O_EXCL, mode);
 663         }
 664         return (fd);
 665 }
 666
 667 static void
 668 cleanup_pidfile(void) {
 669         int n;
 670         if (pidfile != NULL) {
 671                 n = unlink(pidfile);
 672                 if (n == -1 && errno != ENOENT)
 673                         ns_main_earlywarning("unlink '%s': failed", pidfile);
 674                 free(pidfile);
 675         }
 676         pidfile = NULL;
 677 }
 678
 679 static int
 680 mkdirpath(char *filename, void (*report)(const char *, ...)) {
 681         char *slash = strrchr(filename, '/');
 682         char strbuf[ISC_STRERRORSIZE];
 683         unsigned int mode;
 684
 685         if (slash != NULL && slash != filename) {
 686                 struct stat sb;
 687                 *slash = '\0';
 688
 689                 if (stat(filename, &sb) == -1) {
 690                         if (errno != ENOENT) {
 691                                 isc__strerror(errno, strbuf, sizeof(strbuf));
 692                                 (*report)("couldn't stat '%s': %s", filename,
 693                                           strbuf);
 694                                 goto error;
 695                         }
 696                         if (mkdirpath(filename, report) == -1)
 697                                 goto error;
 698                         /*
 699                          * Handle "//", "/./" and "/../" in path.
 700                          */
 701                         if (!strcmp(slash + 1, "") ||
 702                             !strcmp(slash + 1, ".") ||
 703                             !strcmp(slash + 1, "..")) {
 704                                 *slash = '/';
 705                                 return (0);
 706                         }
 707                         mode = S_IRUSR | S_IWUSR | S_IXUSR;     /* u=rwx */
 708                         mode |= S_IRGRP | S_IXGRP;              /* g=rx */
 709                         mode |= S_IROTH | S_IXOTH;              /* o=rx */
 710                         if (mkdir(filename, mode) == -1) {
 711                                 isc__strerror(errno, strbuf, sizeof(strbuf));
 712                                 (*report)("couldn't mkdir '%s': %s", filename,
 713                                           strbuf);
 714                                 goto error;
 715                         }
 716                         if (runas_pw != NULL &&
 717                             chown(filename, runas_pw->pw_uid,
 718                                   runas_pw->pw_gid) == -1) {
 719                                 isc__strerror(errno, strbuf, sizeof(strbuf));
 720                                 (*report)("couldn't chown '%s': %s", filename,
 721                                           strbuf);
 722                         }
 723                 }
 724                 *slash = '/';
 725         }
 726         return (0);
 727
 728  error:
 729         *slash = '/';
 730         return (-1);
 731 }
 732
 733 static void
 734 setperms(uid_t uid, gid_t gid) {
 735         char strbuf[ISC_STRERRORSIZE];
 736 #if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
 737         gid_t oldgid, tmpg;
 738 #endif
 739 #if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID)
 740         uid_t olduid, tmpu;
 741 #endif
 742 #if defined(HAVE_SETEGID)
 743         if (getegid() != gid && setegid(gid) == -1) {
 744                 isc__strerror(errno, strbuf, sizeof(strbuf));
 745                 ns_main_earlywarning("unable to set effective gid to %ld: %s",
 746                                      (long)gid, strbuf);
 747         }
 748 #elif defined(HAVE_SETRESGID)
 749         if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
 750                 if (setresgid(-1, gid, -1) == -1) {
 751                         isc__strerror(errno, strbuf, sizeof(strbuf));
 752                         ns_main_earlywarning("unable to set effective "
 753                                              "gid to %d: %s", gid, strbuf);
 754                 }
 755         }
 756 #endif
 757
 758 #if defined(HAVE_SETEUID)
 759         if (geteuid() != uid && seteuid(uid) == -1) {
 760                 isc__strerror(errno, strbuf, sizeof(strbuf));
 761                 ns_main_earlywarning("unable to set effective uid to %ld: %s",
 762                                      (long)uid, strbuf);
 763         }
 764 #elif defined(HAVE_SETRESUID)
 765         if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
 766                 if (setresuid(-1, uid, -1) == -1) {
 767                         isc__strerror(errno, strbuf, sizeof(strbuf));
 768                         ns_main_earlywarning("unable to set effective "
 769                                              "uid to %d: %s", uid, strbuf);
 770                 }
 771         }
 772 #endif
 773 }
 774
 775 FILE *
 776 ns_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {
 777         char strbuf[ISC_STRERRORSIZE], *f;
 778         FILE *fp;
 779         int fd;
 780
 781         /*
 782          * Make the containing directory if it doesn't exist.
 783          */
 784         f = strdup(filename);
 785         if (f == NULL) {
 786                 isc__strerror(errno, strbuf, sizeof(strbuf));
 787                 ns_main_earlywarning("couldn't strdup() '%s': %s",
 788                                      filename, strbuf);
 789                 return (NULL);
 790         }
 791         if (mkdirpath(f, ns_main_earlywarning) == -1) {
 792                 free(f);
 793                 return (NULL);
 794         }
 795         free(f);
 796
 797         if (switch_user && runas_pw != NULL) {
 798 #ifndef HAVE_LINUXTHREADS
 799                 gid_t oldgid = getgid();
 800 #endif
 801                 /* Set UID/GID to the one we'll be running with eventually */
 802                 setperms(runas_pw->pw_uid, runas_pw->pw_gid);
 803
 804                 fd = safe_open(filename, mode, ISC_FALSE);
 805
 806 #ifndef HAVE_LINUXTHREADS
 807                 /* Restore UID/GID to root */
 808                 setperms(0, oldgid);
 809 #endif /* HAVE_LINUXTHREADS */
 810
 811                 if (fd == -1) {
 812 #ifndef HAVE_LINUXTHREADS
 813                         fd = safe_open(filename, mode, ISC_FALSE);
 814                         if (fd != -1) {
 815                                 ns_main_earlywarning("Required root "
 816                                                      "permissions to open "
 817                                                      "'%s'.", filename);
 818                         } else {
 819                                 ns_main_earlywarning("Could not open "
 820                                                      "'%s'.", filename);
 821                         }
 822                         ns_main_earlywarning("Please check file and "
 823                                              "directory permissions "
 824                                              "or reconfigure the filename.");
 825 #else /* HAVE_LINUXTHREADS */
 826                         ns_main_earlywarning("Could not open "
 827                                              "'%s'.", filename);
 828                         ns_main_earlywarning("Please check file and "
 829                                              "directory permissions "
 830                                              "or reconfigure the filename.");
 831 #endif /* HAVE_LINUXTHREADS */
 832                 }
 833         } else {
 834                 fd = safe_open(filename, mode, ISC_FALSE);
 835         }
 836
 837         if (fd < 0) {
 838                 isc__strerror(errno, strbuf, sizeof(strbuf));
 839                 ns_main_earlywarning("could not open file '%s': %s",
 840                                      filename, strbuf);
 841                 return (NULL);
 842         }
 843
 844         fp = fdopen(fd, "w");
 845         if (fp == NULL) {
 846                 isc__strerror(errno, strbuf, sizeof(strbuf));
 847                 ns_main_earlywarning("could not fdopen() file '%s': %s",
 848                                      filename, strbuf);
 849         }
 850
 851         return (fp);
 852 }
 853
 854 void
 855 ns_os_writepidfile(const char *filename, isc_boolean_t first_time) {
 856         FILE *lockfile;
 857         pid_t pid;
 858         char strbuf[ISC_STRERRORSIZE];
 859         void (*report)(const char *, ...);
 860
 861         /*
 862          * The caller must ensure any required synchronization.
 863          */
 864
 865         report = first_time ? ns_main_earlyfatal : ns_main_earlywarning;
 866
 867         cleanup_pidfile();
 868
 869         if (filename == NULL)
 870                 return;
 871
 872         pidfile = strdup(filename);
 873         if (pidfile == NULL) {
 874                 isc__strerror(errno, strbuf, sizeof(strbuf));
 875                 (*report)("couldn't strdup() '%s': %s", filename, strbuf);
 876                 return;
 877         }
 878
 879         lockfile = ns_os_openfile(filename, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH,
 880                                   first_time);
 881         if (lockfile == NULL) {
 882                 cleanup_pidfile();
 883                 return;
 884         }
 885 #ifdef HAVE_LINUXTHREADS
 886         pid = mainpid;
 887 #else
 888         pid = getpid();
 889 #endif
 890         if (fprintf(lockfile, "%ld\n", (long)pid) < 0) {
 891                 (*report)("fprintf() to pid file '%s' failed", filename);
 892                 (void)fclose(lockfile);
 893                 cleanup_pidfile();
 894                 return;
 895         }
 896         if (fflush(lockfile) == EOF) {
 897                 (*report)("fflush() to pid file '%s' failed", filename);
 898                 (void)fclose(lockfile);
 899                 cleanup_pidfile();
 900                 return;
 901         }
 902         (void)fclose(lockfile);
 903 }
 904
 905 void
 906 ns_os_shutdown(void) {
 907         closelog();
 908         cleanup_pidfile();
 909 }
 910
 911 isc_result_t
 912 ns_os_gethostname(char *buf, size_t len) {
 913         int n;
 914
 915         n = gethostname(buf, len);
 916         return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
 917 }
 918
 919 static char *
 920 next_token(char **stringp, const char *delim) {
 921         char *res;
 922
 923         do {
 924                 res = strsep(stringp, delim);
 925                 if (res == NULL)
 926                         break;
 927         } while (*res == '\0');
 928         return (res);
 929 }
 930
 931 void
 932 ns_os_shutdownmsg(char *command, isc_buffer_t *text) {
 933         char *input, *ptr;
 934         unsigned int n;
 935         pid_t pid;
 936
 937         input = command;
 938
 939         /* Skip the command name. */
 940         ptr = next_token(&input, " \t");
 941         if (ptr == NULL)
 942                 return;
 943
 944         ptr = next_token(&input, " \t");
 945         if (ptr == NULL)
 946                 return;
 947
 948         if (strcmp(ptr, "-p") != 0)
 949                 return;
 950
 951 #ifdef HAVE_LINUXTHREADS
 952         pid = mainpid;
 953 #else
 954         pid = getpid();
 955 #endif
 956
 957         n = snprintf((char *)isc_buffer_used(text),
 958                      isc_buffer_availablelength(text),
 959                      "pid: %ld", (long)pid);
 960         /* Only send a message if it is complete. */
 961         if (n > 0 && n < isc_buffer_availablelength(text))
 962                 isc_buffer_add(text, n);
 963 }
 964
 965 void
 966 ns_os_tzset(void) {
 967 #ifdef HAVE_TZSET
 968         tzset();
 969 #endif
 970 }