2 * Copyright (C) 2004 Internet Systems Consortium, Inc. ("ISC")
3 * Copyright (C) 1999-2002 Internet Software Consortium.
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
9 * THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
10 * REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
11 * AND FITNESS. IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
12 * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
13 * LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
14 * OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
15 * PERFORMANCE OF THIS SOFTWARE.
18 /* $Id: os.c,v 1.46.2.9 2004/04/15 05:36:13 marka Exp $ */
23 #include <sys/types.h> /* dev_t FreeBSD 2.1 */
29 #include <grp.h> /* Required for initgroups() on IRIX. */
41 #include <isc/print.h>
42 #include <isc/result.h>
43 #include <isc/strerror.h>
44 #include <isc/string.h>
46 #include <named/main.h>
49 static char *pidfile = NULL;
50 static int devnullfd = -1;
53 * If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
55 #ifndef HAVE_LINUX_CAPABILITY_H
56 #undef HAVE_SYS_PRCTL_H
61 * (T) HAVE_LINUXTHREADS
62 * (C) HAVE_LINUX_CAPABILITY_H
63 * (P) HAVE_SYS_PRCTL_H
64 * The possible cases are:
65 * none: setuid() normally
67 * C: setuid() normally, drop caps (keep CAP_SETUID)
68 * T+C: no setuid(), drop caps (don't keep CAP_SETUID)
69 * T+C+P: setuid() early, drop caps (keep CAP_SETUID)
70 * C+P: setuid() normally, drop caps (keep CAP_SETUID)
75 * caps = BIND_SERVICE + CHROOT + SETGID
76 * if ((T && C && P) || !T)
81 * if (T && C && P && -u)
88 * if (C && (P || !-u))
93 * It will be nice when Linux threads work properly with setuid().
96 #ifdef HAVE_LINUXTHREADS
97 static pid_t mainpid = 0;
100 static struct passwd *runas_pw = NULL;
101 static isc_boolean_t done_setuid = ISC_FALSE;
103 #ifdef HAVE_LINUX_CAPABILITY_H
105 static isc_boolean_t non_root = ISC_FALSE;
106 static isc_boolean_t non_root_caps = ISC_FALSE;
109 * We define _LINUX_FS_H to prevent it from being included. We don't need
110 * anything from it, and the files it includes cause warnings with 2.2
111 * kernels, and compilation failures (due to conflicts between <linux/string.h>
112 * and <string.h>) on 2.3 kernels.
116 #include <sys/syscall.h> /* Required for syscall(). */
117 #include <linux/capability.h> /* Required for _LINUX_CAPABILITY_VERSION. */
119 #ifdef HAVE_SYS_PRCTL_H
120 #include <sys/prctl.h> /* Required for prctl(). */
123 * If the value of PR_SET_KEEPCAPS is not in <sys/prctl.h>, define it
124 * here. This allows setuid() to work on systems running a new enough
125 * kernel but with /usr/include/linux pointing to "standard" kernel
128 #ifndef PR_SET_KEEPCAPS
129 #define PR_SET_KEEPCAPS 8
132 #endif /* HAVE_SYS_PRCTL_H */
136 #include <asm/unistd.h> /* Slackware 4.0 needs this. */
138 #define SYS_capset __NR_capset
142 linux_setcaps(unsigned int caps) {
143 struct __user_cap_header_struct caphead;
144 struct __user_cap_data_struct cap;
145 char strbuf[ISC_STRERRORSIZE];
147 if ((getuid() != 0 && !non_root_caps) || non_root)
150 memset(&caphead, 0, sizeof caphead);
151 caphead.version = _LINUX_CAPABILITY_VERSION;
153 memset(&cap, 0, sizeof cap);
154 cap.effective = caps;
155 cap.permitted = caps;
156 cap.inheritable = caps;
157 if (syscall(SYS_capset, &caphead, &cap) < 0) {
158 isc__strerror(errno, strbuf, sizeof(strbuf));
159 ns_main_earlyfatal("capset failed: %s", strbuf);
164 linux_initialprivs(void) {
168 * We don't need most privileges, so we drop them right away.
169 * Later on linux_minprivs() will be called, which will drop our
170 * capabilities to the minimum needed to run the server.
176 * We need to be able to bind() to privileged ports, notably port 53!
178 caps |= (1 << CAP_NET_BIND_SERVICE);
181 * We need chroot() initially too.
183 caps |= (1 << CAP_SYS_CHROOT);
185 #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
187 * We can setuid() only if either the kernel supports keeping
188 * capabilities after setuid() (which we don't know until we've
189 * tried) or we're not using threads. If either of these is
190 * true, we want the setuid capability.
192 caps |= (1 << CAP_SETUID);
196 * Since we call initgroups, we need this.
198 caps |= (1 << CAP_SETGID);
201 * Without this, we run into problems reading a configuration file
202 * owned by a non-root user and non-world-readable on startup.
204 caps |= (1 << CAP_DAC_READ_SEARCH);
207 * XXX We might want to add CAP_SYS_RESOURCE, though it's not
208 * clear it would work right given the way linuxthreads work.
209 * XXXDCL But since we need to be able to set the maximum number
210 * of files, the stack size, data size, and core dump size to
211 * support named.conf options, this is now being added to test.
213 caps |= (1 << CAP_SYS_RESOURCE);
219 linux_minprivs(void) {
223 * Drop all privileges except the ability to bind() to privileged
226 * It's important that we drop CAP_SYS_CHROOT. If we didn't, it
227 * chroot() could be used to escape from the chrooted area.
231 caps |= (1 << CAP_NET_BIND_SERVICE);
234 * XXX We might want to add CAP_SYS_RESOURCE, though it's not
235 * clear it would work right given the way linuxthreads work.
236 * XXXDCL But since we need to be able to set the maximum number
237 * of files, the stack size, data size, and core dump size to
238 * support named.conf options, this is now being added to test.
240 caps |= (1 << CAP_SYS_RESOURCE);
245 #ifdef HAVE_SYS_PRCTL_H
247 linux_keepcaps(void) {
248 char strbuf[ISC_STRERRORSIZE];
250 * Ask the kernel to allow us to keep our capabilities after we
254 if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
255 if (errno != EINVAL) {
256 isc__strerror(errno, strbuf, sizeof(strbuf));
257 ns_main_earlyfatal("prctl() failed: %s", strbuf);
260 non_root_caps = ISC_TRUE;
267 #endif /* HAVE_LINUX_CAPABILITY_H */
271 setup_syslog(const char *progname) {
276 options |= LOG_NDELAY;
279 openlog(isc_file_basename(progname), options, LOG_DAEMON);
283 ns_os_init(const char *progname) {
284 setup_syslog(progname);
285 #ifdef HAVE_LINUX_CAPABILITY_H
286 linux_initialprivs();
288 #ifdef HAVE_LINUXTHREADS
292 signal(SIGXFSZ, SIG_IGN);
297 ns_os_daemonize(void) {
299 char strbuf[ISC_STRERRORSIZE];
303 isc__strerror(errno, strbuf, sizeof(strbuf));
304 ns_main_earlyfatal("fork(): %s", strbuf);
313 #ifdef HAVE_LINUXTHREADS
317 if (setsid() == -1) {
318 isc__strerror(errno, strbuf, sizeof(strbuf));
319 ns_main_earlyfatal("setsid(): %s", strbuf);
323 * Try to set stdin, stdout, and stderr to /dev/null, but press
324 * on even if it fails.
326 * XXXMLG The close() calls here are unneeded on all but NetBSD, but
327 * are harmless to include everywhere. dup2() is supposed to close
328 * the FD if it is in use, but unproven-pthreads-0.16 is broken
329 * and will end up closing the wrong FD. This will be fixed eventually,
330 * and these calls will be removed.
332 if (devnullfd != -1) {
333 if (devnullfd != STDIN_FILENO) {
334 (void)close(STDIN_FILENO);
335 (void)dup2(devnullfd, STDIN_FILENO);
337 if (devnullfd != STDOUT_FILENO) {
338 (void)close(STDOUT_FILENO);
339 (void)dup2(devnullfd, STDOUT_FILENO);
341 if (devnullfd != STDERR_FILENO) {
342 (void)close(STDERR_FILENO);
343 (void)dup2(devnullfd, STDERR_FILENO);
349 ns_os_opendevnull(void) {
350 devnullfd = open("/dev/null", O_RDWR, 0);
354 ns_os_closedevnull(void) {
355 if (devnullfd != STDIN_FILENO &&
356 devnullfd != STDOUT_FILENO &&
357 devnullfd != STDERR_FILENO) {
364 all_digits(const char *s) {
368 if (!isdigit((*s)&0xff))
376 ns_os_chroot(const char *root) {
377 char strbuf[ISC_STRERRORSIZE];
379 if (chroot(root) < 0) {
380 isc__strerror(errno, strbuf, sizeof(strbuf));
381 ns_main_earlyfatal("chroot(): %s", strbuf);
383 if (chdir("/") < 0) {
384 isc__strerror(errno, strbuf, sizeof(strbuf));
385 ns_main_earlyfatal("chdir(/): %s", strbuf);
391 ns_os_inituserinfo(const char *username) {
392 char strbuf[ISC_STRERRORSIZE];
393 if (username == NULL)
396 if (all_digits(username))
397 runas_pw = getpwuid((uid_t)atoi(username));
399 runas_pw = getpwnam(username);
402 if (runas_pw == NULL)
403 ns_main_earlyfatal("user '%s' unknown", username);
406 if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0) {
407 isc__strerror(errno, strbuf, sizeof(strbuf));
408 ns_main_earlyfatal("initgroups(): %s", strbuf);
415 ns_os_changeuser(void) {
416 char strbuf[ISC_STRERRORSIZE];
417 if (runas_pw == NULL || done_setuid)
420 done_setuid = ISC_TRUE;
422 #ifdef HAVE_LINUXTHREADS
423 #ifdef HAVE_LINUX_CAPABILITY_H
427 "-u not supported on Linux kernels older than "
428 "2.3.99-pre3 or 2.2.18 when using threads");
431 if (setgid(runas_pw->pw_gid) < 0) {
432 isc__strerror(errno, strbuf, sizeof(strbuf));
433 ns_main_earlyfatal("setgid(): %s", strbuf);
436 if (setuid(runas_pw->pw_uid) < 0) {
437 isc__strerror(errno, strbuf, sizeof(strbuf));
438 ns_main_earlyfatal("setuid(): %s", strbuf);
441 #if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
447 ns_os_minprivs(void) {
448 #ifdef HAVE_SYS_PRCTL_H
452 #ifdef HAVE_LINUXTHREADS
453 ns_os_changeuser(); /* Call setuid() before threads are started */
456 #if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
462 safe_open(const char *filename, isc_boolean_t append) {
466 if (stat(filename, &sb) == -1) {
469 } else if ((sb.st_mode & S_IFREG) == 0) {
475 fd = open(filename, O_WRONLY|O_CREAT|O_APPEND,
476 S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
478 (void)unlink(filename);
479 fd = open(filename, O_WRONLY|O_CREAT|O_EXCL,
480 S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
486 cleanup_pidfile(void) {
487 if (pidfile != NULL) {
488 (void)unlink(pidfile);
495 ns_os_writepidfile(const char *filename, isc_boolean_t first_time) {
500 char strbuf[ISC_STRERRORSIZE];
501 void (*report)(const char *, ...);
504 * The caller must ensure any required synchronization.
507 report = first_time ? ns_main_earlyfatal : ns_main_earlywarning;
511 len = strlen(filename);
512 pidfile = malloc(len + 1);
513 if (pidfile == NULL) {
514 isc__strerror(errno, strbuf, sizeof(strbuf));
515 (*report)("couldn't malloc '%s': %s", filename, strbuf);
519 strcpy(pidfile, filename);
521 fd = safe_open(filename, ISC_FALSE);
523 isc__strerror(errno, strbuf, sizeof(strbuf));
524 (*report)("couldn't open pid file '%s': %s", filename, strbuf);
529 lockfile = fdopen(fd, "w");
530 if (lockfile == NULL) {
531 isc__strerror(errno, strbuf, sizeof(strbuf));
532 (*report)("could not fdopen() pid file '%s': %s",
538 #ifdef HAVE_LINUXTHREADS
543 if (fprintf(lockfile, "%ld\n", (long)pid) < 0) {
544 (*report)("fprintf() to pid file '%s' failed", filename);
545 (void)fclose(lockfile);
549 if (fflush(lockfile) == EOF) {
550 (*report)("fflush() to pid file '%s' failed", filename);
551 (void)fclose(lockfile);
555 (void)fclose(lockfile);
559 ns_os_shutdown(void) {