4 * Copyright (C) 2004-2009 Internet Systems Consortium, Inc. ("ISC")
5 * Copyright (C) 1999-2002 Internet Software Consortium.
7 * Permission to use, copy, modify, and/or distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
11 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
12 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
13 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
14 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
15 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
16 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
17 * PERFORMANCE OF THIS SOFTWARE.
20 /* Id: os.c,v 1.101 2009/08/13 07:04:38 marka Exp */
27 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
33 #include <grp.h> /* Required for initgroups() on IRIX. */
44 #include <isc/buffer.h>
46 #include <isc/print.h>
47 #include <isc/resource.h>
48 #include <isc/result.h>
49 #include <isc/strerror.h>
50 #include <isc/string.h>
52 #include <named/main.h>
55 #include <named/ns_smf_globals.h>
58 static char *pidfile
= NULL
;
59 static int devnullfd
= -1;
62 #define ISC_FACILITY LOG_DAEMON
66 * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
68 #ifndef HAVE_LINUX_CAPABILITY_H
69 #undef HAVE_SYS_PRCTL_H
74 * (T) HAVE_LINUXTHREADS
75 * (C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H)
76 * (P) HAVE_SYS_PRCTL_H
77 * The possible cases are:
78 * none: setuid() normally
80 * C: setuid() normally, drop caps (keep CAP_SETUID)
81 * T+C: no setuid(), drop caps (don't keep CAP_SETUID)
82 * T+C+P: setuid() early, drop caps (keep CAP_SETUID)
83 * C+P: setuid() normally, drop caps (keep CAP_SETUID)
88 * caps = BIND_SERVICE + CHROOT + SETGID
89 * if ((T && C && P) || !T)
94 * if (T && C && P && -u)
101 * if (C && (P || !-u))
102 * caps = BIND_SERVICE
106 * It will be nice when Linux threads work properly with setuid().
109 #ifdef HAVE_LINUXTHREADS
110 static pid_t mainpid
= 0;
113 static struct passwd
*runas_pw
= NULL
;
114 static isc_boolean_t done_setuid
= ISC_FALSE
;
115 static int dfd
[2] = { -1, -1 };
117 #ifdef HAVE_LINUX_CAPABILITY_H
119 static isc_boolean_t non_root
= ISC_FALSE
;
120 static isc_boolean_t non_root_caps
= ISC_FALSE
;
122 #ifdef HAVE_SYS_CAPABILITY_H
123 #include <sys/capability.h>
126 * We define _LINUX_FS_H to prevent it from being included. We don't need
127 * anything from it, and the files it includes cause warnings with 2.2
128 * kernels, and compilation failures (due to conflicts between <linux/string.h>
129 * and <string.h>) on 2.3 kernels.
132 #include <linux/capability.h>
136 #include <asm/unistd.h> /* Slackware 4.0 needs this. */
137 #endif /* __NR_capset */
138 #define SYS_capset __NR_capset
139 #endif /* SYS_capset */
140 #endif /* HAVE_SYS_CAPABILITY_H */
142 #ifdef HAVE_SYS_PRCTL_H
143 #include <sys/prctl.h> /* Required for prctl(). */
146 * If the value of PR_SET_KEEPCAPS is not in <sys/prctl.h>, define it
147 * here. This allows setuid() to work on systems running a new enough
148 * kernel but with /usr/include/linux pointing to "standard" kernel
151 #ifndef PR_SET_KEEPCAPS
152 #define PR_SET_KEEPCAPS 8
155 #endif /* HAVE_SYS_PRCTL_H */
158 #define SETCAPS_FUNC "cap_set_proc "
160 typedef unsigned int cap_t
;
161 #define SETCAPS_FUNC "syscall(capset) "
162 #endif /* HAVE_LIBCAP */
165 linux_setcaps(cap_t caps
) {
167 struct __user_cap_header_struct caphead
;
168 struct __user_cap_data_struct cap
;
170 char strbuf
[ISC_STRERRORSIZE
];
172 if ((getuid() != 0 && !non_root_caps
) || non_root
)
175 memset(&caphead
, 0, sizeof(caphead
));
176 caphead
.version
= _LINUX_CAPABILITY_VERSION
;
178 memset(&cap
, 0, sizeof(cap
));
179 cap
.effective
= caps
;
180 cap
.permitted
= caps
;
184 if (cap_set_proc(caps
) < 0) {
186 if (syscall(SYS_capset
, &caphead
, &cap
) < 0) {
188 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
189 ns_main_earlyfatal(SETCAPS_FUNC
"failed: %s:"
190 " please ensure that the capset kernel"
191 " module is loaded. see insmod(8)",
197 #define SET_CAP(flag) \
200 cap_flag_value_t curval; \
201 err = cap_get_flag(curcaps, capval, CAP_PERMITTED, &curval); \
202 if (err != -1 && curval) { \
203 err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
205 isc__strerror(errno, strbuf, sizeof(strbuf)); \
206 ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
209 err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
211 isc__strerror(errno, strbuf, sizeof(strbuf)); \
212 ns_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
219 if (caps == NULL) { \
220 isc__strerror(errno, strbuf, sizeof(strbuf)); \
221 ns_main_earlyfatal("cap_init failed: %s", strbuf); \
223 curcaps = cap_get_proc(); \
224 if (curcaps == NULL) { \
225 isc__strerror(errno, strbuf, sizeof(strbuf)); \
226 ns_main_earlyfatal("cap_get_proc failed: %s", strbuf); \
235 #define SET_CAP(flag) do { caps |= (1 << (flag)); } while (0)
236 #define INIT_CAP do { caps = 0; } while (0)
237 #endif /* HAVE_LIBCAP */
240 linux_initialprivs(void) {
245 char strbuf
[ISC_STRERRORSIZE
];
250 * We don't need most privileges, so we drop them right away.
251 * Later on linux_minprivs() will be called, which will drop our
252 * capabilities to the minimum needed to run the server.
257 * We need to be able to bind() to privileged ports, notably port 53!
259 SET_CAP(CAP_NET_BIND_SERVICE
);
262 * We need chroot() initially too.
264 SET_CAP(CAP_SYS_CHROOT
);
266 #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
268 * We can setuid() only if either the kernel supports keeping
269 * capabilities after setuid() (which we don't know until we've
270 * tried) or we're not using threads. If either of these is
271 * true, we want the setuid capability.
277 * Since we call initgroups, we need this.
282 * Without this, we run into problems reading a configuration file
283 * owned by a non-root user and non-world-readable on startup.
285 SET_CAP(CAP_DAC_READ_SEARCH
);
288 * XXX We might want to add CAP_SYS_RESOURCE, though it's not
289 * clear it would work right given the way linuxthreads work.
290 * XXXDCL But since we need to be able to set the maximum number
291 * of files, the stack size, data size, and core dump size to
292 * support named.conf options, this is now being added to test.
294 SET_CAP(CAP_SYS_RESOURCE
);
297 * We need to be able to set the ownership of the containing
298 * directory of the pid file when we create it.
310 linux_minprivs(void) {
315 char strbuf
[ISC_STRERRORSIZE
];
321 * Drop all privileges except the ability to bind() to privileged
324 * It's important that we drop CAP_SYS_CHROOT. If we didn't, it
325 * chroot() could be used to escape from the chrooted area.
328 SET_CAP(CAP_NET_BIND_SERVICE
);
331 * XXX We might want to add CAP_SYS_RESOURCE, though it's not
332 * clear it would work right given the way linuxthreads work.
333 * XXXDCL But since we need to be able to set the maximum number
334 * of files, the stack size, data size, and core dump size to
335 * support named.conf options, this is now being added to test.
337 SET_CAP(CAP_SYS_RESOURCE
);
346 #ifdef HAVE_SYS_PRCTL_H
348 linux_keepcaps(void) {
349 char strbuf
[ISC_STRERRORSIZE
];
351 * Ask the kernel to allow us to keep our capabilities after we
355 if (prctl(PR_SET_KEEPCAPS
, 1, 0, 0, 0) < 0) {
356 if (errno
!= EINVAL
) {
357 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
358 ns_main_earlyfatal("prctl() failed: %s", strbuf
);
361 non_root_caps
= ISC_TRUE
;
368 #endif /* HAVE_LINUX_CAPABILITY_H */
372 setup_syslog(const char *progname
) {
377 options
|= LOG_NDELAY
;
379 openlog(isc_file_basename(progname
), options
, ISC_FACILITY
);
383 ns_os_init(const char *progname
) {
384 setup_syslog(progname
);
385 #ifdef HAVE_LINUX_CAPABILITY_H
386 linux_initialprivs();
388 #ifdef HAVE_LINUXTHREADS
392 signal(SIGXFSZ
, SIG_IGN
);
397 ns_os_daemonize(void) {
399 char strbuf
[ISC_STRERRORSIZE
];
401 if (pipe(dfd
) == -1) {
402 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
403 ns_main_earlyfatal("pipe(): %s", strbuf
);
408 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
409 ns_main_earlyfatal("fork(): %s", strbuf
);
414 * Wait for the child to finish loading for the first time.
415 * This would be so much simpler if fork() worked once we
416 * were multi-threaded.
421 n
= read(dfd
[0], &buf
, 1);
424 } while (n
== -1 && errno
== EINTR
);
433 #ifdef HAVE_LINUXTHREADS
437 if (setsid() == -1) {
438 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
439 ns_main_earlyfatal("setsid(): %s", strbuf
);
443 * Try to set stdin, stdout, and stderr to /dev/null, but press
444 * on even if it fails.
446 * XXXMLG The close() calls here are unneeded on all but NetBSD, but
447 * are harmless to include everywhere. dup2() is supposed to close
448 * the FD if it is in use, but unproven-pthreads-0.16 is broken
449 * and will end up closing the wrong FD. This will be fixed eventually,
450 * and these calls will be removed.
452 if (devnullfd
!= -1) {
453 if (devnullfd
!= STDIN_FILENO
) {
454 (void)close(STDIN_FILENO
);
455 (void)dup2(devnullfd
, STDIN_FILENO
);
457 if (devnullfd
!= STDOUT_FILENO
) {
458 (void)close(STDOUT_FILENO
);
459 (void)dup2(devnullfd
, STDOUT_FILENO
);
461 if (devnullfd
!= STDERR_FILENO
) {
462 (void)close(STDERR_FILENO
);
463 (void)dup2(devnullfd
, STDERR_FILENO
);
469 ns_os_started(void) {
473 * Signal to the parent that we started successfully.
475 if (dfd
[0] != -1 && dfd
[1] != -1) {
476 if (write(dfd
[1], &buf
, 1) != 1)
477 ns_main_earlyfatal("unable to signal parent that we "
478 "otherwise started successfully.");
480 dfd
[0] = dfd
[1] = -1;
485 ns_os_opendevnull(void) {
486 devnullfd
= open("/dev/null", O_RDWR
, 0);
490 ns_os_closedevnull(void) {
491 if (devnullfd
!= STDIN_FILENO
&&
492 devnullfd
!= STDOUT_FILENO
&&
493 devnullfd
!= STDERR_FILENO
) {
500 all_digits(const char *s
) {
504 if (!isdigit((*s
)&0xff))
512 ns_os_chroot(const char *root
) {
513 char strbuf
[ISC_STRERRORSIZE
];
519 if (chroot(root
) < 0) {
520 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
521 ns_main_earlyfatal("chroot(): %s", strbuf
);
524 ns_main_earlyfatal("chroot(): disabled");
526 if (chdir("/") < 0) {
527 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
528 ns_main_earlyfatal("chdir(/): %s", strbuf
);
531 /* Set ns_smf_chroot flag on successful chroot. */
538 ns_os_inituserinfo(const char *username
) {
539 char strbuf
[ISC_STRERRORSIZE
];
540 if (username
== NULL
)
543 if (all_digits(username
))
544 runas_pw
= getpwuid((uid_t
)atoi(username
));
546 runas_pw
= getpwnam(username
);
549 if (runas_pw
== NULL
)
550 ns_main_earlyfatal("user '%s' unknown", username
);
553 if (initgroups(runas_pw
->pw_name
, runas_pw
->pw_gid
) < 0) {
554 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
555 ns_main_earlyfatal("initgroups(): %s", strbuf
);
562 ns_os_changeuser(void) {
563 char strbuf
[ISC_STRERRORSIZE
];
564 if (runas_pw
== NULL
|| done_setuid
)
567 done_setuid
= ISC_TRUE
;
569 #ifdef HAVE_LINUXTHREADS
570 #ifdef HAVE_LINUX_CAPABILITY_H
572 ns_main_earlyfatal("-u with Linux threads not supported: "
573 "requires kernel support for "
574 "prctl(PR_SET_KEEPCAPS)");
576 ns_main_earlyfatal("-u with Linux threads not supported: "
577 "no capabilities support or capabilities "
578 "disabled at build time");
582 if (setgid(runas_pw
->pw_gid
) < 0) {
583 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
584 ns_main_earlyfatal("setgid(): %s", strbuf
);
587 if (setuid(runas_pw
->pw_uid
) < 0) {
588 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
589 ns_main_earlyfatal("setuid(): %s", strbuf
);
592 #if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
594 * Restore the ability of named to drop core after the setuid()
595 * call has disabled it.
597 if (prctl(PR_SET_DUMPABLE
,1,0,0,0) < 0) {
598 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
599 ns_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
603 #if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
609 ns_os_adjustnofile() {
610 #ifdef HAVE_LINUXTHREADS
612 isc_resourcevalue_t newvalue
;
615 * Linux: max number of open files specified by one thread doesn't seem
616 * to apply to other threads on Linux.
618 newvalue
= ISC_RESOURCE_UNLIMITED
;
620 result
= isc_resource_setlimit(isc_resource_openfiles
, newvalue
);
621 if (result
!= ISC_R_SUCCESS
)
622 ns_main_earlywarning("couldn't adjust limit on open files");
627 ns_os_minprivs(void) {
628 #ifdef HAVE_SYS_PRCTL_H
632 #ifdef HAVE_LINUXTHREADS
633 ns_os_changeuser(); /* Call setuid() before threads are started */
636 #if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
642 safe_open(const char *filename
, mode_t mode
, isc_boolean_t append
) {
646 if (stat(filename
, &sb
) == -1) {
649 } else if ((sb
.st_mode
& S_IFREG
) == 0) {
655 fd
= open(filename
, O_WRONLY
|O_CREAT
|O_APPEND
, mode
);
657 if (unlink(filename
) < 0 && errno
!= ENOENT
)
659 fd
= open(filename
, O_WRONLY
|O_CREAT
|O_EXCL
, mode
);
665 cleanup_pidfile(void) {
667 if (pidfile
!= NULL
) {
669 if (n
== -1 && errno
!= ENOENT
)
670 ns_main_earlywarning("unlink '%s': failed", pidfile
);
677 mkdirpath(char *filename
, void (*report
)(const char *, ...)) {
678 char *slash
= strrchr(filename
, '/');
679 char strbuf
[ISC_STRERRORSIZE
];
682 if (slash
!= NULL
&& slash
!= filename
) {
686 if (stat(filename
, &sb
) == -1) {
687 if (errno
!= ENOENT
) {
688 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
689 (*report
)("couldn't stat '%s': %s", filename
,
693 if (mkdirpath(filename
, report
) == -1)
696 * Handle "//", "/./" and "/../" in path.
698 if (!strcmp(slash
+ 1, "") ||
699 !strcmp(slash
+ 1, ".") ||
700 !strcmp(slash
+ 1, "..")) {
704 mode
= S_IRUSR
| S_IWUSR
| S_IXUSR
; /* u=rwx */
705 mode
|= S_IRGRP
| S_IXGRP
; /* g=rx */
706 mode
|= S_IROTH
| S_IXOTH
; /* o=rx */
707 if (mkdir(filename
, mode
) == -1) {
708 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
709 (*report
)("couldn't mkdir '%s': %s", filename
,
713 if (runas_pw
!= NULL
&&
714 chown(filename
, runas_pw
->pw_uid
,
715 runas_pw
->pw_gid
) == -1) {
716 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
717 (*report
)("couldn't chown '%s': %s", filename
,
731 setperms(uid_t uid
, gid_t gid
) {
732 char strbuf
[ISC_STRERRORSIZE
];
733 #if !defined(HAVE_SETEGID) && defined(HAVE_SETRESGID)
736 #if !defined(HAVE_SETEUID) && defined(HAVE_SETRESUID)
739 #if defined(HAVE_SETEGID)
740 if (getegid() != gid
&& setegid(gid
) == -1) {
741 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
742 ns_main_earlywarning("unable to set effective gid to %ld: %s",
745 #elif defined(HAVE_SETRESGID)
746 if (getresgid(&tmpg
, &oldgid
, &tmpg
) == -1 || oldgid
!= gid
) {
747 if (setresgid(-1, gid
, -1) == -1) {
748 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
749 ns_main_earlywarning("unable to set effective "
750 "gid to %d: %s", gid
, strbuf
);
755 #if defined(HAVE_SETEUID)
756 if (geteuid() != uid
&& seteuid(uid
) == -1) {
757 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
758 ns_main_earlywarning("unable to set effective uid to %ld: %s",
761 #elif defined(HAVE_SETRESUID)
762 if (getresuid(&tmpu
, &olduid
, &tmpu
) == -1 || olduid
!= uid
) {
763 if (setresuid(-1, uid
, -1) == -1) {
764 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
765 ns_main_earlywarning("unable to set effective "
766 "uid to %d: %s", uid
, strbuf
);
773 ns_os_openfile(const char *filename
, mode_t mode
, isc_boolean_t switch_user
) {
774 char strbuf
[ISC_STRERRORSIZE
], *f
;
779 * Make the containing directory if it doesn't exist.
781 f
= strdup(filename
);
783 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
784 ns_main_earlywarning("couldn't strdup() '%s': %s",
788 if (mkdirpath(f
, ns_main_earlywarning
) == -1) {
794 if (switch_user
&& runas_pw
!= NULL
) {
795 /* Set UID/GID to the one we'll be running with eventually */
796 setperms(runas_pw
->pw_uid
, runas_pw
->pw_gid
);
798 fd
= safe_open(filename
, mode
, ISC_FALSE
);
800 #ifndef HAVE_LINUXTHREADS
801 /* Restore UID/GID to root */
803 #endif /* HAVE_LINUXTHREADS */
806 #ifndef HAVE_LINUXTHREADS
807 fd
= safe_open(filename
, mode
, ISC_FALSE
);
809 ns_main_earlywarning("Required root "
810 "permissions to open "
813 ns_main_earlywarning("Could not open "
816 ns_main_earlywarning("Please check file and "
817 "directory permissions "
818 "or reconfigure the filename.");
819 #else /* HAVE_LINUXTHREADS */
820 ns_main_earlywarning("Could not open "
822 ns_main_earlywarning("Please check file and "
823 "directory permissions "
824 "or reconfigure the filename.");
825 #endif /* HAVE_LINUXTHREADS */
828 fd
= safe_open(filename
, mode
, ISC_FALSE
);
832 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
833 ns_main_earlywarning("could not open file '%s': %s",
838 fp
= fdopen(fd
, "w");
840 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
841 ns_main_earlywarning("could not fdopen() file '%s': %s",
849 ns_os_writepidfile(const char *filename
, isc_boolean_t first_time
) {
852 char strbuf
[ISC_STRERRORSIZE
];
853 void (*report
)(const char *, ...);
856 * The caller must ensure any required synchronization.
859 report
= first_time
? ns_main_earlyfatal
: ns_main_earlywarning
;
863 if (filename
== NULL
)
866 pidfile
= strdup(filename
);
867 if (pidfile
== NULL
) {
868 isc__strerror(errno
, strbuf
, sizeof(strbuf
));
869 (*report
)("couldn't strdup() '%s': %s", filename
, strbuf
);
873 lockfile
= ns_os_openfile(filename
, S_IRUSR
|S_IWUSR
|S_IRGRP
|S_IROTH
,
875 if (lockfile
== NULL
) {
879 #ifdef HAVE_LINUXTHREADS
884 if (fprintf(lockfile
, "%ld\n", (long)pid
) < 0) {
885 (*report
)("fprintf() to pid file '%s' failed", filename
);
886 (void)fclose(lockfile
);
890 if (fflush(lockfile
) == EOF
) {
891 (*report
)("fflush() to pid file '%s' failed", filename
);
892 (void)fclose(lockfile
);
896 (void)fclose(lockfile
);
900 ns_os_shutdown(void) {
906 ns_os_gethostname(char *buf
, size_t len
) {
909 n
= gethostname(buf
, len
);
910 return ((n
== 0) ? ISC_R_SUCCESS
: ISC_R_FAILURE
);
914 next_token(char **stringp
, const char *delim
) {
918 res
= strsep(stringp
, delim
);
921 } while (*res
== '\0');
926 ns_os_shutdownmsg(char *command
, isc_buffer_t
*text
) {
933 /* Skip the command name. */
934 ptr
= next_token(&input
, " \t");
938 ptr
= next_token(&input
, " \t");
942 if (strcmp(ptr
, "-p") != 0)
945 #ifdef HAVE_LINUXTHREADS
951 n
= snprintf((char *)isc_buffer_used(text
),
952 isc_buffer_availablelength(text
),
953 "pid: %ld", (long)pid
);
954 /* Only send a message if it is complete. */
955 if (n
< isc_buffer_availablelength(text
))
956 isc_buffer_add(text
, n
);