subr.c revision 223585 
1/*-
2 * Copyright (c) 2010 The FreeBSD Foundation
3 * Copyright (c) 2011 Pawel Jakub Dawidek <pawel@dawidek.net>
4 * All rights reserved.
5 *
6 * This software was developed by Pawel Jakub Dawidek under sponsorship from
7 * the FreeBSD Foundation.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 *    notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 *    notice, this list of conditions and the following disclaimer in the
16 *    documentation and/or other materials provided with the distribution.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 */
30
31#include <sys/cdefs.h>
32__FBSDID("$FreeBSD: head/sbin/hastd/subr.c 223585 2011-06-27 09:14:25Z pjd $");
33
34#ifdef HAVE_CAPSICUM
35#include <sys/capability.h>
36#endif
37#include <sys/param.h>
38#include <sys/disk.h>
39#include <sys/ioctl.h>
40#include <sys/jail.h>
41#include <sys/stat.h>
42
43#include <errno.h>
44#include <fcntl.h>
45#include <pwd.h>
46#include <stdarg.h>
47#include <stdbool.h>
48#include <stdio.h>
49#include <string.h>
50#include <unistd.h>
51
52#include <pjdlog.h>
53
54#include "hast.h"
55#include "subr.h"
56
57int
58vsnprlcat(char *str, size_t size, const char *fmt, va_list ap)
59{
60	size_t len;
61
62	len = strlen(str);
63	return (vsnprintf(str + len, size - len, fmt, ap));
64}
65
66int
67snprlcat(char *str, size_t size, const char *fmt, ...)
68{
69	va_list ap;
70	int result;
71
72	va_start(ap, fmt);
73	result = vsnprlcat(str, size, fmt, ap);
74	va_end(ap);
75	return (result);
76}
77
78int
79provinfo(struct hast_resource *res, bool dowrite)
80{
81	struct stat sb;
82
83	PJDLOG_ASSERT(res->hr_localpath != NULL &&
84	    res->hr_localpath[0] != '\0');
85
86	if (res->hr_localfd == -1) {
87		res->hr_localfd = open(res->hr_localpath,
88		    dowrite ? O_RDWR : O_RDONLY);
89		if (res->hr_localfd < 0) {
90			KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to open %s",
91			    res->hr_localpath));
92			return (-1);
93		}
94	}
95	if (fstat(res->hr_localfd, &sb) < 0) {
96		KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to stat %s",
97		    res->hr_localpath));
98		return (-1);
99	}
100	if (S_ISCHR(sb.st_mode)) {
101		/*
102		 * If this is character device, it is most likely GEOM provider.
103		 */
104		if (ioctl(res->hr_localfd, DIOCGMEDIASIZE,
105		    &res->hr_local_mediasize) < 0) {
106			KEEP_ERRNO(pjdlog_errno(LOG_ERR,
107			    "Unable obtain provider %s mediasize",
108			    res->hr_localpath));
109			return (-1);
110		}
111		if (ioctl(res->hr_localfd, DIOCGSECTORSIZE,
112		    &res->hr_local_sectorsize) < 0) {
113			KEEP_ERRNO(pjdlog_errno(LOG_ERR,
114			    "Unable obtain provider %s sectorsize",
115			    res->hr_localpath));
116			return (-1);
117		}
118	} else if (S_ISREG(sb.st_mode)) {
119		/*
120		 * We also support regular files for which we hardcode
121		 * sector size of 512 bytes.
122		 */
123		res->hr_local_mediasize = sb.st_size;
124		res->hr_local_sectorsize = 512;
125	} else {
126		/*
127		 * We support no other file types.
128		 */
129		pjdlog_error("%s is neither GEOM provider nor regular file.",
130		    res->hr_localpath);
131		errno = EFTYPE;
132		return (-1);
133	}
134	return (0);
135}
136
137const char *
138role2str(int role)
139{
140
141	switch (role) {
142	case HAST_ROLE_INIT:
143		return ("init");
144	case HAST_ROLE_PRIMARY:
145		return ("primary");
146	case HAST_ROLE_SECONDARY:
147		return ("secondary");
148	}
149	return ("unknown");
150}
151
152int
153drop_privs(struct hast_resource *res)
154{
155	char jailhost[sizeof(res->hr_name) * 2];
156	struct jail jailst;
157	struct passwd *pw;
158	uid_t ruid, euid, suid;
159	gid_t rgid, egid, sgid;
160	gid_t gidset[1];
161	bool capsicum, jailed;
162
163	/*
164	 * According to getpwnam(3) we have to clear errno before calling the
165	 * function to be able to distinguish between an error and missing
166	 * entry (with is not treated as error by getpwnam(3)).
167	 */
168	errno = 0;
169	pw = getpwnam(HAST_USER);
170	if (pw == NULL) {
171		if (errno != 0) {
172			KEEP_ERRNO(pjdlog_errno(LOG_ERR,
173			    "Unable to find info about '%s' user", HAST_USER));
174			return (-1);
175		} else {
176			pjdlog_error("'%s' user doesn't exist.", HAST_USER);
177			errno = ENOENT;
178			return (-1);
179		}
180	}
181
182	bzero(&jailst, sizeof(jailst));
183	jailst.version = JAIL_API_VERSION;
184	jailst.path = pw->pw_dir;
185	if (res == NULL) {
186		(void)snprintf(jailhost, sizeof(jailhost), "hastctl");
187	} else {
188		(void)snprintf(jailhost, sizeof(jailhost), "hastd: %s (%s)",
189		    res->hr_name, role2str(res->hr_role));
190	}
191	jailst.hostname = jailhost;
192	jailst.jailname = NULL;
193	jailst.ip4s = 0;
194	jailst.ip4 = NULL;
195	jailst.ip6s = 0;
196	jailst.ip6 = NULL;
197	if (jail(&jailst) >= 0) {
198		jailed = true;
199	} else {
200		jailed = false;
201		pjdlog_errno(LOG_WARNING,
202		    "Unable to jail to directory to %s", pw->pw_dir);
203		if (chroot(pw->pw_dir) == -1) {
204			KEEP_ERRNO(pjdlog_errno(LOG_ERR,
205			    "Unable to change root directory to %s",
206			    pw->pw_dir));
207			return (-1);
208		}
209	}
210	PJDLOG_VERIFY(chdir("/") == 0);
211	gidset[0] = pw->pw_gid;
212	if (setgroups(1, gidset) == -1) {
213		KEEP_ERRNO(pjdlog_errno(LOG_ERR,
214		    "Unable to set groups to gid %u",
215		    (unsigned int)pw->pw_gid));
216		return (-1);
217	}
218	if (setgid(pw->pw_gid) == -1) {
219		KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to set gid to %u",
220		    (unsigned int)pw->pw_gid));
221		return (-1);
222	}
223	if (setuid(pw->pw_uid) == -1) {
224		KEEP_ERRNO(pjdlog_errno(LOG_ERR, "Unable to set uid to %u",
225		    (unsigned int)pw->pw_uid));
226		return (-1);
227	}
228
229	/*
230	 * Until capsicum doesn't allow ioctl(2) we cannot use it to sandbox
231	 * primary and secondary worker processes, as primary uses GGATE
232	 * ioctls and secondary uses ioctls to handle BIO_DELETE and BIO_FLUSH.
233	 * For now capsicum is only used to sandbox hastctl.
234	 */
235#ifdef HAVE_CAPSICUM
236	if (res == NULL) {
237		capsicum = (cap_enter() == 0);
238		if (!capsicum) {
239			pjdlog_common(LOG_DEBUG, 1, errno,
240			    "Unable to sandbox using capsicum");
241		}
242	} else
243#endif
244		capsicum = false;
245
246	/*
247	 * Better be sure that everything succeeded.
248	 */
249	PJDLOG_VERIFY(getresuid(&ruid, &euid, &suid) == 0);
250	PJDLOG_VERIFY(ruid == pw->pw_uid);
251	PJDLOG_VERIFY(euid == pw->pw_uid);
252	PJDLOG_VERIFY(suid == pw->pw_uid);
253	PJDLOG_VERIFY(getresgid(&rgid, &egid, &sgid) == 0);
254	PJDLOG_VERIFY(rgid == pw->pw_gid);
255	PJDLOG_VERIFY(egid == pw->pw_gid);
256	PJDLOG_VERIFY(sgid == pw->pw_gid);
257	PJDLOG_VERIFY(getgroups(0, NULL) == 1);
258	PJDLOG_VERIFY(getgroups(1, gidset) == 1);
259	PJDLOG_VERIFY(gidset[0] == pw->pw_gid);
260
261	pjdlog_debug(1,
262	    "Privileges successfully dropped using %s%s+setgid+setuid.",
263	    capsicum ? "capsicum+" : "", jailed ? "jail" : "chroot");
264
265	return (0);
266}
267