source: trunk/src/sh_unix.c@ 462

Last change on this file since 462 was 462, checked in by katerina, 10 years ago

Fix for ticket #362 (Buffer for getgrnam_r too small).
File size: 131.8 KB
RevLine 
[1]1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#include "config_xor.h"
21
22
23#include <stdio.h>
24#include <stdlib.h>
25#include <string.h>
26#include <ctype.h>
[98]27#ifdef HAVE_LINUX_FS_H
28#include <linux/fs.h>
29#endif
[1]30
31#ifdef HAVE_MEMORY_H
32#include <memory.h>
33#endif
34
35#ifdef HAVE_UNISTD_H
36#include <errno.h>
37#include <signal.h>
38#include <pwd.h>
39#include <grp.h>
40#include <sys/types.h>
41#include <sys/stat.h>
42#include <sys/resource.h>
43#include <fcntl.h>
44#include <unistd.h>
[169]45/* need to undef these, since the #define's may be picked up from
46 * linux/wait.h, and will clash with a typedef in sys/wait.h
47 */
48#undef P_ALL
49#undef P_PID
50#undef P_PGID
[1]51#include <sys/wait.h>
52
53/*********************
54#ifdef HAVE_SYS_VFS_H
55#include <sys/vfs.h>
56#endif
57**********************/
58#endif
59
60#if TIME_WITH_SYS_TIME
61#include <sys/time.h>
62#include <time.h>
63#else
64#if HAVE_SYS_TIME_H
65#include <sys/time.h>
66#else
67#include <time.h>
68#endif
69#endif
70
71#ifdef HAVE_SYS_SELECT_H
72#include <sys/select.h>
73#endif
74
75#ifndef FD_SET
76#define NFDBITS 32
77#define FD_SET(n, p) ((p)->fds_bits[(n)/NFDBITS] |= (1 << ((n) % NFDBITS)))
78#define FD_CLR(n, p) ((p)->fds_bits[(n)/NFDBITS] &= ~(1 << ((n) % NFDBITS)))
79#define FD_ISSET(n, p) ((p)->fds_bits[(n)/NFDBITS] & (1 << ((n) % NFDBITS)))
80#endif /* !FD_SET */
81#ifndef FD_SETSIZE
82#define FD_SETSIZE 32
83#endif
84#ifndef FD_ZERO
85#define FD_ZERO(p) memset((char *)(p), '\0', sizeof(*(p)))
86#endif
87
88
89#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
90#include <sys/mman.h>
91#endif
92
93#include "samhain.h"
94#include "sh_error.h"
95#include "sh_unix.h"
96#include "sh_utils.h"
97#include "sh_mem.h"
98#include "sh_hash.h"
99#include "sh_tools.h"
[310]100#include "sh_restrict.h"
[295]101#include "sh_ipvx.h"
[1]102#include "sh_tiger.h"
103#include "sh_prelink.h"
[137]104#include "sh_pthread.h"
[1]105
106/* moved here from far below
107 */
108#include <netdb.h>
109
110#define SH_NEED_PWD_GRP
111#define SH_NEED_GETHOSTBYXXX
112#include "sh_static.h"
113
114#ifndef HAVE_LSTAT
115#define lstat stat
116#endif
117
118#if defined(S_IFLNK) && !defined(S_ISLNK)
119#define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
120#else
121#if !defined(S_ISLNK)
122#define S_ISLNK(mode) (0)
123#endif
124#endif
125
126#if defined(S_IFSOCK) && !defined(S_ISSOCK)
127#define S_ISSOCK(mode) (((mode) & S_IFMT) == S_IFSOCK)
128#else
129#if !defined(S_ISSOCK)
130#define S_ISSOCK(mode) (0)
131#endif
132#endif
133
[40]134#if defined(S_IFDOOR) && !defined(S_ISDOOR)
135#define S_ISDOOR(mode) (((mode) & S_IFMT) == S_IFDOOR)
136#else
137#if !defined(S_ISDOOR)
138#define S_ISDOOR(mode) (0)
139#endif
140#endif
141
142#if defined(S_IFPORT) && !defined(S_ISPORT)
143#define S_ISPORT(mode) (((mode) & S_IFMT) == S_IFPORT)
144#else
145#if !defined(S_ISPORT)
146#define S_ISPORT(mode) (0)
147#endif
148#endif
149
[105]150#define SH_KEY_NULL _("000000000000000000000000000000000000000000000000")
[40]151
[1]152#undef FIL__
153#define FIL__ _("sh_unix.c")
154
155unsigned long mask_PRELINK = MASK_PRELINK_;
156unsigned long mask_USER0 = MASK_USER_;
157unsigned long mask_USER1 = MASK_USER_;
[27]158unsigned long mask_USER2 = MASK_USER_;
159unsigned long mask_USER3 = MASK_USER_;
160unsigned long mask_USER4 = MASK_USER_;
[1]161unsigned long mask_ALLIGNORE = MASK_ALLIGNORE_;
162unsigned long mask_ATTRIBUTES = MASK_ATTRIBUTES_;
163unsigned long mask_LOGFILES = MASK_LOGFILES_;
164unsigned long mask_LOGGROW = MASK_LOGGROW_;
165unsigned long mask_READONLY = MASK_READONLY_;
166unsigned long mask_NOIGNORE = MASK_NOIGNORE_;
167
168
169extern char **environ;
170
171int sh_unix_maskreset()
172{
173 mask_PRELINK = MASK_PRELINK_;
174 mask_USER0 = MASK_USER_;
175 mask_USER1 = MASK_USER_;
[27]176 mask_USER2 = MASK_USER_;
177 mask_USER3 = MASK_USER_;
178 mask_USER4 = MASK_USER_;
[1]179 mask_ALLIGNORE = MASK_ALLIGNORE_;
180 mask_ATTRIBUTES = MASK_ATTRIBUTES_;
181 mask_LOGFILES = MASK_LOGFILES_;
182 mask_LOGGROW = MASK_LOGGROW_;
183 mask_READONLY = MASK_READONLY_;
184 mask_NOIGNORE = MASK_NOIGNORE_;
185 return 0;
186}
187
188
189#ifdef SYS_SIGLIST_DECLARED
190/* extern const char * const sys_siglist[]; */
191#else
192char * sh_unix_siglist (int signum)
193{
194 switch (signum)
195 {
196#ifdef SIGHUP
197 case SIGHUP:
198 return _("Hangup");
199#endif
200#ifdef SIGINT
201 case SIGINT:
202 return _("Interrupt");
203#endif
204#ifdef SIGQUIT
205 case SIGQUIT:
206 return _("Quit");
207#endif
208#ifdef SIGILL
209 case SIGILL:
210 return _("Illegal instruction");
211#endif
212#ifdef SIGTRAP
213 case SIGTRAP:
214 return _("Trace/breakpoint trap");
215#endif
216#ifdef SIGABRT
217 case SIGABRT:
218 return _("IOT trap/Abort");
219#endif
220#ifdef SIGBUS
221 case SIGBUS:
222 return _("Bus error");
223#endif
224#ifdef SIGFPE
225 case SIGFPE:
226 return _("Floating point exception");
227#endif
228#ifdef SIGUSR1
229 case SIGUSR1:
230 return _("User defined signal 1");
231#endif
232#ifdef SIGSEGV
233 case SIGSEGV:
234 return _("Segmentation fault");
235#endif
236#ifdef SIGUSR2
237 case SIGUSR2:
238 return _("User defined signal 2");
239#endif
240#ifdef SIGPIPE
241 case SIGPIPE:
242 return _("Broken pipe");
243#endif
244#ifdef SIGALRM
245 case SIGALRM:
246 return _("Alarm clock");
247#endif
248#ifdef SIGTERM
249 case SIGTERM:
250 return _("Terminated");
251#endif
252#ifdef SIGSTKFLT
253 case SIGSTKFLT:
254 return _("Stack fault");
255#endif
256#ifdef SIGCHLD
257 case SIGCHLD:
258 return _("Child exited");
259#endif
260#ifdef SIGCONT
261 case SIGCONT:
262 return _("Continued");
263#endif
264#ifdef SIGSTOP
265 case SIGSTOP:
266 return _("Stopped");
267#endif
268#ifdef SIGTSTP
269 case SIGTSTP:
270 return _("Stop typed at tty");
271#endif
272#ifdef SIGTTIN
273 case SIGTTIN:
274 return _("Stopped (tty input)");
275#endif
276#ifdef SIGTTOU
277 case SIGTTOU:
278 return _("Stopped (tty output)");
279#endif
280#ifdef SIGURG
281 case SIGURG:
282 return _("Urgent condition");
283#endif
284#ifdef SIGXCPU
285 case SIGXCPU:
286 return _("CPU time limit exceeded");
287#endif
288#ifdef SIGXFSZ
289 case SIGXFSZ:
290 return _("File size limit exceeded");
291#endif
292#ifdef SIGVTALRM
293 case SIGVTALRM:
294 return _("Virtual time alarm");
295#endif
296#ifdef SIGPROF
297 case SIGPROF:
298 return _("Profile signal");
299#endif
300#ifdef SIGWINCH
301 case SIGWINCH:
302 return _("Window size changed");
303#endif
304#ifdef SIGIO
305 case SIGIO:
306 return _("Possible I/O");
307#endif
308#ifdef SIGPWR
309 case SIGPWR:
310 return _("Power failure");
311#endif
312#ifdef SIGUNUSED
313 case SIGUNUSED:
314 return _("Unused signal");
315#endif
316 }
317 return _("Unknown");
318}
319#endif
320
321
322/* Log from within a signal handler without using any
323 * functions that are not async signal safe.
324 *
325 * This is the safe_itoa helper function.
326 */
327char * safe_itoa(int i, char * str, int size)
328{
329 unsigned int u;
330 int iisneg = 0;
331 char *p = &str[size-1];
332
333 *p = '\0';
334 if (i < 0) {
335 iisneg = 1;
336 u = ((unsigned int)(-(1+i))) + 1;
337 } else {
338 u = i;
339 }
340 do {
341 --p;
342 *p = '0' + (u % 10);
343 u /= 10;
[22]344 } while (u && (p != str));
345 if ((iisneg == 1) && (p != str)) {
[1]346 --p;
347 *p = '-';
348 }
349 return p;
350}
351
352/* Log from within a signal handler without using any
353 * functions that are not async signal safe.
354 *
355 * This is the safe_logger function.
356 * Arguments: signal (signal number), method (0=logger, 1=stderr), thepid (pid)
357 */
358extern int OnlyStderr;
359
[170]360int safe_logger (int thesignal, int method, char * details)
[1]361{
[34]362 unsigned int i = 0;
[1]363 int status = -1;
364 struct stat buf;
365 pid_t newpid;
366 char str[128];
367 char * p;
[22]368
[1]369 char l0[64], l1[64], l2[64], l3[64];
370 char a0[32], a1[32], a2[32];
371 char e0[128];
372 char msg[128];
[22]373
[1]374 char * locations[] = { NULL, NULL, NULL, NULL, NULL };
375 char * envp[] = { NULL, NULL };
376 char * argp[] = { NULL, NULL, NULL, NULL, NULL };
[22]377
378 pid_t thepid = getpid();
379
[1]380 if ((sh.flag.isdaemon == S_FALSE) || (OnlyStderr == S_TRUE))
381 method = 1;
[22]382
[1]383 /* seems that solaris cc needs this way of initializing ...
384 */
385 locations[0] = l0;
386 locations[1] = l1;
387 locations[2] = l2;
388 locations[3] = l3;
[22]389
[1]390 envp[0] = e0;
[22]391
[1]392 argp[0] = a0;
393 argp[1] = a1;
394 argp[2] = a2;
[22]395
[1]396 sl_strlcpy(msg, _("samhain["), 128);
397 p = safe_itoa((int) thepid, str, 128);
398 if (p && *p)
399 sl_strlcat(msg, p, 128);
[170]400 if (thesignal == 0)
[1]401 {
[22]402 if (details == NULL) {
403 sl_strlcat(msg, _("]: out of memory"), 128);
404 } else {
405 sl_strlcat(msg, _("]: "), 128);
406 sl_strlcat(msg, details, 128);
407 }
[1]408 }
409 else
410 {
411 sl_strlcat(msg, _("]: exit on signal "), 128);
[170]412 p = safe_itoa(thesignal, str, 128);
[1]413 if (p && *p)
414 sl_strlcat(msg, p, 128);
415 }
416
417 if (method == 1) {
418#ifndef STDERR_FILENO
419#define STDERR_FILENO 2
420#endif
[153]421 int retval = 0;
422 do {
423 retval = write(STDERR_FILENO, msg, strlen(msg));
424 } while (retval < 0 && errno == EINTR);
425 do {
426 retval = write(STDERR_FILENO, "\n", 1);
427 } while (retval < 0 && errno == EINTR);
[1]428 return 0;
429 }
[22]430
431 sl_strlcpy (l0, _("/usr/bin/logger"), 64);
432 sl_strlcpy (l1, _("/usr/sbin/logger"), 64);
433 sl_strlcpy (l2, _("/usr/ucb/logger"), 64);
434 sl_strlcpy (l3, _("/bin/logger"), 64);
435
436 sl_strlcpy (a0, _("logger"), 32);
437 sl_strlcpy (a1, _("-p"), 32);
438 sl_strlcpy (a2, _("daemon.alert"), 32);
439
440 sl_strlcpy (e0,
441 _("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/ucb:/usr/local/bin"),
442 128);
443
[1]444 while (locations[i] != NULL) {
445 status = stat(locations[i], &buf);
446 if (status == 0)
447 break;
448 ++i;
449 }
450
451 if (locations[i] != NULL) {
452 argp[3] = msg;
453 newpid = fork();
454 if (newpid == 0) {
455 execve(locations[i], argp, envp);
456 _exit(1);
457 }
458 else if (newpid > 0) {
459 waitpid(newpid, &status, WUNTRACED);
460 }
461 }
462 return 0;
463}
464
[170]465void safe_fatal (const char * details,
466 const char * file, int line)
[22]467{
468 char msg[128];
469 char str[128];
470 char * p;
[170]471 int thesignal = 0;
[34]472 int method = 0;
473
[22]474 p = safe_itoa((int) line, str, 128);
475 sl_strlcpy(msg, _("FATAL: "), 128);
476 sl_strlcat(msg, file, 128);
477 sl_strlcat(msg, ": ", 128);
478 if (p && (*p)) {
479 sl_strlcat(msg, p , 128);
480 sl_strlcat(msg, ": ", 128);
481 }
482 sl_strlcat(msg, details, 128);
[170]483 (void) safe_logger (thesignal, method, msg);
[205]484 raise(SIGKILL);
[22]485}
[1]486
487extern char sh_sig_msg[64];
488
489volatile int immediate_exit_normal = 0;
490
491#if defined(SA_SIGACTION_WORKS)
492static
493void sh_unix_sigexit (int mysignal, siginfo_t * signal_info, void * signal_add)
494#else
495static
496void sh_unix_sigexit (int mysignal)
497#endif
498{
499
500#if defined(SA_SIGACTION_WORKS)
501 if (signal_info != NULL && signal_info->si_code == SI_USER &&
502 mysignal != SIGTERM && mysignal != SIGINT)
503 {
504 return;
505 }
506
507 /* avoid compiler warning (unused var)
508 */
509 (void) signal_add;
510#endif
511
512 /*
513 * Block re-entry
514 */
515 if (immediate_exit_normal > 0)
516 {
517 ++immediate_exit_normal;
518 if ((skey != NULL) && (immediate_exit_normal == 2))
519 memset (skey, '\0', sizeof(sh_key_t));
520 if (immediate_exit_normal == 2)
521 {
[153]522 int val_return;
523
524 do {
525 val_return = chdir ("/");
526 } while (val_return < 0 && errno == EINTR);
527
[22]528 safe_logger (mysignal, 0, NULL);
[1]529 }
[205]530 raise(SIGKILL);
[1]531 }
532 else
533 {
534 immediate_exit_normal = 1;
535 }
536
537#ifdef SYS_SIGLIST_DECLARED
538 strncpy (sh_sig_msg, sys_siglist[mysignal], 40);
539#else
540 strncpy (sh_sig_msg, sh_unix_siglist(mysignal), 40);
541#endif
542 sh_sig_msg[63] = '\0';
543
544 ++sig_raised;
545 ++sig_urgent;
546 sig_termfast = 1;
547 return;
548}
549
550volatile int immediate_exit_fast = 0;
551
552#if defined(SA_SIGACTION_WORKS)
553static
554void sh_unix_sigexit_fast (int mysignal, siginfo_t * signal_info,
555 void * signal_add)
556#else
557static
558void sh_unix_sigexit_fast (int mysignal)
559#endif
560{
[172]561#if defined(SL_DEBUG) && (defined(USE_SYSTEM_MALLOC) || !defined(USE_MALLOC_LOCK))
[154]562 int retval;
563#endif
564
[1]565#if defined(SA_SIGACTION_WORKS)
566 if (signal_info != NULL && signal_info->si_code == SI_USER)
567 {
568 return;
569 }
570#endif
571
572 /* avoid compiler warning (unused var)
573 */
574#if defined(SA_SIGACTION_WORKS)
575 (void) signal_add;
576#endif
577
578 /* Check whether the heap is ok; otherwise _exit
579 */
[172]580#if !defined(SL_DEBUG) || (!defined(USE_SYSTEM_MALLOC) && defined(USE_MALLOC_LOCK))
[1]581 ++immediate_exit_fast;
582 if (skey != NULL && immediate_exit_fast < 2)
583 memset (skey, '\0', sizeof(sh_key_t));
584 if (immediate_exit_fast < 2)
[22]585 safe_logger (mysignal, 0, NULL);
[205]586 raise(SIGKILL);
[1]587#else
588
589 /* debug code
590 */
591 if (immediate_exit_fast == 1)
592 {
593 ++immediate_exit_fast;
594 if (skey != NULL)
595 memset (skey, '\0', sizeof(sh_key_t));
596#ifdef WITH_MESSAGE_QUEUE
597 close_ipc ();
598#endif
[22]599 safe_logger (mysignal, 0, NULL);
[154]600 do {
601 retval = chdir ("/");
602 } while (retval < 0 && errno == EINTR);
[1]603 raise(SIGFPE);
604 }
605 else if (immediate_exit_fast == 2)
606 {
[154]607 do {
608 retval = chdir ("/");
609 } while (retval < 0 && errno == EINTR);
[1]610 raise(SIGFPE);
611 }
612 else if (immediate_exit_fast != 0)
613 {
[205]614 raise(SIGKILL);
[1]615 }
616
617 ++immediate_exit_fast;
618
619 /* The FPE|BUS|SEGV|ILL signals leave the system in an undefined
620 * state, thus it is best to exit immediately.
621 */
622#ifdef SYS_SIGLIST_DECLARED
623 strncpy (sh_sig_msg, sys_siglist[mysignal], 40);
624#else
625 strncpy (sh_sig_msg, sh_unix_siglist(mysignal), 40);
626#endif
[131]627 sh_sig_msg[63] = '\0';
[1]628
629 sl_stack_print();
630
631 /* Try to push out an error message.
632 */
633 sh_error_handle ((-1), FIL__, __LINE__, mysignal, MSG_EXIT_NORMAL,
634 sh.prg_name, sh_sig_msg);
635
636 if (skey != NULL)
637 memset (skey, '\0', sizeof(sh_key_t));
638#ifdef WITH_MESSAGE_QUEUE
639 close_ipc ();
640#endif
641
[154]642 do {
643 retval = chdir ("/");
644 } while (retval < 0 && errno == EINTR);
645
[1]646 raise(SIGFPE);
647#endif
648}
649
650
651static
652void sh_unix_sigaction (int mysignal)
653{
654 ++sig_raised;
655#ifdef SIGUSR1
656 if (mysignal == SIGUSR1)
657 sig_debug_switch = 1;
658#endif
659#ifdef SIGUSR2
660 if (mysignal == SIGUSR2)
661 {
[19]662 ++sig_suspend_switch;
[1]663 ++sig_urgent;
664 }
665#endif
666#ifdef SIGHUP
667 if (mysignal == SIGHUP)
668 sig_config_read_again = 1;
669#endif
670#ifdef SIGTTOU
671 if (mysignal == SIGTTOU)
672 sig_force_check = 1;
673#endif
[279]674#ifdef SIGTTIN
675 if (mysignal == SIGTTIN)
676 sig_fresh_trail = 1;
677#endif
[1]678#ifdef SIGABRT
679 if (mysignal == SIGABRT)
680 sig_fresh_trail = 1;
681#endif
682#ifdef SIGQUIT
683 if (mysignal == SIGQUIT)
684 {
[131]685 sig_terminate = 1;
[1]686 ++sig_urgent;
687 }
688#endif
689#ifdef SIGTERM
690 if (mysignal == SIGTERM)
691 {
692 strncpy (sh_sig_msg, _("Terminated"), 40);
693 sig_termfast = 1;
694 ++sig_urgent;
695 }
696#endif
697
698 return;
699}
700
[379]701void sh_unix_ign_sigpipe()
702{
703 struct sigaction ignact;
704
705 ignact.sa_handler = SIG_IGN; /* signal action */
706 sigemptyset( &ignact.sa_mask ); /* set an empty mask */
707 ignact.sa_flags = 0; /* init sa_flags */
708
709#ifdef SIGPIPE
710 retry_sigaction(FIL__, __LINE__, SIGPIPE, &ignact, NULL);
711#endif
712
713 return;
714}
[1]715static
716void sh_unix_siginstall (int goDaemon)
717{
718 struct sigaction act, act_fast, act2, oldact, ignact;
719#if defined (SH_WITH_SERVER)
720 (void) goDaemon;
721#endif
722
723 SL_ENTER(_("sh_unix_siginstall"));
724
725 ignact.sa_handler = SIG_IGN; /* signal action */
726 sigemptyset( &ignact.sa_mask ); /* set an empty mask */
727 ignact.sa_flags = 0; /* init sa_flags */
728
729#if defined(SA_SIGACTION_WORKS)
730 act.sa_sigaction = &sh_unix_sigexit; /* signal action */
731#else
732 act.sa_handler = &sh_unix_sigexit; /* signal action */
733#endif
734
735 sigfillset ( &act.sa_mask ); /* set a full mask */
736
737
738 /* Block all but deadly signals.
739 */
740#ifdef SIGILL
741 sigdelset ( &act.sa_mask, SIGILL );
742#endif
743#ifndef SL_DEBUG
744#ifdef SIGFPE
745 sigdelset ( &act.sa_mask, SIGFPE );
746#endif
747#endif
748#ifdef SIGSEGV
749 sigdelset ( &act.sa_mask, SIGSEGV );
750#endif
751#ifdef SIGBUS
752 sigdelset ( &act.sa_mask, SIGBUS );
753#endif
754
755#if defined(SA_SIGACTION_WORKS)
756 act_fast.sa_sigaction = &sh_unix_sigexit_fast; /* signal action */
757#else
758 act_fast.sa_handler = &sh_unix_sigexit_fast; /* signal action */
759#endif
760
761 sigfillset ( &act_fast.sa_mask ); /* set a full mask */
762
763#ifdef SIGILL
764 sigdelset ( &act_fast.sa_mask, SIGILL );
765#endif
766#ifndef SL_DEBUG
767#ifdef SIGFPE
768 sigdelset ( &act_fast.sa_mask, SIGFPE );
769#endif
770#endif
771#ifdef SIGSEGV
772 sigdelset ( &act_fast.sa_mask, SIGSEGV );
773#endif
774#ifdef SIGBUS
775 sigdelset ( &act_fast.sa_mask, SIGBUS );
776#endif
777
778
779 /* Use siginfo to verify origin of signal, if possible.
780 */
781#if defined(SA_SIGACTION_WORKS)
782 act.sa_flags = SA_SIGINFO;
783 act_fast.sa_flags = SA_SIGINFO;
784#else
785 act.sa_flags = 0;
786 act_fast.sa_flags = 0;
787#endif
788
789 /* Do not block the signal from being received in its handler ...
790 * (is this a good or a bad idea ??).
791 */
792#if defined(SA_NOMASK)
793 act_fast.sa_flags |= SA_NOMASK;
794#elif defined(SA_NODEFER)
795 act_fast.sa_flags |= SA_NODEFER;
796#endif
797
798
799 act2.sa_handler = &sh_unix_sigaction; /* signal action */
800 sigemptyset( &act2.sa_mask ); /* set an empty mask */
801 act2.sa_flags = 0; /* init sa_flags */
802
803 /* signals to control the daemon */
804
805#ifdef SIGHUP
806 retry_sigaction(FIL__, __LINE__, SIGHUP, &act2, &oldact);
807#endif
808#ifdef SIGABRT
809 retry_sigaction(FIL__, __LINE__, SIGABRT, &act2, &oldact);
810#endif
811#ifdef SIGUSR1
812 retry_sigaction(FIL__, __LINE__, SIGUSR1, &act2, &oldact);
813#endif
814#ifdef SIGUSR2
815 retry_sigaction(FIL__, __LINE__, SIGUSR2, &act2, &oldact);
816#endif
817#ifdef SIGQUIT
818 retry_sigaction(FIL__, __LINE__, SIGQUIT, &act2, &oldact);
819#endif
820#ifdef SIGTERM
[131]821 retry_sigaction(FIL__, __LINE__, SIGTERM, &act, &oldact);
[1]822#endif
823
824 /* fatal signals that may cause termination */
825
826#ifdef SIGILL
827 retry_sigaction(FIL__, __LINE__, SIGILL, &act_fast, &oldact);
828#endif
829#ifndef SL_DEBUG
830#ifdef SIGFPE
831 retry_sigaction(FIL__, __LINE__, SIGFPE, &act_fast, &oldact);
832#endif
833#endif
834#ifdef SIGSEGV
835 retry_sigaction(FIL__, __LINE__, SIGSEGV, &act_fast, &oldact);
836#endif
837#ifdef SIGBUS
838 retry_sigaction(FIL__, __LINE__, SIGBUS, &act_fast, &oldact);
839#endif
840
841 /* other signals */
842
843#ifdef SIGINT
844 retry_sigaction(FIL__, __LINE__, SIGINT, &act, &oldact);
845#endif
846#ifdef SIGPIPE
[132]847 retry_sigaction(FIL__, __LINE__, SIGPIPE, &ignact, &oldact);
[1]848#endif
849#ifdef SIGALRM
850 retry_sigaction(FIL__, __LINE__, SIGALRM, &ignact, &oldact);
851#endif
852#ifdef SIGTSTP
853 retry_sigaction(FIL__, __LINE__, SIGTSTP, &ignact, &oldact);
854#endif
[279]855
[1]856#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
857#ifdef SIGTTOU
858 if (goDaemon == 1)
859 retry_sigaction(FIL__, __LINE__, SIGTTOU, &act2, &oldact);
860 else
861 retry_sigaction(FIL__, __LINE__, SIGTTOU, &ignact, &oldact);
862#endif
[279]863#ifdef SIGTTIN
864 if (goDaemon == 1)
865 retry_sigaction(FIL__, __LINE__, SIGTTIN, &act2, &oldact);
866 else
867 retry_sigaction(FIL__, __LINE__, SIGTTIN, &ignact, &oldact);
868#endif
[1]869#else
870#ifdef SIGTTOU
871 retry_sigaction(FIL__, __LINE__, SIGTTOU, &ignact, &oldact);
872#endif
[279]873#ifdef SIGTTIN
874 retry_sigaction(FIL__, __LINE__, SIGTTIN, &ignact, &oldact);
[1]875#endif
[279]876#endif
[1]877
878#ifdef SIGTRAP
879#if !defined(SCREW_IT_UP)
880 retry_sigaction(FIL__, __LINE__, SIGTRAP, &act, &oldact);
881#endif
882#endif
883
884#ifdef SIGPOLL
885 retry_sigaction(FIL__, __LINE__, SIGPOLL, &ignact, &oldact);
886#endif
887#if defined(SIGPROF) && !defined(SH_PROFILE)
888 retry_sigaction(FIL__, __LINE__, SIGPROF, &ignact, &oldact);
889#endif
890#ifdef SIGSYS
891 retry_sigaction(FIL__, __LINE__, SIGSYS, &act, &oldact);
892#endif
893#ifdef SIGURG
894 retry_sigaction(FIL__, __LINE__, SIGURG, &ignact, &oldact);
895#endif
896#if defined(SIGVTALRM) && !defined(SH_PROFILE)
897 retry_sigaction(FIL__, __LINE__, SIGVTALRM, &ignact, &oldact);
898#endif
899#ifdef SIGXCPU
900 retry_sigaction(FIL__, __LINE__, SIGXCPU, &act, &oldact);
901#endif
902#ifdef SIGXFSZ
903 retry_sigaction(FIL__, __LINE__, SIGXFSZ, &act, &oldact);
904#endif
905
906#ifdef SIGEMT
907 retry_sigaction(FIL__, __LINE__, SIGEMT, &ignact, &oldact);
908#endif
909#ifdef SIGSTKFLT
910 retry_sigaction(FIL__, __LINE__, SIGSTKFLT, &act, &oldact);
911#endif
912#ifdef SIGIO
913 retry_sigaction(FIL__, __LINE__, SIGIO, &ignact, &oldact);
914#endif
915#ifdef SIGPWR
916 retry_sigaction(FIL__, __LINE__, SIGPWR, &act, &oldact);
917#endif
918
919#ifdef SIGLOST
920 retry_sigaction(FIL__, __LINE__, SIGLOST, &ignact, &oldact);
921#endif
922#ifdef SIGUNUSED
923 retry_sigaction(FIL__, __LINE__, SIGUNUSED, &ignact, &oldact);
924#endif
925
926 SL_RET0(_("sh_unix_siginstall"));
927}
928
929/* ---------------------------------------------------------------- */
930
931/* checksum the own binary
932 */
[22]933int sh_unix_self_hash (const char * c)
[1]934{
935 char message[512];
[133]936 char hashbuf[KEYBUF_SIZE];
[1]937
938 SL_ENTER(_("sh_unix_self_hash"));
939
940 if (c == NULL)
941 {
942 sh.exec.path[0] = '\0';
943 SL_RETURN((0), _("sh_unix_self_hash"));
944 }
945 sl_strlcpy(sh.exec.path, c, SH_PATHBUF);
946
947 sl_strlcpy(sh.exec.hash,
[160]948 sh_tiger_hash (c, TIGER_FILE, TIGER_NOLIM, hashbuf, sizeof(hashbuf)),
[1]949 KEY_LEN+1);
950 sl_snprintf(message, 512, _("%s has checksum: %s"),
951 sh.exec.path, sh.exec.hash);
952 message[511] = '\0';
953 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
954 message, _("sh_unix_self_hash"));
[93]955 if (0 == sl_strcmp(sh.exec.hash, SH_KEY_NULL ))
[1]956 {
957 dlog(1, FIL__, __LINE__,
958 _("Could not checksum my own executable because of the\nfollowing error: %s: %s\n\nPossible reasons include:\n Wrong path in configure file option SamhainPath=/path/to/executable\n No read permission for the effective UID: %d\n"),
959 sh.exec.path, sl_get_errmsg(), (int) sl_ret_euid());
960 sh_error_handle ((-1), FIL__, __LINE__, EACCES, MSG_NOACCESS,
961 (long) sh.real.uid, c);
962 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
963 }
964 SL_RETURN((0), _("sh_unix_self_hash"));
965}
966
967int sh_unix_self_check ()
968{
969 char newhash[KEY_LEN+1];
970 char message[512];
[133]971 char hashbuf[KEYBUF_SIZE];
[1]972
973 SL_ENTER(_("sh_unix_self_check"));
974 if (sh.exec.path == NULL || sh.exec.path[0] == '\0')
975 SL_RETURN((0), _("sh_unix_self_check"));
976
[133]977 sl_strlcpy(newhash,
[160]978 sh_tiger_hash (sh.exec.path, TIGER_FILE, TIGER_NOLIM, hashbuf, sizeof(hashbuf)),
[133]979 KEY_LEN+1);
[1]980 if (0 == sl_strncmp(sh.exec.hash,
981 newhash,
982 KEY_LEN))
983 SL_RETURN((0), _("sh_unix_self_check"));
984
985
986 dlog(1, FIL__, __LINE__,
987 _("The checksum of the executable: %s has changed since startup (%s -> %s).\n"),
988 sh.exec.path, sh.exec.hash, newhash);
989
990 sl_snprintf(message, 512,
991 _("The checksum of %s has changed since startup (%s -> %s)"),
992 sh.exec.path, sh.exec.hash, newhash);
993 message[511] = '\0';
994
995 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
996 message, _("sh_unix_self_check"));
997 sh_error_handle ((-1), FIL__, __LINE__, EACCES, MSG_E_AUTH,
998 sh.exec.path);
999 SL_RETURN((-1), _("sh_unix_self_check"));
1000}
1001
1002
1003/* ---------------------------------------------------------------- */
1004
[410]1005long sh_group_to_gid (const char * g, int * fail)
1006{
1007 struct group * w;
1008 gid_t gid = 0;
[428]1009 int status = 0;
[1]1010
[410]1011#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1012 struct group grp;
1013 char * buffer;
[462]1014 static size_t gbufsize = SH_GRBUF_SIZE;
[410]1015#endif
1016
1017 *fail = -1;
1018
1019 if (g)
1020 {
1021 size_t i;
1022 size_t len = strlen(g);
1023
1024 *fail = 0;
1025
1026 for (i = 0; i < len; ++i)
1027 {
1028 char c = g[i];
1029
1030 if (!isdigit((int) c))
1031 goto is_a_name;
1032 }
1033 return atol(g);
1034
1035 is_a_name:
1036
1037#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
[462]1038
1039 buffer = SH_ALLOC(gbufsize);
1040 status = sh_getgrnam_r(g, &grp, buffer, gbufsize, &w);
1041
1042 if ((status == ERANGE) && (w == NULL))
1043 {
1044 if (SL_TRUE == sl_ok_adds( gbufsize, SH_GRBUF_SIZE ))
1045 {
1046 SH_FREE(buffer);
1047 gbufsize += SH_GRBUF_SIZE;
1048 goto is_a_name;
1049 }
1050 }
1051
[410]1052#else
[462]1053
[428]1054 errno = 0;
[410]1055 w = sh_getgrnam(g);
[428]1056 status = errno;
[462]1057
[410]1058#endif
1059
[428]1060 if ((status == ERANGE) && (w == NULL))
[410]1061 {
[428]1062 static int seen = 0;
1063
1064 if (seen == 0)
1065 {
1066 char errbuf[SH_ERRBUF_SIZE];
1067
1068 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_GRNULL,
1069 sh_error_message(status, errbuf, sizeof(errbuf)),
1070 _("sh_group_to_gid"), (long) -1, _("line too long in group entry"));
1071 ++seen;
1072 }
1073 *fail = -1;
1074 }
1075 else if (w == NULL)
1076 {
[410]1077 char * tmp = sh_util_strdup(g);
1078 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
1079 _("sh_group_to_gid"), tmp);
1080 SH_FREE(tmp);
1081 *fail = -1;
1082 }
1083 else
1084 {
1085 gid = w->gr_gid;
1086 }
1087#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1088 SH_FREE(buffer);
1089#endif
1090 }
1091
1092 return gid;
1093}
1094
1095/* ---------------------------------------------------------------- */
1096
1097
[1]1098/* added Tue Feb 22 10:36:44 NFT 2000 Rainer Wichmann */
[22]1099static int tf_add_trusted_user_int(const char * c)
[1]1100{
[137]1101 struct passwd * w;
[1]1102 int count;
1103 uid_t pwid = (uid_t)-1;
1104
[131]1105#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1106 struct passwd pwd;
[227]1107 char * buffer;
[131]1108#endif
1109
[1]1110 SL_ENTER(_("tf_add_trusted_user_int"));
1111
1112 /* First check for a user name.
1113 */
[131]1114#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
[227]1115 buffer = SH_ALLOC(SH_PWBUF_SIZE);
1116 sh_getpwnam_r(c, &pwd, buffer, SH_PWBUF_SIZE, &w);
[131]1117#else
1118 w = sh_getpwnam(c);
1119#endif
1120
1121 if ((w != NULL) && ((pwid = w->pw_uid) > 0))
[1]1122 goto succe;
1123
1124 /* Failed, so check for a numerical value.
1125 */
1126 pwid = strtol(c, (char **)NULL, 10);
1127 if (pwid > 0 && pwid < 65535)
1128 goto succe;
1129
1130 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
1131 _("add trusted user"), c);
[227]1132#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1133 SH_FREE(buffer);
1134#endif
[1]1135 SL_RETURN((-1), _("tf_add_trusted_user_int"));
1136
1137 succe:
1138 count = sl_trust_add_user(pwid);
[227]1139#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1140 SH_FREE(buffer);
1141#endif
[1]1142 SL_RETURN((count), _("tf_add_trusted_user_int"));
1143}
1144
[22]1145int tf_add_trusted_user(const char * c)
[1]1146{
1147 int i;
1148 char * q;
1149 char * p = sh_util_strdup (c);
[131]1150#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1151 char * saveptr;
1152#endif
1153
[1]1154 SL_ENTER(_("tf_add_trusted_user"));
1155
[131]1156#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1157 q = strtok_r(p, ", \t", &saveptr);
1158#else
[1]1159 q = strtok(p, ", \t");
[131]1160#endif
[1]1161 if (!q)
1162 {
1163 SH_FREE(p);
1164 SL_RETURN((-1), _("tf_add_trusted_user"));
1165 }
1166 while (q)
1167 {
1168 i = tf_add_trusted_user_int(q);
1169 if (SL_ISERROR(i))
1170 {
1171 SH_FREE(p);
1172 SL_RETURN((i), _("tf_add_trusted_user"));
1173 }
[131]1174#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_STRTOK_R)
1175 q = strtok_r(NULL, ", \t", &saveptr);
1176#else
[1]1177 q = strtok(NULL, ", \t");
[131]1178#endif
[1]1179 }
1180 SH_FREE(p);
1181 SL_RETURN((0), _("tf_add_trusted_user"));
1182}
1183
[170]1184extern uid_t sl_trust_baduid(void);
1185extern gid_t sl_trust_badgid(void);
[1]1186
1187#if defined(HOST_IS_CYGWIN) || defined(__cygwin__) || defined(__CYGWIN32__) || defined(__CYGWIN__)
[183]1188int tf_trust_check (const char * file, int mode)
[1]1189{
1190 (void) file;
1191 (void) mode;
1192 return 0;
1193}
1194#else
[183]1195int tf_trust_check (const char * file, int mode)
[1]1196{
1197 char * tmp;
1198 char * tmp2;
1199 char * p;
1200 int status;
1201 int level;
[383]1202 uid_t ff_euid = (uid_t) -1;
[1]1203
1204 SL_ENTER(_("tf_trust_check"));
1205
1206 if (mode == SL_YESPRIV)
1207 sl_get_euid(&ff_euid);
1208 else
1209 sl_get_ruid(&ff_euid);
1210
1211#if defined(SH_WITH_SERVER)
1212 if (0 == sl_ret_euid()) /* privileges not dropped yet */
1213 {
[131]1214#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1215 struct passwd pwd;
[227]1216 char * buffer = SH_ALLOC(SH_PWBUF_SIZE);
[131]1217 struct passwd * tempres;
[227]1218 sh_getpwnam_r(DEFAULT_IDENT, &pwd, buffer, SH_PWBUF_SIZE, &tempres);
[131]1219#else
[1]1220 struct passwd * tempres = sh_getpwnam(DEFAULT_IDENT);
[131]1221#endif
[1]1222
1223 if (!tempres)
1224 {
1225 dlog(1, FIL__, __LINE__,
1226 _("User %s does not exist. Please add the user to your system.\n"),
1227 DEFAULT_IDENT);
1228 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
1229 }
[383]1230 else
1231 {
1232 ff_euid = tempres->pw_uid;
1233 }
[227]1234#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWNAM_R)
1235 SH_FREE(buffer);
1236#endif
[1]1237 }
1238#endif
1239
1240 status = sl_trustfile_euid(file, ff_euid);
1241
1242 if ( SL_ENONE != status)
1243 {
1244 if (status == SL_ESTAT)
1245 level = SH_ERR_ALL;
1246 else
1247 level = SH_ERR_ERR;
1248
1249 tmp = sh_util_safe_name (file);
1250 p = sl_trust_errfile();
1251 if (p && *p != '\0')
1252 {
1253 tmp2 = sh_util_safe_name (sl_trust_errfile());
1254 sh_error_handle(level, FIL__, __LINE__, status, MSG_E_TRUST2,
1255 sl_error_string(status), tmp, tmp2);
1256 SH_FREE(tmp2);
1257 }
1258 else
1259 {
1260 sh_error_handle(level, FIL__, __LINE__, status, MSG_E_TRUST1,
1261 sl_error_string(status), tmp);
1262 }
1263 SH_FREE(tmp);
1264
1265 if (status == SL_EBADUID || status == SL_EBADGID ||
1266 status == SL_EBADOTH || status == SL_ETRUNC ||
1267 status == SL_EINTERNAL )
1268 {
1269 switch (status) {
1270 case SL_EINTERNAL:
1271 dlog(1, FIL__, __LINE__,
1272 _("An internal error occured in the trustfile function.\n"));
1273 break;
1274 case SL_ETRUNC:
1275 tmp = sh_util_safe_name (file);
1276 dlog(1, FIL__, __LINE__,
1277 _("A filename truncation occured in the trustfile function.\nProbably the normalized filename for %s\nis too long. This may be due e.g. to deep or circular softlinks.\n"),
1278 tmp);
1279 SH_FREE(tmp);
1280 break;
1281 case SL_EBADOTH:
1282 tmp = sh_util_safe_name (file);
1283 p = sl_trust_errfile();
1284 dlog(1, FIL__, __LINE__,
1285 _("The path element: %s\nin the filename: %s is world writeable.\n"),
1286 p, tmp);
1287 SH_FREE(tmp);
1288 break;
1289 case SL_EBADUID:
1290 tmp = sh_util_safe_name (file);
1291 p = sl_trust_errfile();
1292 dlog(1, FIL__, __LINE__,
1293 _("The owner (UID = %ld) of the path element: %s\nin the filename: %s\nis not in the list of trusted users.\nTo fix the problem, you can:\n - run ./configure again with the option --with-trusted=0,...,UID\n where UID is the UID of the untrusted user, or\n - use the option TrustedUser=UID in the configuration file.\n"),
1294 (UID_CAST)sl_trust_baduid(), p, tmp);
1295 SH_FREE(tmp);
1296 break;
1297 case SL_EBADGID:
1298 tmp = sh_util_safe_name (file);
1299 p = sl_trust_errfile();
1300 dlog(1, FIL__, __LINE__,
1301 _("The path element: %s\nin the filename: %s\nis group writeable (GID = %ld), and at least one of the group\nmembers (UID = %ld) is not in the list of trusted users.\nTo fix the problem, you can:\n - run ./configure again with the option --with-trusted=0,...,UID\n where UID is the UID of the untrusted user, or\n - use the option TrustedUser=UID in the configuration file.\n"),
1302 p, tmp, (UID_CAST)sl_trust_badgid(),
1303 (UID_CAST)sl_trust_baduid());
1304 SH_FREE(tmp);
1305 break;
1306 default:
1307 break;
1308 }
1309
1310 SL_RETURN((-1), _("tf_trust_check"));
1311 }
1312 }
1313
1314 SL_RETURN((0), _("tf_trust_check"));
1315}
1316#endif
1317
1318#ifdef HAVE_INITGROUPS
1319#ifdef HOST_IS_OSF
1320int sh_unix_initgroups ( char * in_user, gid_t in_gid)
1321#else
1322int sh_unix_initgroups (const char * in_user, gid_t in_gid)
1323#endif
1324{
1325 int status = -1;
1326 status = sh_initgroups (in_user, in_gid);
1327 if (status < 0)
1328 {
1329 if (errno == EPERM)
1330 return 0;
1331 if (errno == EINVAL)
1332 return 0;
1333 return -1;
1334 }
1335 return 0;
1336}
1337#else
1338int sh_unix_initgroups (const char * in_user, gid_t in_gid)
1339{
1340 (void) in_user;
1341 (void) in_gid;
1342 return 0;
1343}
1344#endif
1345
1346#ifdef HAVE_INITGROUPS
[132]1347char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len);
[1]1348int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid)
1349{
1350 int status = -1;
[132]1351 char user[SH_MINIBUF];
[1]1352
1353 SL_ENTER(_("sh_unix_initgroups2"));
1354
[132]1355 if (NULL == sh_unix_getUIDname (SH_ERR_ERR, in_pid, user, sizeof(user)))
[1]1356 SL_RETURN((-1), _("sh_unix_initgroups2"));
1357 status = sh_initgroups (user, in_gid);
1358 if (status < 0)
1359 {
1360 if (errno == EPERM)
1361 status = 0;
1362 if (errno == EINVAL)
1363 status = 0;
1364 }
1365 SL_RETURN((status), _("sh_unix_initgroups2"));
1366}
1367#else
1368int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid)
1369{
1370 (void) in_pid;
1371 (void) in_gid;
1372 return 0;
1373}
1374#endif
1375
[174]1376void sh_unix_closeall (int fd, int except, int inchild)
[1]1377{
1378 int fdx = fd;
1379#ifdef _SC_OPEN_MAX
1380 int fdlimit = sysconf (_SC_OPEN_MAX);
1381#else
1382#ifdef OPEN_MAX
1383 int fdlimit = OPEN_MAX;
1384#else
1385 int fdlimit = _POSIX_OPEN_MAX;
1386#endif
1387#endif
1388
1389 SL_ENTER(_("sh_unix_closeall"));
1390
1391 /* can't happen - so fix it :-(
1392 */
1393 if (fdlimit < 0)
[84]1394 fdlimit = 20; /* POSIX lower limit */
[1]1395
1396 if (fdlimit > 65536)
1397 fdlimit = 65536;
1398
[247]1399 if (!inchild)
1400 sl_dropall (fdx, except);
1401 else
1402 sl_dropall_dirty (fdx, except);
1403
[1]1404 /* Close everything from fd (inclusive) up to fdlimit (exclusive).
1405 */
1406 while (fd < fdlimit)
1407 {
1408 if (fd == except)
1409 fd++;
1410 else if (slib_do_trace != 0 && fd == slib_trace_fd)
1411 fd++;
1412 else
[252]1413 sl_close_fd(FIL__, __LINE__, fd++);
[1]1414 }
1415
1416 SL_RET0(_("sh_unix_closeall"));
1417}
1418
1419static void sh_unix_setlimits(void)
1420{
1421 struct rlimit limits;
1422
1423 SL_ENTER(_("sh_unix_setlimits"));
1424
1425 limits.rlim_cur = RLIM_INFINITY;
1426 limits.rlim_max = RLIM_INFINITY;
1427
1428#ifdef RLIMIT_CPU
1429 setrlimit (RLIMIT_CPU, &limits);
1430#endif
1431#ifdef RLIMIT_FSIZE
1432 setrlimit (RLIMIT_FSIZE, &limits);
1433#endif
1434#ifdef RLIMIT_DATA
1435 setrlimit (RLIMIT_DATA, &limits);
1436#endif
1437#ifdef RLIMIT_STACK
1438 setrlimit (RLIMIT_STACK, &limits);
1439#endif
1440#ifdef RLIMIT_RSS
1441 setrlimit (RLIMIT_RSS, &limits);
1442#endif
1443#ifdef RLIMIT_NPROC
1444 setrlimit (RLIMIT_NPROC, &limits);
1445#endif
1446#ifdef RLIMIT_MEMLOCK
1447 setrlimit (RLIMIT_MEMLOCK, &limits);
1448#endif
1449
1450#if !defined(SL_DEBUG)
1451 /* no core dumps
1452 */
1453 limits.rlim_cur = 0;
1454 limits.rlim_max = 0;
1455#ifdef RLIMIT_CORE
1456 setrlimit (RLIMIT_CORE, &limits);
1457#endif
1458#else
1459#ifdef RLIMIT_CORE
1460 setrlimit (RLIMIT_CORE, &limits);
1461#endif
1462#endif
1463
[8]1464 limits.rlim_cur = 1024;
1465 limits.rlim_max = 1024;
[1]1466
[8]1467#if defined(RLIMIT_NOFILE)
1468 setrlimit (RLIMIT_NOFILE, &limits);
1469#elif defined(RLIMIT_OFILE)
1470 setrlimit (RLIMIT_OFILE, &limits);
1471#endif
1472
[1]1473 SL_RET0(_("sh_unix_setlimits"));
1474}
1475
1476static void sh_unix_copyenv(void)
1477{
1478 char ** env0 = environ;
1479 char ** env1;
1480 int envlen = 0;
[22]1481 size_t len;
[1]1482
1483 SL_ENTER(_("sh_unix_copyenv"));
1484
1485 while (env0 != NULL && env0[envlen] != NULL) {
1486 /* printf("%2d: %s\n", envlen, env0[envlen]); */
1487 ++envlen;
1488 }
1489 ++envlen;
1490
1491 /* printf("-> %2d: slots allocated\n", envlen); */
[454]1492 env1 = calloc(1,sizeof(char *) * envlen); /* only once */
[1]1493 if (env1 == NULL)
1494 {
1495 fprintf(stderr, _("%s: %d: Out of memory\n"), FIL__, __LINE__);
1496 SL_RET0(_("sh_unix_copyenv"));
1497 }
1498 env0 = environ;
1499 envlen = 0;
1500
[22]1501 while (env0 != NULL && env0[envlen] != NULL) {
1502 len = strlen(env0[envlen]) + 1;
[454]1503 env1[envlen] = calloc(1,len); /* only once */
[1]1504 if (env1[envlen] == NULL)
1505 {
1506 fprintf(stderr, _("%s: %d: Out of memory\n"), FIL__, __LINE__);
1507 SL_RET0(_("sh_unix_copyenv"));
1508 }
[22]1509 sl_strlcpy(env1[envlen], env0[envlen], len);
[1]1510 ++envlen;
1511 }
1512 env1[envlen] = NULL;
1513
1514 environ = env1;
1515 SL_RET0(_("sh_unix_copyenv"));
1516}
1517
1518/* delete all environment variables
1519 */
1520static void sh_unix_zeroenv(void)
1521{
1522 char * c;
1523 char ** env;
1524
1525 SL_ENTER(_("sh_unix_zeroenv"));
1526
1527 sh_unix_copyenv();
1528 env = environ;
1529
1530 while (env != NULL && *env != NULL) {
1531 c = strchr ((*env), '=');
1532#ifdef WITH_MYSQL
1533 /*
1534 * Skip the MYSQL_UNIX_PORT environment variable; MySQL may need it.
1535 */
1536 if (0 == sl_strncmp((*env), _("MYSQL_UNIX_PORT="), 16))
1537 {
1538 ++(env);
1539 continue;
1540 }
[18]1541 if (0 == sl_strncmp((*env), _("MYSQL_TCP_PORT="), 15))
1542 {
1543 ++(env);
1544 continue;
1545 }
1546 if (0 == sl_strncmp((*env), _("MYSQL_HOME="), 11))
1547 {
1548 ++(env);
1549 continue;
1550 }
[1]1551#endif
1552#ifdef WITH_ORACLE
1553 /*
[415]1554 * Skip the ORACLE_HOME and TNS_ADMIN environment variables;
1555 * Oracle may need them.
[1]1556 */
1557 if (0 == sl_strncmp((*env), _("ORACLE_HOME="), 12))
1558 {
1559 ++(env);
1560 continue;
1561 }
[415]1562 if (0 == sl_strncmp((*env), _("TNS_ADMIN="), 10))
1563 {
1564 ++(env);
1565 continue;
1566 }
[1]1567#endif
1568 /*
1569 * Skip the TZ environment variable.
1570 */
1571 if (0 == sl_strncmp((*env), _("TZ="), 3))
1572 {
1573 ++(env);
1574 continue;
1575 }
1576 ++(env);
1577 if (c != NULL)
1578 {
1579 ++c;
1580 while ((*c) != '\0') {
1581 (*c) = '\0';
1582 ++c;
1583 }
1584 }
1585 }
1586
[205]1587#ifdef HAVE_TZSET
1588 tzset();
1589#endif
1590
[1]1591 SL_RET0(_("sh_unix_zeroenv"));
1592}
1593
1594
1595static void sh_unix_resettimer(void)
1596{
1597 struct itimerval this_timer;
1598
1599 SL_ENTER(_("sh_unix_resettimer"));
1600
1601 this_timer.it_value.tv_sec = 0;
1602 this_timer.it_value.tv_usec = 0;
1603
1604 this_timer.it_interval.tv_sec = 0;
1605 this_timer.it_interval.tv_usec = 0;
1606
1607 setitimer(ITIMER_REAL, &this_timer, NULL);
1608#if !defined(SH_PROFILE)
1609 setitimer(ITIMER_VIRTUAL, &this_timer, NULL);
1610 setitimer(ITIMER_PROF, &this_timer, NULL);
1611#endif
1612
1613 SL_RET0(_("sh_unix_resettimer"));
1614}
1615
1616static void sh_unix_resetsignals(void)
1617{
1618 int sig_num;
1619#ifdef NSIG
1620 int max_sig = NSIG;
1621#else
1622 int max_sig = 255;
1623#endif
1624 int test;
1625 int status;
[264]1626 struct sigaction act;
1627#if !defined(SH_PROFILE)
1628 struct sigaction oldact;
1629#endif
[1]1630
1631 sigset_t set_proc;
1632
1633 SL_ENTER(_("sh_unix_resetsignals"));
1634 /*
1635 * Reset the current signal mask (inherited from parent process).
1636 */
1637
1638 sigfillset(&set_proc);
1639
1640 do {
1641 errno = 0;
[315]1642 test = SH_SETSIGMASK(SIG_UNBLOCK, &set_proc, NULL);
[1]1643 } while (test < 0 && errno == EINTR);
1644
1645 /*
1646 * Reset signal handling.
1647 */
1648
1649 act.sa_handler = SIG_DFL; /* signal action */
1650 sigemptyset( &act.sa_mask ); /* set an empty mask */
1651 act.sa_flags = 0; /* init sa_flags */
1652
1653 for (sig_num = 1; sig_num <= max_sig; ++sig_num)
1654 {
1655#if !defined(SH_PROFILE)
1656 test = retry_sigaction(FIL__, __LINE__, sig_num, &act, &oldact);
1657#else
1658 test = 0;
1659#endif
1660 if ((test == -1) && (errno != EINVAL))
1661 {
[132]1662 char errbuf[SH_ERRBUF_SIZE];
[1]1663 status = errno;
1664 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_W_SIG,
[132]1665 sh_error_message (status, errbuf, sizeof(errbuf)), sig_num);
[1]1666 }
1667 }
1668
1669 SL_RET0(_("sh_unix_resetsignals"));
1670}
1671
1672/* Get the local hostname (FQDN)
1673 */
[293]1674static char * sh_tolower (char * s)
1675{
1676 char * ret = s;
1677 if (s)
1678 {
1679 for (; *s; ++s)
1680 {
1681 *s = tolower((unsigned char) *s);
1682 }
1683 }
1684 return ret;
1685}
1686
1687
[1]1688#include <sys/socket.h>
1689
1690/* Required for BSD
1691 */
1692#ifdef HAVE_NETINET_IN_H
1693#include <netinet/in.h>
1694#endif
1695
1696#include <arpa/inet.h>
1697
[263]1698const char * sh_unix_h_name (struct hostent * host_entry)
[29]1699{
1700 char ** p;
1701 if (strchr(host_entry->h_name, '.')) {
1702 return host_entry->h_name;
1703 } else {
1704 for (p = host_entry->h_aliases; *p; ++p) {
1705 if (strchr(*p, '.'))
1706 return *p;
1707 }
1708 }
1709 return host_entry->h_name;
1710}
1711
[1]1712/* uname() on FreeBSD is broken, because the 'nodename' buf is too small
1713 * to hold a valid (leftmost) domain label.
1714 */
1715#if defined(HAVE_UNAME) && !defined(HOST_IS_FREEBSD)
1716#include <sys/utsname.h>
1717void sh_unix_localhost()
1718{
1719 struct utsname buf;
1720 int i;
[170]1721 int ddot;
[1]1722 int len;
1723 char * p;
1724 char hostname[256];
[295]1725 char numeric[SH_IP_BUF];
1726 char * canonical;
[1]1727
1728
1729 SL_ENTER(_("sh_unix_localhost"));
1730
1731 (void) uname (&buf);
[22]1732 /* flawfinder: ignore */ /* ff bug, ff sees system() */
[1]1733 sl_strlcpy (sh.host.system, buf.sysname, SH_MINIBUF);
1734 sl_strlcpy (sh.host.release, buf.release, SH_MINIBUF);
1735 sl_strlcpy (sh.host.machine, buf.machine, SH_MINIBUF);
1736
1737 /* Workaround for cases where nodename could be
1738 * a truncated FQDN.
1739 */
1740 if (strlen(buf.nodename) == (sizeof(buf.nodename)-1))
1741 {
1742 p = strchr(buf.nodename, '.');
1743 if (NULL != p) {
1744 *p = '\0';
1745 sl_strlcpy(hostname, buf.nodename, 256);
1746 } else {
1747#ifdef HAVE_GETHOSTNAME
1748 if (0 != gethostname(hostname, 256))
1749 {
1750 sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1751 _("nodename returned by uname may be truncated"),
1752 _("sh_unix_localhost"));
1753 sl_strlcpy (hostname, buf.nodename, 256);
1754 }
1755 else
1756 {
1757 hostname[255] = '\0';
1758 }
1759#else
1760 sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1761 _("nodename returned by uname may be truncated"),
1762 _("sh_unix_localhost"));
1763 sl_strlcpy(hostname, buf.nodename, 256);
1764#endif
1765 }
1766 }
1767 else
1768 {
1769 sl_strlcpy(hostname, buf.nodename, 256);
1770 }
1771
[295]1772 canonical = sh_ipvx_canonical(hostname, numeric, sizeof(numeric));
[1]1773
[295]1774 if (canonical == NULL)
[134]1775 {
[295]1776 sl_strlcpy (sh.host.name, hostname, SH_PATHBUF);
[293]1777 sh_tolower (sh.host.name);
[134]1778 }
[295]1779 else
[1]1780 {
[295]1781 sl_strlcpy (sh.host.name, canonical, SH_PATHBUF);
1782 SH_FREE(canonical);
[1]1783 }
1784
1785 /* check whether it looks like a FQDN
1786 */
1787 len = sl_strlen(sh.host.name);
[170]1788 ddot = 0;
[1]1789 for (i = 0; i < len; ++i)
1790 if (sh.host.name[i] == '.') ++ddot;
1791
[295]1792 if (ddot == 0)
[1]1793 {
1794 dlog(1, FIL__, __LINE__,
1795 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1796 hostname, sh.host.name);
[295]1797 sl_strlcpy (sh.host.name, numeric, SH_PATHBUF);
[1]1798 SL_RET0(_("sh_unix_localhost"));
1799 }
1800
[295]1801 if (sh_ipvx_is_numeric(sh.host.name))
[1]1802 {
1803 dlog(1, FIL__, __LINE__,
1804 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1805 hostname, sh.host.name);
1806 }
1807
1808 SL_RET0(_("sh_unix_localhost"));
1809}
[217]1810
[1]1811#else
[217]1812
1813/*
1814 * --FreeBSD code
1815 */
1816#if defined(HAVE_UNAME)
1817#include <sys/utsname.h>
1818#endif
[1]1819void sh_unix_localhost()
1820{
[217]1821#if defined(HAVE_UNAME)
1822 struct utsname buf;
1823#endif
[1]1824 int i;
[170]1825 int ddot;
[1]1826 int len;
1827 char hostname[1024];
[295]1828 char numeric[SH_IP_BUF];
1829 char * canonical;
[1]1830
1831 SL_ENTER(_("sh_unix_localhost"));
1832
[217]1833#if defined(HAVE_UNAME)
1834 (void) uname (&buf);
1835 /* flawfinder: ignore */ /* ff bug, ff sees system() */
1836 sl_strlcpy (sh.host.system, buf.sysname, SH_MINIBUF);
1837 sl_strlcpy (sh.host.release, buf.release, SH_MINIBUF);
1838 sl_strlcpy (sh.host.machine, buf.machine, SH_MINIBUF);
1839#endif
1840
[1]1841 (void) gethostname (hostname, 1024);
1842 hostname[1023] = '\0';
[134]1843
[295]1844 canonical = sh_ipvx_canonical(hostname, numeric, sizeof(numeric));
[1]1845
[295]1846 if (canonical == NULL)
[1]1847 {
[295]1848 sl_strlcpy (sh.host.name, hostname, SH_PATHBUF);
[293]1849 sh_tolower (sh.host.name);
[1]1850 }
[295]1851 else
[1]1852 {
[295]1853 sl_strlcpy (sh.host.name, canonical, SH_PATHBUF);
1854 SH_FREE(canonical);
[1]1855 }
1856
1857 /* check whether it looks like a FQDN
1858 */
1859 len = sl_strlen(sh.host.name);
[170]1860 ddot = 0;
[1]1861 for (i = 0; i < len; ++i)
1862 if (sh.host.name[i] == '.') ++ddot;
1863 if (ddot == 0)
1864 {
1865 dlog(1, FIL__, __LINE__,
1866 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1867 hostname, sh.host.name);
[295]1868 sl_strlcpy (sh.host.name, numeric, SH_PATHBUF);
[1]1869 SL_RET0(_("sh_unix_localhost"));
1870 }
1871
[295]1872 if (sh_ipvx_is_numeric(sh.host.name))
[1]1873 {
1874 dlog(1, FIL__, __LINE__,
1875 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1876 hostname, sh.host.name);
1877 }
1878
1879 SL_RET0(_("sh_unix_localhost"));
1880}
1881#endif
1882
1883
1884void sh_unix_memlock()
1885{
1886 SL_ENTER(_("sh_unix_memlock"));
1887
1888 /* do this before dropping privileges
1889 */
1890#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
1891 if (skey->mlock_failed == SL_FALSE)
1892 {
[19]1893 if ( (-1) == sh_unix_mlock( FIL__, __LINE__,
1894 (char *) skey, sizeof (sh_key_t)) )
[1]1895 {
[134]1896 SH_MUTEX_LOCK_UNSAFE(mutex_skey);
[1]1897 skey->mlock_failed = SL_TRUE;
[134]1898 SH_MUTEX_UNLOCK_UNSAFE(mutex_skey);
[1]1899 }
1900 }
1901#else
1902 if (skey->mlock_failed == SL_FALSE)
1903 {
[134]1904 SH_MUTEX_LOCK_UNSAFE(mutex_skey);
[1]1905 skey->mlock_failed = SL_TRUE;
[134]1906 SH_MUTEX_UNLOCK_UNSAFE(mutex_skey);
[1]1907 }
1908#endif
1909
1910 SL_RET0(_("sh_unix_memlock"));
1911}
1912
1913#ifdef SH_WITH_SERVER
1914char * chroot_dir = NULL;
1915
[20]1916int sh_unix_set_chroot(const char * str)
[1]1917{
1918 size_t len;
1919 static int block = 0;
1920
1921 if (block == 1)
1922 return 0;
1923
1924 if (str && *str == '/')
1925 {
1926 len = strlen(str) + 1;
[454]1927 chroot_dir = calloc(1,strlen(str) + 1); /* only once */
[1]1928 if (!chroot_dir)
1929 {
1930 fprintf(stderr, _("%s: %d: Out of memory\n"), FIL__, __LINE__);
1931 return 1;
1932 }
1933 sl_strlcpy(chroot_dir, str, len);
1934 block = 1;
1935 return 0;
1936 }
1937 return 1;
1938}
1939
[170]1940int sh_unix_chroot(void)
[1]1941{
1942 int status;
1943
1944 if (chroot_dir != NULL)
1945 {
1946 status = retry_aud_chdir(FIL__, __LINE__, chroot_dir);
1947 if ( (-1) == status )
1948 {
[132]1949 char errbuf[SH_ERRBUF_SIZE];
[1]1950 status = errno;
1951 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_W_CHDIR,
[132]1952 sh_error_message (status, errbuf, sizeof(errbuf)), chroot_dir);
[1]1953 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
1954 }
[22]1955 /* flawfinder: ignore */
[1]1956 return (chroot(chroot_dir));
1957 }
1958 return 0;
1959}
1960/* #ifdef SH_WITH_SERVER */
1961#else
[170]1962int sh_unix_chroot(void) { return 0; }
[1]1963#endif
1964
1965/* daemon mode
1966 */
1967static int block_setdeamon = 0;
1968
[20]1969int sh_unix_setdeamon(const char * dummy)
[1]1970{
1971 int res = 0;
1972
1973 SL_ENTER(_("sh_unix_setdeamon"));
1974
1975 if (block_setdeamon != 0)
1976 SL_RETURN((0),_("sh_unix_setdeamon"));
1977
1978 if (dummy == NULL)
1979 sh.flag.isdaemon = ON;
1980 else
1981 res = sh_util_flagval (dummy, &sh.flag.isdaemon);
1982
1983 if (sh.flag.opts == S_TRUE)
1984 block_setdeamon = 1;
1985
1986 SL_RETURN(res, _("sh_unix_setdeamon"));
1987}
1988#if defined(HAVE_LIBPRELUDE)
1989#include "sh_prelude.h"
1990#endif
1991
[20]1992int sh_unix_setnodeamon(const char * dummy)
[1]1993{
1994 int res = 0;
[132]1995
[1]1996 SL_ENTER(_("sh_unix_setnodeamon"));
1997
1998 if (block_setdeamon != 0)
1999 SL_RETURN((0),_("sh_unix_setmodeamon"));
2000
2001 if (dummy == NULL)
2002 sh.flag.isdaemon = OFF;
2003 else
2004 res = sh_util_flagval (dummy, &sh.flag.isdaemon);
2005
2006 if (sh.flag.opts == S_TRUE)
2007 block_setdeamon = 1;
2008
2009 SL_RETURN(res, _("sh_unix_setnodeamon"));
2010}
2011
2012int sh_unix_init(int goDaemon)
2013{
2014 int status;
2015 uid_t uid;
2016 pid_t oldpid = getpid();
2017#if defined(SH_WITH_SERVER)
[170]2018 extern int sh_socket_open_int (void);
[1]2019#endif
[132]2020 char errbuf[SH_ERRBUF_SIZE];
[1]2021
[321]2022 extern void sh_kill_sub();
2023
[1]2024 SL_ENTER(_("sh_unix_init"));
2025
2026 /* fork twice, exit the parent process
2027 */
2028 if (goDaemon == 1) {
2029
2030 switch (aud_fork(FIL__, __LINE__)) {
2031 case 0: break; /* child process continues */
2032 case -1: SL_RETURN((-1),_("sh_unix_init")); /* error */
[321]2033 default: /* parent process exits */
2034 sh_kill_sub();
2035 aud__exit(FIL__, __LINE__, 0);
[1]2036 }
2037
2038 /* Child processes do not inherit page locks across a fork.
2039 * Error in next fork would return in this (?) thread of execution.
2040 */
2041 sh_unix_memlock();
2042
2043 setsid(); /* should not fail */
[162]2044 sh.pid = (UINT64) getpid();
[1]2045
2046 switch (aud_fork(FIL__, __LINE__)) {
2047 case 0: break; /* child process continues */
2048 case -1: SL_RETURN((-1),_("sh_unix_init")); /* error */
[321]2049 default: /* parent process exits */
2050 sh_kill_sub();
2051 aud__exit(FIL__, __LINE__, 0);
[1]2052 }
2053
2054 /* Child processes do not inherit page locks across a fork.
2055 */
2056 sh_unix_memlock();
[162]2057 sh.pid = (UINT64) getpid();
[1]2058
2059 } else {
2060 setsid(); /* should not fail */
2061 }
2062
2063 /* set working directory
2064 */
2065#ifdef SH_PROFILE
2066 status = 0;
2067#else
2068 status = retry_aud_chdir(FIL__, __LINE__, "/");
2069#endif
2070 if ( (-1) == status )
2071 {
2072 status = errno;
2073 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_W_CHDIR,
[132]2074 sh_error_message (status, errbuf, sizeof(errbuf)), "/");
[1]2075 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
2076 }
2077
2078 /* reset timers
2079 */
2080 sh_unix_resettimer();
2081
2082 /* signal handlers
2083 */
2084 sh_unix_resetsignals();
2085#if defined(SCREW_IT_UP)
2086 sh_sigtrap_prepare();
2087#endif
2088 sh_unix_siginstall (goDaemon);
2089
2090 /* set file creation mask
2091 */
2092 (void) umask (0); /* should not fail */
2093
2094 /* set resource limits to maximum, and
2095 * core dump size to zero
2096 */
2097 sh_unix_setlimits();
2098
2099 /* zero out the environment (like PATH='\0')
2100 */
2101 sh_unix_zeroenv();
2102
2103 if (goDaemon == 1)
2104 {
[92]2105 /* Close first tree file descriptors
[84]2106 */
[252]2107 sl_close_fd (FIL__, __LINE__, 0); /* if running as daemon */
2108 sl_close_fd (FIL__, __LINE__, 1); /* if running as daemon */
2109 sl_close_fd (FIL__, __LINE__, 2); /* if running as daemon */
[84]2110
2111 /* Enable full error logging
2112 */
2113 sh_error_only_stderr (S_FALSE);
2114
2115 /* open first three streams to /dev/null
2116 */
2117 status = aud_open(FIL__, __LINE__, SL_NOPRIV, _("/dev/null"), O_RDWR, 0);
2118 if (status < 0)
2119 {
2120 status = errno;
2121 sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
[132]2122 sh_error_message(status, errbuf, sizeof(errbuf)), _("open"));
[84]2123 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
2124 }
2125
2126 status = retry_aud_dup(FIL__, __LINE__, 0);
2127 if (status >= 0)
2128 retry_aud_dup(FIL__, __LINE__, 0);
2129
2130 if (status < 0)
2131 {
2132 status = errno;
2133 sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
[132]2134 sh_error_message(status, errbuf, sizeof(errbuf)), _("dup"));
[84]2135 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
2136 }
2137
[86]2138 sh_error_enable_unsafe (S_TRUE);
[1]2139#if defined(HAVE_LIBPRELUDE)
2140 sh_prelude_reset ();
2141#endif
2142
2143 /* --- wait until parent has exited ---
2144 */
2145 while (1 == 1)
2146 {
2147 errno = 0;
2148 if (0 > aud_kill (FIL__, __LINE__, oldpid, 0) && errno == ESRCH)
2149 {
2150 break;
2151 }
2152 retry_msleep(0, 1);
2153 }
2154
2155 /* write PID file
2156 */
2157 status = sh_unix_write_pid_file();
2158 if (status < 0)
2159 {
2160 sl_get_euid(&uid);
2161 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_PIDFILE,
2162 (long) uid, sh.srvlog.alt);
2163 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
2164 }
2165#if defined(SH_WITH_SERVER)
2166 sh_socket_open_int ();
2167#endif
2168 }
2169 else
2170 {
[86]2171 sh_error_enable_unsafe (S_TRUE);
[1]2172#if defined(HAVE_LIBPRELUDE)
2173 sh_prelude_reset ();
2174#endif
2175#if defined(SH_WITH_SERVER)
2176 sh_socket_open_int ();
2177#endif
2178 }
2179
2180 /* chroot (this is a no-op if no chroot dir is specified
2181 */
2182 status = sh_unix_chroot();
2183 if (status < 0)
2184 {
2185 status = errno;
2186 sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
[132]2187 sh_error_message(status, errbuf, sizeof(errbuf)), _("chroot"));
[1]2188 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
2189 }
2190
2191 /* drop capabilities
2192 */
2193 sl_drop_cap();
2194
2195 SL_RETURN((0),_("sh_unix_init"));
2196}
2197
[197]2198/* --- run a command, securely --- */
2199
2200int sh_unix_run_command (const char * str)
2201{
2202 pid_t pid;
2203 char * arg[4];
2204 char * env[5];
2205 char * path = sh_util_strdup(_("/bin/sh"));
2206
2207 int status = -1;
2208
2209 arg[0] = sh_util_strdup(_("/bin/sh"));
2210 arg[1] = sh_util_strdup(_("-c"));
2211 arg[2] = sh_util_strdup(str);
2212 arg[3] = NULL;
2213
2214 env[0] = sh_util_strdup(_("PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/ucb"));
2215 env[1] = sh_util_strdup(_("SHELL=/bin/sh"));
2216 env[2] = sh_util_strdup(_("IFS= \t\n"));
[199]2217 if (getenv("TZ")) { /* flawfinder: ignore */
2218 char * tz = sh_util_strdup(getenv("TZ")); /* flawfinder: ignore */
2219 size_t tzlen = strlen(tz);
2220 if (SL_TRUE == sl_ok_adds (4, tzlen)) {
2221 env[3] = SH_ALLOC(4+tzlen);
[197]2222 sl_strlcpy(env[3], "TZ=", 4);
[199]2223 sl_strlcat(env[3], tz , 4+tzlen);
[197]2224 } else {
2225 env[3] = NULL;
2226 }
2227 } else {
2228 env[3] = NULL;
2229 }
2230 env[4] = NULL;
2231
2232 pid = fork();
2233
2234 if (pid == (pid_t)(-1))
2235 {
2236 return -1;
2237 }
2238
2239 else if (pid == 0) /* child */
2240 {
2241 memset(skey, 0, sizeof(sh_key_t));
2242 (void) umask(S_IRGRP|S_IWGRP|S_IXGRP|S_IROTH|S_IWOTH|S_IXOTH);
2243 sh_unix_closeall (3, -1, SL_TRUE); /* in child process */
2244 execve(path, arg, env);
2245 _exit(EXIT_FAILURE);
2246 }
2247
2248 else /* parent */
2249 {
2250 int r;
2251
[203]2252 while((r = waitpid(pid, &status, WUNTRACED)) != pid && r != -1) ;
[197]2253
[199]2254#if !defined(USE_UNO)
[197]2255 if (r == -1 || !WIFEXITED(status))
2256 {
2257 status = -1;
2258 }
2259 else
2260 {
2261 status = WEXITSTATUS(status);
2262 }
[199]2263#endif
[197]2264 }
2265
2266 return status;
2267}
2268
[1]2269/********************************************************
2270 *
2271 * TIME
2272 *
2273 ********************************************************/
2274
2275/* Figure out the time offset of the current timezone
2276 * in a portable way.
2277 */
2278char * t_zone(const time_t * xx)
2279{
2280 struct tm aa;
2281 struct tm bb;
[362]2282
[1]2283 int sign = 0;
2284 int diff = 0;
2285 int hh, mm;
2286 static char tz[64];
2287
2288 SL_ENTER(_("t_zone"));
2289
[131]2290#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GMTIME_R)
[362]2291 gmtime_r (xx, &aa);
[131]2292#else
[362]2293 memcpy (&aa, gmtime(xx), sizeof(struct tm));
[131]2294#endif
2295
2296#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_LOCALTIME_R)
[362]2297 localtime_r (xx, &bb);
[131]2298#else
[362]2299 memcpy (&bb, localtime(xx), sizeof(struct tm));
[131]2300#endif
[1]2301
2302 /* Check for datum wrap-around.
2303 */
2304 if (aa.tm_year < bb.tm_year)
2305 sign = (-1);
2306 else if (aa.tm_mon < bb.tm_mon)
2307 sign = (-1);
2308 else if (aa.tm_mday < bb.tm_mday)
2309 sign = (-1);
2310 else if (bb.tm_year < aa.tm_year)
2311 sign = ( 1);
2312 else if (bb.tm_mon < aa.tm_mon)
2313 sign = ( 1);
2314 else if (bb.tm_mday < aa.tm_mday)
2315 sign = ( 1);
2316
2317 diff = aa.tm_hour * 60 + aa.tm_min;
2318 diff = (bb.tm_hour * 60 + bb.tm_min) - diff;
2319 diff = diff - (sign * 24 * 60); /* datum wrap-around correction */
2320 hh = diff / 60;
2321 mm = diff - (hh * 60);
2322 sprintf (tz, _("%+03d%02d"), hh, mm); /* known to fit */
2323
2324 SL_RETURN(tz, _("t_zone"));
2325}
2326
2327unsigned long sh_unix_longtime ()
2328{
2329 return ((unsigned long)time(NULL));
2330}
2331
2332#ifdef HAVE_GETTIMEOFDAY
2333unsigned long sh_unix_notime ()
2334{
2335 struct timeval tv;
2336
2337 gettimeofday (&tv, NULL);
2338
2339 return ((unsigned long)(tv.tv_sec + tv.tv_usec * 10835 + getpid() + getppid()));
2340
2341}
2342#endif
2343
2344static int count_dev_time = 0;
2345
2346void reset_count_dev_time(void)
2347{
2348 count_dev_time = 0;
2349 return;
2350}
2351
[22]2352int sh_unix_settimeserver (const char * address)
[1]2353{
2354
2355 SL_ENTER(_("sh_unix_settimeserver"));
2356
2357 if (address != NULL && count_dev_time < 2
2358 && sl_strlen(address) < SH_PATHBUF)
2359 {
2360 if (count_dev_time == 0)
2361 sl_strlcpy (sh.srvtime.name, address, SH_PATHBUF);
2362 else
2363 sl_strlcpy (sh.srvtime.alt, address, SH_PATHBUF);
2364
2365 ++count_dev_time;
2366 SL_RETURN((0), _("sh_unix_settimeserver"));
2367 }
2368 SL_RETURN((-1), _("sh_unix_settimeserver"));
2369}
2370
2371
2372#ifdef HAVE_NTIME
2373#define UNIXEPOCH 2208988800UL /* difference between Unix time and net time
2374 * The UNIX EPOCH starts in 1970.
2375 */
2376#include <sys/socket.h>
2377#include <netinet/in.h>
2378#include <arpa/inet.h>
2379#include <netdb.h>
2380#include <ctype.h>
2381#endif
2382
2383/* Timeserver service. */
2384/* define is missing on HP-UX 10.20 */
2385#ifndef IPPORT_TIMESERVER
2386#define IPPORT_TIMESERVER 37
2387#endif
2388
[132]2389char * sh_unix_time (time_t thetime, char * buffer, size_t len)
[1]2390{
2391
2392 int status;
[132]2393 char AsciiTime[81]; /* local time */
[1]2394 time_t time_now;
2395 struct tm * time_ptr;
[131]2396#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_LOCALTIME_R)
2397 struct tm time_tm;
2398#endif
[1]2399#ifdef SH_USE_XML
2400 static char deftime[] = N_("0000-00-00T00:00:00"); /* default time */
2401#else
2402 static char deftime[] = N_("[0000-00-00T00:00:00]"); /* default time */
2403#endif
2404
2405#ifdef HAVE_NTIME
2406 int fd; /* network file descriptor */
2407 u_char net_time[4]; /* remote time in network format */
2408 static int failerr = 0; /* no net time */
2409 int fail = 0; /* no net time */
2410 int errflag;
2411 char errmsg[256];
2412 char error_call[SH_MINIBUF];
2413 int error_num;
2414#endif
2415
2416 SL_ENTER(_("sh_unix_time"));
2417
2418#ifdef HAVE_NTIME
2419 if (thetime == 0)
2420 {
2421 if (sh.srvtime.name[0] == '\0')
2422 {
2423 fail = 1;
2424 (void) time (&time_now);
2425 }
2426 else /* have a timeserver address */
2427 {
[343]2428 /* don't call timeserver more than once per second */
2429 static time_t time_old = 0;
2430 time_t time_new;
2431 static time_t time_saved = 0;
2432 (void) time (&time_new);
2433 if ((time_new == time_old) && (time_saved != 0))
2434 {
2435 time_now = time_saved;
2436 goto end;
2437 }
2438 time_old = time_new;
2439
2440
[1]2441 fd = connect_port_2 (sh.srvtime.name, sh.srvtime.alt,
2442 IPPORT_TIMESERVER,
2443 error_call, &error_num, errmsg, sizeof(errmsg));
2444 if (fd >= 0)
2445 {
2446 if (4 != read_port (fd, (char *) net_time, 4, &errflag, 2))
2447 {
2448 fail = 1;
2449 sh_error_handle ((-1), FIL__, __LINE__, errflag,
2450 MSG_E_NLOST,
2451 _("time"), sh.srvtime.name);
2452 }
[252]2453 sl_close_fd(FIL__, __LINE__, fd);
[1]2454 }
2455 else
2456 {
2457 sh_error_handle ((-1), FIL__, __LINE__, error_num,
2458 MSG_E_NET, errmsg, error_call,
2459 _("time"), sh.srvtime.name);
2460 fail = 1;
2461 }
2462
2463 if (fail == 0)
2464 {
[230]2465 unsigned long ltmp;
2466 UINT32 ttmp;
2467 memcpy(&ttmp, net_time, sizeof(UINT32)); ltmp = ttmp;
2468 time_now = ntohl(ltmp) - UNIXEPOCH;
[343]2469 time_saved = time_now;
2470
[1]2471 if (failerr == 1) {
2472 failerr = 0;
2473 sh_error_handle ((-1), FIL__, __LINE__, 0,
2474 MSG_E_NEST,
2475 _("time"), sh.srvtime.name);
2476 }
2477 }
2478 else
2479 {
2480 (void) time (&time_now);
[343]2481 time_saved = 0;
2482
[1]2483 if (failerr == 0)
2484 {
2485 failerr = 1;
2486 sh_error_handle ((-1), FIL__, __LINE__, errflag,
2487 MSG_SRV_FAIL,
2488 _("time"), sh.srvtime.name);
2489 }
2490 }
[343]2491 end:
2492 ; /* 'label at end of compound statement' */
[1]2493 }
2494 }
2495 else
2496 {
2497 time_now = thetime;
2498 }
2499
2500 /* #ifdef HAVE_NTIME */
2501#else
2502
2503 if (thetime == 0)
2504 {
2505 (void) time (&time_now);
2506 }
2507 else
2508 {
2509 time_now = thetime;
2510 }
2511
2512 /* #ifdef HAVE_NTIME */
2513#endif
2514
[132]2515 if (time_now == (-1) )
2516 {
2517 sl_strlcpy(buffer, _(deftime), len);
2518 SL_RETURN(buffer, _("sh_unix_time"));
2519 }
[1]2520 else
[131]2521 {
2522#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_LOCALTIME_R)
2523 time_ptr = localtime_r (&time_now, &time_tm);
2524#else
2525 time_ptr = localtime (&time_now);
2526#endif
2527 }
[1]2528 if (time_ptr != NULL)
2529 {
[132]2530 status = strftime (AsciiTime, sizeof(AsciiTime),
[1]2531#ifdef SH_USE_XML
2532 _("%Y-%m-%dT%H:%M:%S%%s"),
2533#else
2534 _("[%Y-%m-%dT%H:%M:%S%%s]"),
2535#endif
2536 time_ptr);
2537
[132]2538 sl_snprintf(buffer, len, AsciiTime, t_zone(&time_now));
[1]2539
[132]2540 if ( (status == 0) || (status == sizeof(AsciiTime)) )
2541 {
2542 sl_strlcpy(buffer, _(deftime), len);
2543 SL_RETURN( buffer, _("sh_unix_time"));
2544 }
[1]2545 else
[132]2546 {
2547 SL_RETURN(buffer, _("sh_unix_time"));
2548 }
[1]2549 }
2550
2551 /* last resort
2552 */
[132]2553 sl_strlcpy(buffer, _(deftime), len);
2554 SL_RETURN( buffer, _("sh_unix_time"));
[1]2555}
2556
2557static int sh_unix_use_localtime = S_FALSE;
2558
2559/* whether to use localtime for file timesatams in logs
2560 */
[22]2561int sh_unix_uselocaltime (const char * c)
[1]2562{
2563 int i;
2564 SL_ENTER(_("sh_unix_uselocaltime"));
2565 i = sh_util_flagval(c, &(sh_unix_use_localtime));
2566
2567 SL_RETURN(i, _("sh_unix_uselocaltime"));
2568}
2569
[132]2570char * sh_unix_gmttime (time_t thetime, char * buffer, size_t len)
[1]2571{
2572
2573 int status;
2574
2575 struct tm * time_ptr;
[131]2576#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS)
2577 struct tm time_tm;
2578#endif
[132]2579 char AsciiTime[81]; /* GMT time */
[1]2580#ifdef SH_USE_XML
2581 static char deftime[] = N_("0000-00-00T00:00:00"); /* default time */
2582#else
2583 static char deftime[] = N_("[0000-00-00T00:00:00]"); /* default time */
2584#endif
2585
2586 SL_ENTER(_("sh_unix_gmttime"));
2587
2588 if (sh_unix_use_localtime == S_FALSE)
[131]2589 {
2590#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GMTIME_R)
2591 time_ptr = gmtime_r (&thetime, &time_tm);
2592#else
2593 time_ptr = gmtime (&thetime);
2594#endif
2595 }
[1]2596 else
[131]2597 {
2598#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_LOCALTIME_R)
2599 time_ptr = localtime_r (&thetime, &time_tm);
2600#else
2601 time_ptr = localtime (&thetime);
2602#endif
2603 }
[1]2604 if (time_ptr != NULL)
2605 {
2606 status = strftime (AsciiTime, 80,
2607#ifdef SH_USE_XML
2608 _("%Y-%m-%dT%H:%M:%S"),
2609#else
2610 _("[%Y-%m-%dT%H:%M:%S]"),
2611#endif
2612 time_ptr);
2613
[132]2614 if ( (status == 0) || (status == 80) )
2615 sl_strlcpy(buffer, _(deftime), len);
[1]2616 else
[132]2617 sl_strlcpy(buffer, AsciiTime, len);
2618 SL_RETURN( buffer, _("sh_unix_gmttime"));
[1]2619 }
2620
2621 /* last resort
2622 */
[132]2623 sl_strlcpy(buffer, _(deftime), len);
2624 SL_RETURN( buffer, _("sh_unix_gmttime"));
[1]2625}
2626
2627
[132]2628char * sh_unix_getUIDdir (int level, uid_t uid, char * out, size_t len)
[1]2629{
2630 struct passwd * tempres;
2631 int status = 0;
[264]2632
[131]2633#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWUID_R)
2634 struct passwd pwd;
[227]2635 char * buffer;
[131]2636#endif
[132]2637 char errbuf[SH_ERRBUF_SIZE];
[1]2638
2639 SL_ENTER(_("sh_unix_getUIDdir"));
2640
[131]2641#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWUID_R)
[227]2642 buffer = SH_ALLOC(SH_PWBUF_SIZE);
2643 sh_getpwuid_r(uid, &pwd, buffer, SH_PWBUF_SIZE, &tempres);
[131]2644#else
[1]2645 errno = 0;
2646 tempres = sh_getpwuid(uid);
2647 status = errno;
[131]2648#endif
[1]2649
2650 if (tempres == NULL) {
2651 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
[132]2652 sh_error_message(status, errbuf, sizeof(errbuf)),
[1]2653 _("getpwuid"), (long) uid, _("completely missing"));
[227]2654#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
2655 SH_FREE(buffer);
2656#endif
[1]2657 SL_RETURN( NULL, _("sh_unix_getUIDdir"));
2658 }
2659
2660 if (tempres->pw_dir != NULL) {
[132]2661 sl_strlcpy(out, tempres->pw_dir, len);
[227]2662#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
2663 SH_FREE(buffer);
2664#endif
[132]2665 SL_RETURN( out, _("sh_unix_getUIDdir"));
[1]2666 } else {
2667 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
[132]2668 sh_error_message(status, errbuf, sizeof(errbuf)),
[1]2669 _("getpwuid"), (long) uid, _("pw_dir"));
[227]2670#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
2671 SH_FREE(buffer);
2672#endif
[1]2673 SL_RETURN( NULL, _("sh_unix_getUIDdir"));
2674 }
2675}
2676
[264]2677/* ------------------- Caching ----------------*/
2678#include "zAVLTree.h"
[132]2679
[264]2680#define CACHE_GID 0
2681#define CACHE_UID 1
2682
2683struct user_id {
2684 char * name;
2685 uid_t id;
2686 struct user_id * next;
2687};
2688
2689static struct user_id * uid_list = NULL;
2690static struct user_id * gid_list = NULL;
2691
2692SH_MUTEX_STATIC(mutex_cache, PTHREAD_MUTEX_INITIALIZER);
2693
2694static void sh_userid_free(struct user_id * item)
2695{
2696 while (item)
2697 {
2698 struct user_id * user = item;
2699 item = item->next;
2700
2701 SH_FREE(user->name);
2702 SH_FREE(user);
2703 }
2704 return;
2705}
2706
2707void sh_userid_destroy ()
2708{
2709 struct user_id * tmp_uid;
2710 struct user_id * tmp_gid;
2711
2712 SH_MUTEX_LOCK_UNSAFE(mutex_cache);
2713 tmp_gid = gid_list;
2714 gid_list = NULL;
2715 tmp_uid = uid_list;
2716 uid_list = NULL;
2717 SH_MUTEX_UNLOCK_UNSAFE(mutex_cache);
2718
2719 sh_userid_free(tmp_uid);
2720 sh_userid_free(tmp_gid);
2721 return;
2722}
2723
2724static void sh_userid_additem(struct user_id * list, struct user_id * item)
2725{
[383]2726 if (list)
2727 {
2728 while (list && list->next)
2729 list = list->next;
2730 list->next = item;
2731 }
[264]2732 return;
2733}
2734
2735static void sh_userid_add(uid_t id, char * username, int which)
2736{
2737 size_t len;
2738 struct user_id * user = SH_ALLOC(sizeof(struct user_id));
2739
2740 if (username)
2741 len = strlen(username) + 1;
2742 else
2743 len = 1;
2744
2745 user->name = SH_ALLOC(len);
2746 user->id = id;
2747 if (username)
2748 sl_strlcpy(user->name, username, len);
2749 else
2750 user->name[0] = '\0';
2751 user->next = NULL;
2752
2753 SH_MUTEX_LOCK(mutex_cache);
2754 if (which == CACHE_UID)
2755 {
2756 if (!uid_list)
2757 uid_list = user;
2758 else
2759 sh_userid_additem(uid_list, user);
2760 }
2761 else
2762 {
2763 if (!gid_list)
2764 gid_list = user;
2765 else
2766 sh_userid_additem(gid_list, user);
2767 }
2768 SH_MUTEX_UNLOCK(mutex_cache);
2769
2770 return;
2771}
2772
2773static char * sh_userid_search(struct user_id * list, uid_t id)
2774{
2775 while (list)
2776 {
2777 if (list->id == id)
2778 return list->name;
2779 list = list->next;
2780 }
2781 return NULL;
2782}
2783
2784static char * sh_userid_get (uid_t id, int which, char * out, size_t len)
2785{
2786 char * user = NULL;
2787
2788 SH_MUTEX_LOCK_UNSAFE(mutex_cache);
2789 if (which == CACHE_UID)
2790 user = sh_userid_search(uid_list, id);
2791 else
2792 user = sh_userid_search(gid_list, id);
2793 if (user)
2794 {
2795 sl_strlcpy(out, user, len);
2796 user = out;
2797 }
2798 SH_MUTEX_UNLOCK_UNSAFE(mutex_cache);
2799
2800 return user;
2801}
2802
2803/* --------- end caching code --------- */
2804
[132]2805char * sh_unix_getUIDname (int level, uid_t uid, char * out, size_t len)
[1]2806{
2807 struct passwd * tempres;
[131]2808#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWUID_R)
2809 struct passwd pwd;
[227]2810 char * buffer;
[131]2811#endif
[1]2812 int status = 0;
[132]2813 char errbuf[SH_ERRBUF_SIZE];
[264]2814 char * tmp;
[1]2815
2816 SL_ENTER(_("sh_unix_getUIDname"));
2817
[264]2818 tmp = sh_userid_get(uid, CACHE_UID, out, len);
2819
2820 if (tmp)
2821 {
2822 if (tmp[0] != '\0')
2823 {
2824 SL_RETURN( out, _("sh_unix_getUIDname"));
2825 }
2826 else
2827 {
2828 SL_RETURN( NULL, _("sh_unix_getUIDname"));
2829 }
[132]2830 }
[1]2831
[131]2832#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETPWUID_R)
[227]2833 buffer = SH_ALLOC(SH_PWBUF_SIZE);
2834 sh_getpwuid_r(uid, &pwd, buffer, SH_PWBUF_SIZE, &tempres);
[131]2835#else
[1]2836 errno = 0;
2837 tempres = sh_getpwuid(uid);
2838 status = errno;
[131]2839#endif
[1]2840
[264]2841 if (tempres == NULL)
2842 {
2843 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
2844 sh_error_message(status, errbuf, sizeof(errbuf)),
2845 _("getpwuid"), (long) uid, _("completely missing"));
[227]2846#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
[264]2847 SH_FREE(buffer);
[227]2848#endif
[264]2849 sh_userid_add(uid, NULL, CACHE_UID);
2850 SL_RETURN( NULL, _("sh_unix_getUIDname"));
2851 }
[1]2852
2853
[264]2854 if (tempres->pw_name != NULL)
2855 {
2856
2857 sl_strlcpy(out, tempres->pw_name, len);
2858 sh_userid_add(uid, out, CACHE_UID);
2859
[227]2860#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
[264]2861 SH_FREE(buffer);
[227]2862#endif
[264]2863
2864 SL_RETURN( out, _("sh_unix_getUIDname"));
2865 }
2866 else
2867 {
2868 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
2869 sh_error_message(status, errbuf, sizeof(errbuf)),
2870 _("getpwuid"), (long) uid, _("pw_user"));
[227]2871#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
[264]2872 SH_FREE(buffer);
[227]2873#endif
[264]2874 SL_RETURN( NULL, _("sh_unix_getUIDname"));
2875 }
2876 /* notreached */
[1]2877}
2878
[132]2879char * sh_unix_getGIDname (int level, gid_t gid, char * out, size_t len)
[1]2880{
2881 struct group * tempres;
2882 int status = 0;
[264]2883
[131]2884#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
2885 struct group grp;
[227]2886 char * buffer;
[131]2887#endif
[132]2888 char errbuf[SH_ERRBUF_SIZE];
[264]2889 char * tmp;
[131]2890
[1]2891 SL_ENTER(_("sh_unix_getGIDname"));
2892
[264]2893 tmp = sh_userid_get((uid_t)gid, CACHE_GID, out, len);
2894
2895 if (tmp)
2896 {
2897 if (tmp[0] != '\0')
2898 {
2899 SL_RETURN( out, _("sh_unix_getGIDname"));
2900 }
2901 else
2902 {
2903 SL_RETURN( NULL, _("sh_unix_getGIDname"));
2904 }
[132]2905 }
2906
[131]2907#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
[227]2908 buffer = SH_ALLOC(SH_GRBUF_SIZE);
2909 status = sh_getgrgid_r(gid, &grp, buffer, SH_GRBUF_SIZE, &tempres);
[131]2910#else
[1]2911 errno = 0;
2912 tempres = sh_getgrgid(gid);
2913 status = errno;
[131]2914#endif
[1]2915
[428]2916 if (status == ERANGE)
2917 {
2918 static int seen = 0;
2919
2920 if (seen == 0)
2921 {
2922 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_GRNULL,
2923 sh_error_message(status, errbuf, sizeof(errbuf)),
2924 _("getgrgid"), (long) gid, _("line too long in group entry"));
2925 ++seen;
2926 }
2927
2928#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
2929 SH_FREE(buffer);
2930#endif
2931
2932 sh_userid_add(gid, NULL, CACHE_GID);
2933 SL_RETURN( NULL, _("sh_unix_getGIDname"));
2934 }
2935
[264]2936 if (tempres == NULL)
2937 {
2938 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_GRNULL,
2939 sh_error_message(status, errbuf, sizeof(errbuf)),
2940 _("getgrgid"), (long) gid, _("completely missing"));
[1]2941
[227]2942#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
[264]2943 SH_FREE(buffer);
[227]2944#endif
[1]2945
[264]2946 sh_userid_add(gid, NULL, CACHE_GID);
2947 SL_RETURN( NULL, _("sh_unix_getGIDname"));
2948 }
2949
2950 if (tempres->gr_name != NULL)
2951 {
2952
2953 sl_strlcpy(out, tempres->gr_name, len);
2954 sh_userid_add((uid_t)gid, out, CACHE_GID);
2955
[227]2956#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
[264]2957 SH_FREE(buffer);
[227]2958#endif
[264]2959
2960 SL_RETURN( out, _("sh_unix_getGIDname"));
2961 }
2962 else
2963 {
2964 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_GRNULL,
2965 sh_error_message(status, errbuf, sizeof(errbuf)),
2966 _("getgrgid"), (long) gid, _("gr_name"));
2967
[227]2968#if defined(HAVE_PTHREAD) && defined (_POSIX_THREAD_SAFE_FUNCTIONS) && defined(HAVE_GETGRGID_R)
[264]2969 SH_FREE(buffer);
[227]2970#endif
[264]2971
2972 SL_RETURN( NULL, _("sh_unix_getGIDname"));
2973 }
2974 /* notreached */
[1]2975}
2976
2977int sh_unix_getUser ()
2978{
2979 char * p;
2980 uid_t seuid, sruid;
[132]2981 char user[USER_MAX];
2982 char dir[SH_PATHBUF];
[1]2983
2984 SL_ENTER(_("sh_unix_getUser"));
2985
2986 seuid = geteuid();
2987
2988 sh.effective.uid = seuid;
2989
[132]2990 p = sh_unix_getUIDdir (SH_ERR_ERR, seuid, dir, sizeof(dir));
[1]2991
2992 if (p == NULL)
2993 SL_RETURN((-1), _("sh_unix_getUser"));
2994 else
2995 {
2996 if (sl_strlen(p) >= SH_PATHBUF) {
2997 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_PWLONG,
2998 _("getpwuid"), (long) seuid, _("pw_home"));
2999 SL_RETURN((-1), _("sh_unix_getUser"));
3000 } else {
3001 sl_strlcpy ( sh.effective.home, p, SH_PATHBUF);
3002 }
3003 }
3004
3005 sruid = getuid();
3006
3007 sh.real.uid = sruid;
3008
[132]3009 p = sh_unix_getUIDname (SH_ERR_ERR, sruid, user, sizeof(user));
[1]3010 if (p == NULL)
3011 SL_RETURN((-1), _("sh_unix_getUser"));
3012 else
3013 {
3014 if (sl_strlen(p) >= USER_MAX) {
3015 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_PWLONG,
3016 _("getpwuid"), (long) sruid, _("pw_user"));
3017 SL_RETURN((-1), _("sh_unix_getUser"));
3018 } else {
3019 sl_strlcpy ( sh.real.user, p, USER_MAX);
3020 }
3021 }
3022
[132]3023 p = sh_unix_getUIDdir (SH_ERR_ERR, sruid, dir, sizeof(dir));
[1]3024
3025 if (p == NULL)
3026 SL_RETURN((-1), _("sh_unix_getUser"));
3027 else
3028 {
3029 if (sl_strlen(p) >= SH_PATHBUF) {
3030 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_PWLONG,
3031 _("getpwuid"), (long) sruid, _("pw_home"));
3032 SL_RETURN((-1), _("sh_unix_getUser"));
3033 } else {
3034 sl_strlcpy ( sh.real.home, p, SH_PATHBUF);
3035 }
3036 }
3037
3038 SL_RETURN((0), _("sh_unix_getUser"));
3039
3040 /* notreached */
3041}
3042
3043
3044int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline)
3045{
3046 register int count;
3047 register int n = 0;
3048 char c;
3049
3050 SL_ENTER(_("sh_unix_getline"));
3051
3052 if (sizeofline < 2) {
[34]3053 line[0] = '\0';
[1]3054 SL_RETURN((0), _("sh_unix_getline"));
3055 }
3056
[34]3057 --sizeofline;
3058
[1]3059 while (n < sizeofline) {
3060
3061 count = sl_read (fd, &c, 1);
3062
3063 /* end of file
3064 */
3065 if (count < 1) {
3066 line[n] = '\0';
3067 n = -1;
3068 break;
3069 }
3070
3071 if (/* c != '\0' && */ c != '\n') {
3072 line[n] = c;
3073 ++n;
3074 } else if (c == '\n') {
3075 if (n > 0) {
3076 line[n] = '\0';
3077 break;
3078 } else {
3079 line[n] = '\n'; /* get newline only if only char on line */
3080 ++n;
3081 line[n] = '\0';
3082 break;
3083 }
3084 } else {
3085 line[n] = '\0';
3086 break;
3087 }
3088
3089 }
3090
3091
3092 line[sizeofline] = '\0'; /* make sure line is terminated */
3093 SL_RETURN((n), _("sh_unix_getline"));
3094}
3095
3096
3097#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
3098
3099/**************************************************************
3100 *
3101 * --- FILE INFO ---
3102 *
3103 **************************************************************/
3104
[10]3105#if (defined(__linux__) && (defined(HAVE_LINUX_EXT2_FS_H) || defined(HAVE_EXT2FS_EXT2_FS_H))) || defined(HAVE_STAT_FLAGS)
[1]3106
[10]3107#if defined(__linux__)
[1]3108
3109/* --- Determine ext2fs file attributes. ---
3110 */
3111#include <sys/ioctl.h>
3112#if defined(HAVE_EXT2FS_EXT2_FS_H)
3113#include <ext2fs/ext2_fs.h>
3114#else
3115#include <linux/ext2_fs.h>
3116#endif
3117
[10]3118/* __linux__ includes */
3119#endif
3120
[1]3121static
3122int sh_unix_getinfo_attr (char * name,
3123 unsigned long * flags,
3124 char * c_attr,
[10]3125 int fd, struct stat * buf)
[1]3126{
3127
3128/* TAKEN FROM:
3129 *
3130 * lsattr.c - List file attributes on an ext2 file system
3131 *
3132 * Copyright (C) 1993, 1994 Remy Card <card@masi.ibp.fr>
3133 * Laboratoire MASI, Institut Blaise Pascal
3134 * Universite Pierre et Marie Curie (Paris VI)
3135 *
3136 * This file can be redistributed under the terms of the GNU General
3137 * Public License
3138 */
3139
3140#ifdef HAVE_STAT_FLAGS
3141
3142 SL_ENTER(_("sh_unix_getinfo_attr"));
3143
3144 *flags = 0;
3145
[10]3146 /* cast to void to avoid compiler warning about unused parameters */
3147 (void) fd;
3148 (void) name;
[1]3149
[10]3150#ifdef UF_NODUMP
3151 if (buf->st_flags & UF_NODUMP) {
3152 *flags |= UF_NODUMP;
3153 c_attr[0] = 'd';
3154 }
3155#endif
[1]3156#ifdef UF_IMMUTABLE
[10]3157 if (buf->st_flags & UF_IMMUTABLE) {
3158 *flags |= UF_IMMUTABLE;
3159 c_attr[1] = 'i';
3160 }
[1]3161#endif
3162#ifdef UF_APPEND
[10]3163 if (buf->st_flags & UF_APPEND) {
3164 *flags |= UF_APPEND;
3165 c_attr[2] = 'a';
3166 }
[1]3167#endif
[10]3168#ifdef UF_NOUNLINK
3169 if (buf->st_flags & UF_NOUNLINK) {
3170 *flags |= UF_NOUNLINK;
3171 c_attr[3] = 'u';
3172 }
[1]3173#endif
[10]3174#ifdef UF_OPAQUE
3175 if (buf->st_flags & UF_OPAQUE) {
3176 *flags |= UF_OPAQUE;
3177 c_attr[4] = 'o';
3178 }
3179#endif
3180#ifdef SF_ARCHIVED
3181 if (buf->st_flags & SF_ARCHIVED) {
3182 *flags |= SF_ARCHIVED;
3183 c_attr[5] = 'R';
3184 }
3185
3186#endif
3187#ifdef SF_IMMUTABLE
3188 if (buf->st_flags & SF_IMMUTABLE) {
3189 *flags |= SF_IMMUTABLE;
3190 c_attr[6] = 'I';
3191 }
3192#endif
3193#ifdef SF_APPEND
3194 if (buf->st_flags & SF_APPEND) {
3195 *flags |= SF_APPEND;
3196 c_attr[7] = 'A';
3197 }
3198#endif
3199#ifdef SF_NOUNLINK
3200 if (buf->st_flags & SF_NOUNLINK) {
3201 *flags |= SF_NOUNLINK;
3202 c_attr[8] = 'U';
3203 }
3204#endif
[1]3205
[10]3206 /* ! HAVE_STAT_FLAGS */
[1]3207#else
3208
3209#ifdef HAVE_EXT2_IOCTLS
3210 int /* fd, */ r, f;
3211
3212 SL_ENTER(_("sh_unix_getinfo_attr"));
3213
3214 *flags = 0;
[10]3215 (void) buf;
[1]3216
3217 /* open() -> aud_open() R.Wichmann
3218 fd = aud_open (FIL__, __LINE__, SL_YESPRIV, name, O_RDONLY|O_NONBLOCK, 0);
3219 */
3220
3221 if (fd == -1 || name == NULL)
3222 SL_RETURN(-1, _("sh_unix_getinfo_attr"));
3223
3224
3225 r = ioctl (fd, EXT2_IOC_GETFLAGS, &f);
[252]3226 /* sl_close_fd (FIL__, __LINE__, fd); */
[1]3227
3228 if (r == -1)
3229 SL_RETURN(-1, _("sh_unix_getinfo_attr"));
3230
[10]3231 if (f == 0)
3232 SL_RETURN(0, _("sh_unix_getinfo_attr"));
3233
[1]3234 *flags = f;
3235
3236/* ! HAVE_EXT2_IOCTLS */
3237#else
3238
3239 SL_ENTER(_("sh_unix_getinfo_attr"));
3240
3241 *flags = 0; /* modified by R.Wichmann */
3242
3243/* ! HAVE_EXT2_IOCTLS */
3244#endif
3245/*
3246 * END
3247 *
3248 * lsattr.c - List file attributes on an ext2 file system
3249 */
3250
[10]3251 if (*flags == 0)
3252 goto theend;
3253
[1]3254#ifdef EXT2_SECRM_FL
3255 if ( (*flags & EXT2_SECRM_FL) != 0 ) c_attr[0] = 's';
3256#endif
3257#ifdef EXT2_UNRM_FL
3258 if ( (*flags & EXT2_UNRM_FL) != 0 ) c_attr[1] = 'u';
3259#endif
3260#ifdef EXT2_SYNC_FL
3261 if ( (*flags & EXT2_SYNC_FL) != 0 ) c_attr[2] = 'S';
3262#endif
3263#ifdef EXT2_IMMUTABLE_FL
3264 if ( (*flags & EXT2_IMMUTABLE_FL) != 0) c_attr[3] = 'i';
3265#endif
3266#ifdef EXT2_APPEND_FL
3267 if ( (*flags & EXT2_APPEND_FL) != 0 ) c_attr[4] = 'a';
3268#endif
3269#ifdef EXT2_NODUMP_FL
3270 if ( (*flags & EXT2_NODUMP_FL) != 0 ) c_attr[5] = 'd';
3271#endif
3272#ifdef EXT2_NOATIME_FL
3273 if ( (*flags & EXT2_NOATIME_FL) != 0) c_attr[6] = 'A';
3274#endif
3275#ifdef EXT2_COMPR_FL
3276 if ( (*flags & EXT2_COMPR_FL) != 0 ) c_attr[7] = 'c';
3277#endif
[10]3278
3279#ifdef EXT2_TOPDIR_FL
3280 if ( (*flags & EXT2_TOPDIR_FL) != 0 ) c_attr[8] = 'T';
[1]3281#endif
[10]3282#ifdef EXT2_DIRSYNC_FL
3283 if ( (*flags & EXT2_DIRSYNC_FL) != 0 ) c_attr[9] = 'D';
[1]3284#endif
[10]3285#ifdef EXT2_NOTAIL_FL
3286 if ( (*flags & EXT2_NOTAIL_FL) != 0 ) c_attr[10] = 't';
[1]3287#endif
[10]3288#ifdef EXT2_JOURNAL_DATA_FL
3289 if ( (*flags & EXT2_JOURNAL_DATA_FL) != 0) c_attr[11] = 'j';
[1]3290#endif
3291
[10]3292 theend:
3293 /* ext2 */
3294#endif
3295
[1]3296 c_attr[12] = '\0';
3297
3298 SL_RETURN(0, _("sh_unix_getinfo_attr"));
3299}
3300
[10]3301/* defined(__linux__) || defined(HAVE_STAT_FLAGS) */
[1]3302#endif
3303
3304/* determine file type
3305 */
3306static
3307int sh_unix_getinfo_type (struct stat * buf,
3308 ShFileType * type,
3309 char * c_mode)
3310{
3311 SL_ENTER(_("sh_unix_getinfo_type"));
3312
3313 if ( S_ISREG(buf->st_mode) ) {
3314 (*type) = SH_FILE_REGULAR;
3315 c_mode[0] = '-';
3316 }
3317 else if ( S_ISLNK(buf->st_mode) ) {
3318 (*type) = SH_FILE_SYMLINK;
3319 c_mode[0] = 'l';
3320 }
3321 else if ( S_ISDIR(buf->st_mode) ) {
3322 (*type) = SH_FILE_DIRECTORY;
3323 c_mode[0] = 'd';
3324 }
3325 else if ( S_ISCHR(buf->st_mode) ) {
3326 (*type) = SH_FILE_CDEV;
3327 c_mode[0] = 'c';
3328 }
3329 else if ( S_ISBLK(buf->st_mode) ) {
3330 (*type) = SH_FILE_BDEV;
3331 c_mode[0] = 'b';
3332 }
3333 else if ( S_ISFIFO(buf->st_mode) ) {
3334 (*type) = SH_FILE_FIFO;
3335 c_mode[0] = '|';
3336 }
3337 else if ( S_ISSOCK(buf->st_mode) ) {
3338 (*type) = SH_FILE_SOCKET;
3339 c_mode[0] = 's';
3340 }
[40]3341 else if ( S_ISDOOR(buf->st_mode) ) {
3342 (*type) = SH_FILE_DOOR;
3343 c_mode[0] = 'D';
3344 }
3345 else if ( S_ISPORT(buf->st_mode) ) {
3346 (*type) = SH_FILE_PORT;
3347 c_mode[0] = 'P';
3348 }
[1]3349 else {
3350 (*type) = SH_FILE_UNKNOWN;
3351 c_mode[0] = '?';
3352 }
3353
3354 SL_RETURN(0, _("sh_unix_getinfo_type"));
3355}
3356
3357int sh_unix_get_ftype(char * fullpath)
3358{
[149]3359 char c_mode[CMODE_SIZE];
[1]3360 struct stat buf;
3361 ShFileType type;
3362 int res;
3363
3364 SL_ENTER(_("sh_unix_get_ftype"));
3365
3366 res = retry_lstat(FIL__, __LINE__, fullpath, &buf);
3367
3368 if (res < 0)
3369 SL_RETURN(SH_FILE_UNKNOWN, _("sh_unix_getinfo_type"));
3370
3371 sh_unix_getinfo_type (&buf, &type, c_mode);
3372
3373 SL_RETURN(type, _("sh_unix_get_ftype"));
3374}
3375
3376
3377static
3378int sh_unix_getinfo_mode (struct stat *buf,
3379 unsigned int * mode,
3380 char * c_mode)
3381{
3382
3383 SL_ENTER(_("sh_unix_getinfo_mode"));
3384
3385 (*mode) = buf->st_mode;
3386
3387 /* make 'ls'-like string */
3388
3389 if ( (buf->st_mode & S_IRUSR) != 0 ) c_mode[1] = 'r';
3390 if ( (buf->st_mode & S_IWUSR) != 0 ) c_mode[2] = 'w';
3391 if ( (buf->st_mode & S_IXUSR) != 0 ) {
3392 if ((buf->st_mode & S_ISUID) != 0 ) c_mode[3] = 's';
3393 else c_mode[3] = 'x';
3394 } else {
3395 if ((buf->st_mode & S_ISUID) != 0 ) c_mode[3] = 'S';
3396 }
3397
3398 if ( (buf->st_mode & S_IRGRP) != 0 ) c_mode[4] = 'r';
3399 if ( (buf->st_mode & S_IWGRP) != 0 ) c_mode[5] = 'w';
3400 if ( (buf->st_mode & S_IXGRP) != 0 ) {
3401 if ((buf->st_mode & S_ISGID) != 0 ) c_mode[6] = 's';
3402 else c_mode[6] = 'x';
3403 } else {
3404 if ((buf->st_mode & S_ISGID) != 0 ) c_mode[6] = 'S';
3405 }
3406
3407 if ( (buf->st_mode & S_IROTH) != 0 ) c_mode[7] = 'r';
3408 if ( (buf->st_mode & S_IWOTH) != 0 ) c_mode[8] = 'w';
3409#ifdef S_ISVTX /* not POSIX */
3410 if ( (buf->st_mode & S_IXOTH) != 0 ) {
3411 if ((buf->st_mode & S_ISVTX) != 0 ) c_mode[9] = 't';
3412 else c_mode[9] = 'x';
3413 } else {
3414 if ((buf->st_mode & S_ISVTX) != 0 ) c_mode[9] = 'T';
3415 }
3416#else
3417 if ( (buf->st_mode & S_IXOTH) != 0 ) c_mode[9] = 'x';
3418#endif
3419
3420 SL_RETURN(0, _("sh_unix_getinfo_mode"));
3421}
3422
3423
3424long IO_Limit = 0;
3425
3426void sh_unix_io_pause ()
3427{
3428 long runtime;
3429 float someval;
3430 unsigned long sometime;
3431
3432 if (IO_Limit == 0)
3433 {
3434 return;
3435 }
3436 else
3437 {
3438 runtime = (long) (time(NULL) - sh.statistics.time_start);
3439
3440 if (runtime > 0 && (long)(sh.statistics.bytes_hashed/runtime) > IO_Limit)
3441 {
3442 someval = sh.statistics.bytes_hashed - (IO_Limit * runtime);
3443 someval /= (float) IO_Limit;
3444 if (someval < 1.0)
3445 {
3446 someval *= 1000; /* milliseconds in a second */
3447 sometime = (unsigned long) someval;
3448 retry_msleep(0, sometime);
3449 }
3450 else
3451 {
3452 sometime = (unsigned long) someval;
3453 retry_msleep (sometime, 0);
3454 }
3455 }
3456 }
3457 return;
3458}
3459
[22]3460int sh_unix_set_io_limit (const char * c)
[1]3461{
3462 long val;
3463
3464 SL_ENTER(_("sh_unix_set_io_limit"));
3465
3466 val = strtol (c, (char **)NULL, 10);
3467 if (val < 0)
3468 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
3469 _("set I/O limit"), c);
3470
3471 val = (val < 0 ? 0 : val);
3472
3473 IO_Limit = val * 1024;
3474 SL_RETURN( 0, _("sh_unix_set_io_limit"));
3475}
3476
3477/* obtain file info
3478 */
3479extern int flag_err_debug;
3480
3481#include "sh_ignore.h"
3482
[425]3483int sh_unix_checksum_size (char * filename, off_t size, int is_max_size,
[133]3484 char * fileHash, int alert_timeout, SL_TICKET fd)
[19]3485{
[227]3486 file_type * tmpFile;
[19]3487 int status;
3488
3489 SL_ENTER(_("sh_unix_checksum_size"));
3490
[227]3491 tmpFile = SH_ALLOC(sizeof(file_type));
3492 tmpFile->link_path = NULL;
[169]3493
[59]3494 if (sh.flag.checkSum != SH_CHECK_INIT)
3495 {
3496 /* lookup file in database */
[425]3497 if (is_max_size == S_TRUE) {
3498 status = sh_hash_get_it (filename, tmpFile, NULL);
3499 if ((status != 0) || (tmpFile->size > size)) {
3500 goto out;
3501 }
3502 } else {
3503 tmpFile->size = size;
[59]3504 }
3505 }
3506 else
3507 {
[425]3508 tmpFile->size = size;
[59]3509 }
[19]3510
[425]3511 /* if last <= current get checksum */
3512 if (tmpFile->size <= size)
[19]3513 {
[133]3514 char hashbuf[KEYBUF_SIZE];
[227]3515 UINT64 local_length = (UINT64) (tmpFile->size < 0 ? 0 : tmpFile->size);
[22]3516 sl_strlcpy(fileHash,
[153]3517 sh_tiger_generic_hash (filename, fd, &(local_length),
[133]3518 alert_timeout, hashbuf, sizeof(hashbuf)),
[59]3519 KEY_LEN+1);
[68]3520
[107]3521 /* return */
[227]3522 if (tmpFile->link_path) SH_FREE(tmpFile->link_path);
3523 SH_FREE(tmpFile);
[19]3524 SL_RETURN( 0, _("sh_unix_checksum_size"));
3525 }
3526
3527 out:
[227]3528 if (tmpFile->link_path) SH_FREE(tmpFile->link_path);
3529 SH_FREE(tmpFile);
[93]3530 sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
[19]3531 SL_RETURN( -1, _("sh_unix_checksum_size"));
3532}
3533
[425]3534/********************************************************
3535 * Search rotated logfile
3536 */
3537extern char * sh_rotated_log_search(const char * path, struct stat * buf);
3538
3539int sh_check_rotated_log (const char * path,
3540 UINT64 old_size, UINT64 old_inode, const char * old_hash)
3541{
3542 struct stat obuf;
3543 UINT64 length_nolim = TIGER_NOLIM;
3544 int retval = S_FALSE;
3545
3546 if (old_size != length_nolim)
3547 {
3548 char hashbuf[KEYBUF_SIZE];
3549 char * rotated_file;
3550
3551 obuf.st_ino = old_inode;
3552 rotated_file = sh_rotated_log_search(path, &obuf);
3553
3554 if (rotated_file && (0 != strcmp(path, rotated_file)))
3555 {
3556 SL_TICKET fd = sl_open_fastread (FIL__, __LINE__, rotated_file, SL_YESPRIV);
3557 if (!SL_ISERROR(fd))
3558 {
3559 sh_unix_checksum_size (rotated_file, old_size, S_FALSE, hashbuf, 120 /* alert_timeout */, fd);
3560
3561 sl_close(fd);
3562
3563 if (strncmp (old_hash, hashbuf, KEY_LEN) == 0) {
3564 retval = S_TRUE;
3565 }
3566 }
3567 SH_FREE(rotated_file);
3568 }
3569 }
3570 return retval;
3571}
3572
3573
[68]3574int sh_unix_check_selinux = S_FALSE;
3575int sh_unix_check_acl = S_FALSE;
3576
3577#ifdef USE_ACL
3578
3579#include <sys/acl.h>
3580static char * sh_unix_getinfo_acl (char * path, int fd, struct stat * buf)
3581{
3582 /* system.posix_acl_access, system.posix_acl_default
3583 */
3584 char * out = NULL;
3585 char * collect = NULL;
3586 char * tmp;
3587 char * out_compact;
3588 ssize_t len;
3589 acl_t result;
3590
3591 SL_ENTER(_("sh_unix_getinfo_acl"));
3592
3593 result = (fd == -1) ?
3594 acl_get_file (path, ACL_TYPE_ACCESS) :
3595 acl_get_fd (fd);
3596
3597 if (result)
3598 {
3599 out = acl_to_text (result, &len);
3600 if (out && (len > 0)) {
3601 out_compact = sh_util_acl_compact (out, len);
3602 acl_free(out);
3603 if (out_compact)
3604 {
3605 collect = sh_util_strconcat (_("acl_access:"), out_compact, NULL);
3606 SH_FREE(out_compact);
3607 }
3608 }
3609 acl_free(result);
3610 }
3611
3612
3613 if ( S_ISDIR(buf->st_mode) )
3614 {
3615 result = acl_get_file (path, ACL_TYPE_DEFAULT);
3616
3617 if (result)
3618 {
3619 out = acl_to_text (result, &len);
3620 if (out && (len > 0)) {
3621 out_compact = sh_util_acl_compact (out, len);
3622 acl_free(out);
3623 if (out_compact) {
3624 if (collect) {
3625 tmp = sh_util_strconcat (_("acl_default:"),
3626 out_compact, ":", collect, NULL);
3627 SH_FREE(collect);
3628 }
3629 else {
3630 tmp = sh_util_strconcat (_("acl_default:"), out_compact, NULL);
3631 }
3632 SH_FREE(out_compact);
3633 collect = tmp;
3634 }
3635 }
3636 acl_free(result);
3637 }
3638 }
3639
3640 SL_RETURN((collect),_("sh_unix_getinfo_acl"));
3641}
3642#endif
3643
3644#ifdef USE_XATTR
3645
3646#include <attr/xattr.h>
3647static char * sh_unix_getinfo_xattr_int (char * path, int fd, char * name)
3648{
3649 char * out = NULL;
3650 char * tmp = NULL;
3651 size_t size = 256;
3652 ssize_t result;
3653
3654 SL_ENTER(_("sh_unix_getinfo_xattr_int"));
3655
3656 out = SH_ALLOC(size);
3657
3658 result = (fd == -1) ?
3659 lgetxattr (path, name, out, size-1) :
3660 fgetxattr (fd, name, out, size-1);
3661
3662 if (result == -1 && errno == ERANGE)
3663 {
3664 SH_FREE(out);
3665 result = (fd == -1) ?
3666 lgetxattr (path, name, NULL, 0) :
3667 fgetxattr (fd, name, NULL, 0);
3668 size = result + 1;
3669 out = SH_ALLOC(size);
3670 result = (fd == -1) ?
3671 lgetxattr (path, name, out, size-1) :
3672 fgetxattr (fd, name, out, size-1);
3673 }
3674
3675 if ((result > 0) && ((size_t)result < size))
3676 {
3677 out[size-1] = '\0';
3678 tmp = out;
3679 }
3680 else
3681 {
3682 SH_FREE(out);
3683 }
3684
3685 SL_RETURN((tmp),_("sh_unix_getinfo_xattr_int"));
3686}
3687
3688
3689static char * sh_unix_getinfo_xattr (char * path, int fd, struct stat * buf)
3690{
3691 /* system.posix_acl_access, system.posix_acl_default, security.selinux
3692 */
3693 char * tmp;
3694 char * out = NULL;
3695 char * collect = NULL;
3696
3697 SL_ENTER(_("sh_unix_getinfo_xattr"));
3698
3699#ifdef USE_ACL
3700 /*
3701 * we need the acl_get_fd/acl_get_file functions, getxattr will only
3702 * yield the raw bytes
3703 */
3704 if (sh_unix_check_acl == S_TRUE)
3705 {
3706 out = sh_unix_getinfo_acl(path, fd, buf);
3707
3708 if (out)
3709 {
3710 collect = out;
3711 }
3712 }
[290]3713#else
3714 (void) buf;
[68]3715#endif
3716
[105]3717 if (sh_unix_check_selinux == S_TRUE)
3718 {
3719 out = sh_unix_getinfo_xattr_int(path, fd, _("security.selinux"));
[68]3720
[105]3721 if (out)
3722 {
3723 if (collect) {
3724 tmp = sh_util_strconcat(_("selinux:"), out, ":", collect, NULL);
3725 SH_FREE(collect);
3726 }
3727 else {
3728 tmp = sh_util_strconcat(_("selinux:"), out, NULL);
3729 }
3730 SH_FREE(out);
3731 collect = tmp;
3732 }
[68]3733 }
3734
3735 SL_RETURN((collect),_("sh_unix_getinfo_xattr"));
3736}
3737#endif
3738
3739#ifdef USE_XATTR
3740int sh_unix_setcheckselinux (const char * c)
3741{
3742 int i;
3743 SL_ENTER(_("sh_unix_setcheckselinux"));
3744 i = sh_util_flagval(c, &(sh_unix_check_selinux));
3745
3746 SL_RETURN(i, _("sh_unix_setcheckselinux"));
3747}
3748#endif
3749
3750#ifdef USE_ACL
3751int sh_unix_setcheckacl (const char * c)
3752{
3753 int i;
3754 SL_ENTER(_("sh_unix_setcheckacl"));
3755 i = sh_util_flagval(c, &(sh_unix_check_acl));
3756
3757 SL_RETURN(i, _("sh_unix_setcheckacl"));
3758}
3759#endif
3760
[169]3761#ifdef HAVE_LIBZ
3762#include <zlib.h>
3763#endif
3764
[367]3765
3766static void * sh_dummy_filename;
3767static void * sh_dummy_tmp;
3768static void * sh_dummy_tmp2;
3769
[373]3770int sh_unix_getinfo (int level, const char * filename, file_type * theFile,
[1]3771 char * fileHash, int policy)
3772{
3773 char timestr[81];
3774 long runtim;
3775 struct stat buf;
3776 struct stat lbuf;
3777 struct stat fbuf;
[367]3778 volatile int stat_return;
3779 volatile int stat_errno = 0;
[8]3780
[1]3781 ShFileType type;
3782 unsigned int mode;
3783 char * tmp;
3784 char * tmp2;
[8]3785
[1]3786 char * linknamebuf;
[367]3787 volatile int linksize;
[1]3788
3789 extern int get_the_fd (SL_TICKET ticket);
3790
[367]3791 volatile SL_TICKET rval_open;
3792 volatile int err_open = 0;
[192]3793
[367]3794 volatile int fd;
3795 volatile int fstat_return;
3796 volatile int fstat_errno = 0;
3797 volatile int try = 0;
[192]3798
[167]3799 sh_string * content = NULL;
3800
[1]3801 time_t tend;
3802 time_t tstart;
3803
3804
3805 char * path = NULL;
3806
[367]3807 volatile int alert_timeout = 120;
[1]3808
3809 path = theFile->fullpath;
3810
3811 SL_ENTER(_("sh_unix_getinfo"));
3812
[381]3813 if (!MODI_INITIALIZED(theFile->check_mask))
3814 {
3815 tmp2 = sh_util_safe_name (theFile->fullpath);
3816 SH_MUTEX_LOCK(mutex_thread_nolog);
3817 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_E_SUBGPATH,
3818 _("Uninitialized check mask"), _("sh_unix_getinfo"),
3819 tmp2);
3820 SH_MUTEX_UNLOCK(mutex_thread_nolog);
3821 SH_FREE(tmp2);
3822 }
3823
[367]3824 /* Take the address to keep gcc from putting it into a register.
3825 * Avoids the 'clobbered by longjmp' warning.
3826 */
3827 sh_dummy_filename = (void *) &filename;
3828 sh_dummy_tmp = (void *) &tmp;
3829 sh_dummy_tmp2 = (void *) &tmp2;
3830
[1]3831 /* --- Stat the file, and get checksum. ---
3832 */
3833 tstart = time(NULL);
[8]3834
[1]3835 stat_return = retry_lstat (FIL__, __LINE__,
3836 path /* theFile->fullpath */, &buf);
3837
[192]3838 if (stat_return)
3839 stat_errno = errno;
3840
[252]3841 theFile->link_path = NULL;
3842
3843 try_again:
3844
[8]3845 fd = -1;
3846 fstat_return = -1;
3847 rval_open = -1;
3848
[1]3849 if (stat_return == 0 && S_ISREG(buf.st_mode))
3850 {
[248]3851 rval_open = sl_open_fastread (FIL__, __LINE__,
3852 path /* theFile->fullpath */, SL_YESPRIV);
[192]3853 if (SL_ISERROR(rval_open))
[252]3854 {
3855 char * stale = sl_check_stale();
3856
3857 if (stale)
3858 {
[367]3859 SH_MUTEX_LOCK(mutex_thread_nolog);
[252]3860 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, err_open, MSG_E_SUBGEN,
3861 stale, _("sh_unix_getinfo_open"));
[367]3862 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[252]3863 }
[1]3864
[252]3865 if (errno == EBADF && try == 0) /* obsolete, but we keep this, just in case */
3866 {
3867 ++try;
3868 goto try_again;
3869 }
3870 err_open = errno;
3871 }
[251]3872
[1]3873 alert_timeout = 120; /* this is per 8K block now ! */
3874
[8]3875 if (path[1] == 'p' && path[5] == '/' && path[2] == 'r' &&
3876 path[3] == 'o' && path[4] == 'c' && path[0] == '/')
[1]3877 {
3878 /* seven is magic */
3879 alert_timeout = 7;
3880 }
[8]3881
3882 fd = get_the_fd(rval_open);
[1]3883 }
3884
3885 tend = time(NULL);
3886
3887 /* An unprivileged user may slow lstat/open to a crawl
3888 * with clever path/symlink setup
3889 */
3890 if ((tend - tstart) > (time_t) /* 60 */ 6)
3891 {
3892 tmp2 = sh_util_safe_name (theFile->fullpath);
[367]3893 SH_MUTEX_LOCK(mutex_thread_nolog);
[1]3894 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_TOOLATE,
3895 (long)(tend - tstart), tmp2);
[367]3896 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[1]3897 SH_FREE(tmp2);
3898 }
[8]3899
[1]3900 if (fd >= 0)
[192]3901 {
3902 fstat_return = retry_fstat (FIL__, __LINE__, fd, &fbuf);
[251]3903
[192]3904 if (fstat_return)
[251]3905 {
3906 char * stale;
3907
3908 fstat_errno = errno;
3909
3910 stale = sl_check_stale();
3911
3912 if (stale)
3913 {
[367]3914 SH_MUTEX_LOCK(mutex_thread_nolog);
[251]3915 sh_error_handle(SH_ERR_ERR, FIL__, __LINE__, fstat_errno,
3916 MSG_E_SUBGEN,
3917 stale, _("sh_unix_getinfo_fstat"));
[367]3918 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[251]3919 }
[252]3920
3921 if (try == 0) /* obsolete, but we keep this, just in case */
3922 {
3923 ++try;
3924 sl_close(rval_open);
3925 goto try_again;
3926 }
[251]3927 }
[192]3928 }
[1]3929 else
[192]3930 {
3931 fd = -1;
3932 }
[8]3933
[1]3934
3935 /* --- case 1: lstat failed ---
3936 */
3937 if (stat_return != 0)
3938 {
3939 stat_return = errno;
3940 if (!SL_ISERROR(rval_open))
3941 sl_close(rval_open);
3942 if (sh.flag.checkSum == SH_CHECK_INIT ||
3943 (sh_hash_have_it (theFile->fullpath) >= 0 &&
[114]3944 (!SH_FFLAG_REPORTED_SET(theFile->file_reported))))
[1]3945 {
3946 if (S_FALSE == sh_ignore_chk_del(theFile->fullpath)) {
[458]3947 int flags = sh_hash_getflags (theFile->fullpath);
3948
3949 if ((flags >= 0) && (flags & SH_FFLAG_ENOENT) == 0) {
3950 char errbuf[SH_ERRBUF_SIZE];
3951 uid_t euid;
3952 (void) sl_get_euid(&euid);
3953 tmp2 = sh_util_safe_name (theFile->fullpath);
3954 SH_MUTEX_LOCK(mutex_thread_nolog);
3955 sh_error_handle (level, FIL__, __LINE__, stat_return, MSG_FI_STAT,
3956 _("lstat"),
3957 sh_error_message (stat_errno, errbuf, sizeof(errbuf)),
3958 (long) euid,
3959 tmp2);
3960 SH_MUTEX_UNLOCK(mutex_thread_nolog);
3961 SH_FREE(tmp2);
3962 sh_hash_set_flag (theFile->fullpath, SH_FFLAG_ENOENT);
3963 }
[1]3964 }
3965 }
3966 SL_RETURN((-1),_("sh_unix_getinfo"));
3967 }
3968
[8]3969 /* --- case 2: not a regular file ---
[1]3970 */
3971 else if (! S_ISREG(buf.st_mode))
3972 {
3973 if (fileHash != NULL)
[93]3974 sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
[1]3975 }
3976
3977 /* --- case 3a: a regular file, fstat ok ---
3978 */
3979 else if (fstat_return == 0 &&
3980 buf.st_mode == fbuf.st_mode &&
3981 buf.st_ino == fbuf.st_ino &&
3982 buf.st_uid == fbuf.st_uid &&
3983 buf.st_gid == fbuf.st_gid &&
3984 buf.st_dev == fbuf.st_dev )
3985 {
3986 if (fileHash != NULL)
3987 {
[310]3988 if ((theFile->check_mask & MODI_CHK) == 0 ||
3989 sh_restrict_this(theFile->fullpath, (UINT64) fbuf.st_size,
3990 (UINT64) fbuf.st_mode, rval_open))
[1]3991 {
[93]3992 sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
[1]3993 }
[381]3994 else if ((theFile->check_mask & MODI_PREL) != 0 &&
[1]3995 S_TRUE == sh_prelink_iself(rval_open, fbuf.st_size,
[102]3996 alert_timeout, theFile->fullpath))
[1]3997 {
3998 if (0 != sh_prelink_run (theFile->fullpath,
3999 fileHash, alert_timeout))
[93]4000 sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
[1]4001 }
4002 else
4003 {
[133]4004 char hashbuf[KEYBUF_SIZE];
[425]4005 UINT64 length_current = TIGER_NOLIM;
[167]4006
[170]4007 if (MODI_TXT_ENABLED(theFile->check_mask) && fbuf.st_size < (10 * SH_TXT_MAX))
[167]4008 {
4009 sl_init_content (rval_open, fbuf.st_size);
4010 }
4011
[22]4012 sl_strlcpy(fileHash,
4013 sh_tiger_generic_hash (theFile->fullpath,
[425]4014 rval_open, &length_current,
[133]4015 alert_timeout,
4016 hashbuf, sizeof(hashbuf)),
[22]4017 KEY_LEN+1);
[167]4018
4019 content = sl_get_content(rval_open);
[169]4020 content = sh_string_copy(content);
[167]4021
[19]4022 if ((theFile->check_mask & MODI_SGROW) != 0)
4023 {
[436]4024 /* Update size so it matches the one for which the checksum
4025 has been computed */
4026 fbuf.st_size = length_current;
[151]4027 buf.st_size = fbuf.st_size;
[19]4028 sl_rewind(rval_open);
[425]4029 sh_unix_checksum_size (theFile->fullpath, length_current, S_TRUE,
[19]4030 &fileHash[KEY_LEN + 1],
[133]4031 alert_timeout, rval_open);
[19]4032 }
[1]4033 }
4034 }
4035 }
4036
4037 /* --- case 3b: a regular file, fstat ok, but different ---
4038 */
4039 else if (fstat_return == 0 && S_ISREG(fbuf.st_mode))
4040 {
4041 memcpy (&buf, &fbuf, sizeof( struct stat ));
4042
4043 if (fileHash != NULL)
4044 {
[310]4045 if ((theFile->check_mask & MODI_CHK) == 0 ||
4046 sh_restrict_this(theFile->fullpath, (UINT64) fbuf.st_size,
4047 (UINT64) fbuf.st_mode, rval_open))
[1]4048 {
[93]4049 sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
[1]4050 }
4051 else if (policy == SH_LEVEL_PRELINK &&
4052 S_TRUE == sh_prelink_iself(rval_open, fbuf.st_size,
[102]4053 alert_timeout, theFile->fullpath))
[1]4054 {
4055 if (0 != sh_prelink_run (theFile->fullpath,
4056 fileHash, alert_timeout))
[93]4057 sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
[1]4058 }
4059 else
4060 {
[133]4061 char hashbuf[KEYBUF_SIZE];
[425]4062 UINT64 length_current = TIGER_NOLIM;
[167]4063
[170]4064 if (MODI_TXT_ENABLED(theFile->check_mask) && fbuf.st_size < (10 * SH_TXT_MAX))
[167]4065 {
4066 sl_init_content (rval_open, fbuf.st_size);
4067 }
4068
[1]4069 sl_strlcpy(fileHash,
[133]4070 sh_tiger_generic_hash (theFile->fullpath, rval_open,
[425]4071 &length_current,
[133]4072 alert_timeout,
4073 hashbuf, sizeof(hashbuf)),
[1]4074 KEY_LEN + 1);
[167]4075
4076 content = sl_get_content(rval_open);
[169]4077 content = sh_string_copy(content);
[167]4078
[19]4079 if ((theFile->check_mask & MODI_SGROW) != 0)
4080 {
[436]4081 /* Update size so it matches the one for which the checksum
4082 has been computed */
4083 fbuf.st_size = length_current;
[151]4084 buf.st_size = fbuf.st_size;
[19]4085 sl_rewind(rval_open);
[425]4086 sh_unix_checksum_size (theFile->fullpath, length_current, S_TRUE,
[19]4087 &fileHash[KEY_LEN + 1],
[133]4088 alert_timeout, rval_open);
[19]4089 }
[1]4090 }
4091 }
4092 }
4093
4094 /* --- case 4: a regular file, fstat failed ---
4095 */
4096
[192]4097 else /* fstat_return != 0 or !S_ISREG(fbuf.st_mode) or open() failed */
[1]4098 {
[185]4099 uid_t euid;
[192]4100
[1]4101 if (fileHash != NULL)
[93]4102 sl_strlcpy(fileHash, SH_KEY_NULL, KEY_LEN+1);
[1]4103
[65]4104 if ((theFile->check_mask & MODI_CHK) != 0)
4105 {
4106 tmp2 = sh_util_safe_name (theFile->fullpath);
[185]4107
[200]4108
4109 if (fd >= 0 && fstat_return != 0)
[185]4110 {
[192]4111 char errbuf[SH_ERRBUF_SIZE];
[185]4112 (void) sl_get_euid(&euid);
[192]4113
[367]4114 SH_MUTEX_LOCK(mutex_thread_nolog);
[192]4115 sh_error_handle (level, FIL__, __LINE__, stat_return, MSG_FI_STAT,
4116 _("fstat"),
4117 sh_error_message (fstat_errno, errbuf, sizeof(errbuf)),
4118 (long) euid,
4119 tmp2);
[367]4120 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[185]4121 }
[200]4122 else if (fd >= 0 && !S_ISREG(fbuf.st_mode))
[185]4123 {
[367]4124 SH_MUTEX_LOCK(mutex_thread_nolog);
[192]4125 sh_error_handle (level, FIL__, __LINE__, fstat_errno,
[185]4126 MSG_E_NOTREG, tmp2);
[367]4127 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[185]4128 }
4129 else
4130 {
[192]4131 char errbuf[SH_ERRBUF_SIZE];
4132 char errbuf2[SH_ERRBUF_SIZE];
4133 sl_strlcpy(errbuf, sl_error_string(rval_open), sizeof(errbuf));
4134 sh_error_message(err_open, errbuf2, sizeof(errbuf2));
[367]4135 SH_MUTEX_LOCK(mutex_thread_nolog);
[192]4136 sh_error_handle (level, FIL__, __LINE__, err_open,
4137 MSG_E_READ, errbuf, errbuf2, tmp2);
[367]4138 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[185]4139 }
[65]4140 SH_FREE(tmp2);
4141 }
[1]4142 }
4143
4144
4145 /* --- Determine file type. ---
4146 */
[149]4147 memset (theFile->c_mode, '-', CMODE_SIZE-1);
4148 theFile->c_mode[CMODE_SIZE-1] = '\0';
[8]4149
[149]4150 memset (theFile->link_c_mode, '-', CMODE_SIZE-1);
4151 theFile->link_c_mode[CMODE_SIZE-1] = '\0';
[1]4152
4153 sh_unix_getinfo_type (&buf, &type, theFile->c_mode);
4154 theFile->type = type;
4155
[10]4156#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
[1]4157
4158 /* --- Determine file attributes. ---
4159 */
[149]4160 memset (theFile->c_attributes, '-', ATTRBUF_SIZE);
4161 theFile->c_attributes[ATTRBUF_USED] = '\0';
[1]4162 theFile->attributes = 0;
4163
[279]4164#if (defined(__linux__) && (defined(HAVE_LINUX_EXT2_FS_H) || defined(HAVE_EXT2FS_EXT2_FS_H))) || defined(HAVE_STAT_FLAGS)
[1]4165 if (theFile->c_mode[0] != 'c' && theFile->c_mode[0] != 'b' &&
4166 theFile->c_mode[0] != 'l' )
4167 sh_unix_getinfo_attr(theFile->fullpath,
[10]4168 &theFile->attributes, theFile->c_attributes,
4169 fd, &buf);
[1]4170#endif
[279]4171#endif
[1]4172
[105]4173#if defined(USE_XATTR) && defined(USE_ACL)
4174 if (sh_unix_check_selinux == S_TRUE || sh_unix_check_acl == S_TRUE)
4175 theFile->attr_string = sh_unix_getinfo_xattr (theFile->fullpath, fd, &buf);
4176#elif defined(USE_XATTR)
[68]4177 if (sh_unix_check_selinux == S_TRUE)
4178 theFile->attr_string = sh_unix_getinfo_xattr (theFile->fullpath, fd, &buf);
4179#elif defined(USE_ACL)
4180 if (sh_unix_check_acl == S_TRUE)
4181 theFile->attr_string = sh_unix_getinfo_acl (theFile->fullpath, fd, &buf);
4182#else
4183 theFile->attr_string = NULL;
4184#endif
4185
[1]4186 if (!SL_ISERROR(rval_open))
4187 sl_close(rval_open);
4188
4189
4190 /* --- I/O limit. ---
4191 */
4192 if (IO_Limit > 0)
4193 {
4194 runtim = (long) (time(NULL) - sh.statistics.time_start);
4195
4196 if (runtim > 0 && (long)(sh.statistics.bytes_hashed/runtim) > IO_Limit)
4197 retry_msleep(1, 0);
4198 }
4199
4200 /* --- Determine permissions. ---
4201 */
4202 sh_unix_getinfo_mode (&buf, &mode, theFile->c_mode);
4203
4204 /* --- Trivia. ---
4205 */
4206 theFile->dev = buf.st_dev;
4207 theFile->ino = buf.st_ino;
4208 theFile->mode = buf.st_mode;
4209 theFile->hardlinks = buf.st_nlink;
4210 theFile->owner = buf.st_uid;
4211 theFile->group = buf.st_gid;
4212 theFile->rdev = buf.st_rdev;
4213 theFile->size = buf.st_size;
4214 theFile->blksize = (unsigned long) buf.st_blksize;
4215 theFile->blocks = (unsigned long) buf.st_blocks;
4216 theFile->atime = buf.st_atime;
4217 theFile->mtime = buf.st_mtime;
4218 theFile->ctime = buf.st_ctime;
4219
4220
4221 /* --- Owner and group. ---
4222 */
4223
[132]4224 if (NULL == sh_unix_getGIDname(SH_ERR_ALL, buf.st_gid, theFile->c_group, GROUP_MAX+1)) {
[1]4225
4226 tmp2 = sh_util_safe_name (theFile->fullpath);
4227
4228 if (policy == SH_LEVEL_ALLIGNORE)
4229 {
[367]4230 SH_MUTEX_LOCK(mutex_thread_nolog);
[1]4231 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, ENOENT,
4232 MSG_FI_NOGRP,
4233 (long) buf.st_gid, tmp2);
[367]4234 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[1]4235 }
4236 else
4237 {
[367]4238 SH_MUTEX_LOCK(mutex_thread_nolog);
[1]4239 sh_error_handle (ShDFLevel[SH_ERR_T_NAME], FIL__, __LINE__, ENOENT,
4240 MSG_FI_NOGRP,
4241 (long) buf.st_gid, tmp2);
[367]4242 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[1]4243 }
4244 SH_FREE(tmp2);
4245 sl_snprintf(theFile->c_group, GROUP_MAX+1, "%d", (long) buf.st_gid);
4246 }
4247
4248
[137]4249 if (NULL == sh_unix_getUIDname(SH_ERR_ALL, buf.st_uid, theFile->c_owner, USER_MAX+1)) {
[1]4250
4251 tmp2 = sh_util_safe_name (theFile->fullpath);
4252
4253 if (policy == SH_LEVEL_ALLIGNORE)
4254 {
[367]4255 SH_MUTEX_LOCK(mutex_thread_nolog);
[1]4256 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, ENOENT,
4257 MSG_FI_NOUSR,
4258 (long) buf.st_uid, tmp2);
[367]4259 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[1]4260 }
4261 else
4262 {
[367]4263 SH_MUTEX_LOCK(mutex_thread_nolog);
[1]4264 sh_error_handle (ShDFLevel[SH_ERR_T_NAME], FIL__, __LINE__, ENOENT,
4265 MSG_FI_NOUSR,
4266 (long) buf.st_uid, tmp2);
[367]4267 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[1]4268 }
4269 SH_FREE(tmp2);
4270 sl_snprintf(theFile->c_owner, USER_MAX+1, "%d", (long) buf.st_uid);
4271 }
4272
4273 /* --- Output the file. ---
4274 */
4275 if (flag_err_debug == SL_TRUE)
4276 {
4277 tmp2 = sh_util_safe_name ((filename == NULL) ?
4278 theFile->fullpath : filename);
[137]4279 (void) sh_unix_time(theFile->mtime, timestr, sizeof(timestr));
[367]4280 SH_MUTEX_LOCK(mutex_thread_nolog);
[1]4281 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_LIST,
4282 theFile->c_mode,
4283 theFile->hardlinks,
4284 theFile->c_owner,
4285 theFile->c_group,
4286 (unsigned long) theFile->size,
4287 timestr,
4288 tmp2);
[367]4289 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[1]4290 SH_FREE(tmp2);
4291 }
4292
4293 /* --- Check for links. ---
4294 */
4295 if (theFile->c_mode[0] == 'l')
4296 {
4297 linknamebuf = SH_ALLOC(PATH_MAX);
4298
[22]4299 /* flawfinder: ignore */
[1]4300 linksize = readlink (theFile->fullpath, linknamebuf, PATH_MAX-1);
4301
4302 if (linksize < (PATH_MAX-1) && linksize >= 0)
4303 linknamebuf[linksize] = '\0';
4304 else
4305 linknamebuf[PATH_MAX-1] = '\0';
4306
4307 if (linksize < 0)
4308 {
[132]4309 char errbuf[SH_ERRBUF_SIZE];
[1]4310 linksize = errno;
4311 tmp2 = sh_util_safe_name (theFile->fullpath);
[367]4312 SH_MUTEX_LOCK(mutex_thread_nolog);
[1]4313 sh_error_handle (level, FIL__, __LINE__, linksize, MSG_FI_RDLNK,
[132]4314 sh_error_message (linksize, errbuf, sizeof(errbuf)), tmp2);
[367]4315 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[1]4316 SH_FREE(tmp2);
4317 SH_FREE(linknamebuf);
[167]4318 theFile->link_path = sh_util_strdup("-");
[1]4319 SL_RETURN((-1),_("sh_unix_getinfo"));
4320 }
[138]4321
[167]4322 if (linknamebuf[0] == '/')
4323 {
4324 theFile->link_path = sh_util_strdup (linknamebuf);
4325 }
4326 else
4327 {
4328 tmp = sh_util_dirname(theFile->fullpath);
4329 if (tmp) {
4330 theFile->link_path = SH_ALLOC(PATH_MAX);
4331 sl_strlcpy (theFile->link_path, tmp, PATH_MAX);
4332 SH_FREE(tmp);
4333 } else {
4334 theFile->link_path = SH_ALLOC(PATH_MAX);
4335 theFile->link_path[0] = '\0';
4336 }
4337 /*
4338 * Only attach '/' if not root directory. Handle "//", which
4339 * according to POSIX is implementation-defined, and may be
4340 * different from "/" (however, three or more '/' will collapse
4341 * to one).
4342 */
4343 tmp = theFile->link_path; while (*tmp == '/') ++tmp;
4344 if (*tmp != '\0')
4345 {
4346 sl_strlcat (theFile->link_path, "/", PATH_MAX);
4347 }
4348 sl_strlcat (theFile->link_path, linknamebuf, PATH_MAX);
4349 }
4350
4351 /* stat the link
4352 */
4353 stat_return = retry_lstat (FIL__, __LINE__, theFile->link_path, &lbuf);
4354
4355 /* check for error
4356 */
4357 if (stat_return != 0)
4358 {
4359 stat_return = errno;
4360 tmp = sh_util_safe_name (theFile->fullpath);
4361 tmp2 = sh_util_safe_name (theFile->link_path);
4362 if (stat_return != ENOENT)
4363 {
[192]4364 uid_t euid;
[167]4365 char errbuf[SH_ERRBUF_SIZE];
[192]4366
4367 (void) sl_get_euid(&euid);
[367]4368 SH_MUTEX_LOCK(mutex_thread_nolog);
[167]4369 sh_error_handle (level, FIL__, __LINE__, stat_return,
[192]4370 MSG_FI_STAT,
[454]4371 _("lstat (link target)"),
[167]4372 sh_error_message (stat_return,errbuf, sizeof(errbuf)),
[192]4373 (long) euid,
[167]4374 tmp2);
[367]4375 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[167]4376 }
4377 else
4378 {
4379 /* a dangling link -- everybody seems to have plenty of them
4380 */
[367]4381 SH_MUTEX_LOCK(mutex_thread_nolog);
[167]4382 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_DLNK,
4383 tmp, tmp2);
[367]4384 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[167]4385 }
4386 theFile->linkisok = BAD;
[93]4387 SH_FREE(tmp);
[167]4388 SH_FREE(tmp2);
4389 SH_FREE(linknamebuf);
4390 /*
4391 * changed Tue Feb 10 16:16:13 CET 2004:
4392 * add dangling symlinks into database
4393 * SL_RETURN((-1),_("sh_unix_getinfo"));
4394 */
4395 theFile->linkmode = 0;
4396 SL_RETURN((0),_("sh_unix_getinfo"));
[93]4397 }
[1]4398
[167]4399 theFile->linkisok = GOOD;
4400
4401
4402 /* --- Determine file type. ---
4403 */
4404 sh_unix_getinfo_type (&lbuf, &type, theFile->link_c_mode);
4405 theFile->type = type;
4406
4407 /* --- Determine permissions. ---
4408 */
4409 sh_unix_getinfo_mode (&lbuf, &mode, theFile->link_c_mode);
4410 theFile->linkmode = lbuf.st_mode;
4411
4412 /* --- Output the link. ---
4413 */
4414 if (theFile->linkisok == GOOD)
4415 {
4416 tmp2 = sh_util_safe_name (linknamebuf);
[367]4417 SH_MUTEX_LOCK(mutex_thread_nolog);
[167]4418 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_LLNK,
4419 theFile->link_c_mode, tmp2);
[367]4420 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[167]4421 SH_FREE(tmp2);
4422 }
4423 SH_FREE(linknamebuf);
4424 }
[402]4425 else /* not a link, theFile->c_mode[0] != 'l' */
[167]4426 {
4427 if (content)
4428 {
[169]4429#ifdef HAVE_LIBZ
[171]4430 unsigned long clen;
4431 unsigned char * compressed;
4432#ifdef HAVE_COMPRESSBOUND
4433 clen = compressBound(sh_string_len(content));
4434#else
4435 if (sh_string_len(content) > 10*SH_TXT_MAX)
4436 clen = SH_TXT_MAX;
4437 else
4438 clen = 13 + (int)(1.0001*sh_string_len(content));
4439#endif
4440 compressed = SH_ALLOC(clen);
[169]4441 if (Z_OK == compress(compressed, &clen,
4442 (unsigned char *) sh_string_str(content),
4443 sh_string_len(content)))
4444 {
4445 if (clen < SH_TXT_MAX)
4446 {
4447 sh_util_base64_enc_alloc (&(theFile->link_path),
4448 (char *) compressed, clen);
4449 }
4450 else
4451 {
4452 char tmsg[128];
4453 char * tpath = sh_util_safe_name (theFile->fullpath);
4454 sl_snprintf(tmsg, sizeof(tmsg),
4455 _("compressed file too large (%lu bytes)"),
4456 clen);
[367]4457 SH_MUTEX_LOCK(mutex_thread_nolog);
[169]4458 sh_error_handle (SH_ERR_WARN, FIL__, __LINE__, -1,
4459 MSG_E_SUBGPATH, tmsg,
4460 _("sh_unix_getinfo"), tpath);
[367]4461 SH_MUTEX_UNLOCK(mutex_thread_nolog);
[169]4462 SH_FREE(tpath);
4463 }
4464 }
4465 SH_FREE(compressed);
4466#endif
4467 sh_string_destroy(&content);
[167]4468 }
4469 }
[1]4470 SL_RETURN((0),_("sh_unix_getinfo"));
4471}
4472
4473/* #if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE) */
4474#endif
4475
[169]4476int sh_unix_unlock(char * lockfile, char * flag)
4477{
4478 int error = 0;
4479
4480 SL_ENTER(_("sh_unix_unlock"));
[1]4481
[169]4482 if (sh.flag.isdaemon == S_FALSE && flag == NULL)
4483 SL_RETURN((0),_("sh_unix_unlock"));
4484
4485 /* --- Logfile is not locked to us. ---
4486 */
4487 if (sh.flag.islocked == BAD && flag != NULL)
4488 SL_RETURN((-1),_("sh_unix_unlock"));
4489
4490 /* --- Check whether the directory is secure. ---
4491 */
4492 if (0 != tf_trust_check (lockfile, SL_YESPRIV))
4493 SL_RETURN((-1),_("sh_unix_unlock"));
4494
4495 /* --- Delete the lock file. ---
4496 */
4497 error = retry_aud_unlink (FIL__, __LINE__, lockfile);
4498
4499 if (error == 0)
4500 {
4501 if (flag != NULL)
4502 sh.flag.islocked = BAD; /* not locked anymore */
4503 }
4504 else if (flag != NULL)
4505 {
4506 char errbuf[SH_ERRBUF_SIZE];
4507 error = errno;
4508 sh_error_handle ((-1), FIL__, __LINE__, error, MSG_E_UNLNK,
4509 sh_error_message(error, errbuf, sizeof(errbuf)),
4510 lockfile);
4511 SL_RETURN((-1),_("sh_unix_unlock"));
4512 }
4513 SL_RETURN((0),_("sh_unix_unlock"));
4514}
4515
[265]4516int sh_unix_check_piddir (char * pidpath)
[246]4517{
4518 static struct stat buf;
4519 int status = 0;
4520 char * pid_dir;
4521
4522 SL_ENTER(_("sh_unix_check_piddir"));
4523
[265]4524 pid_dir = sh_util_dirname (pidpath);
[246]4525
4526 status = retry_lstat (FIL__, __LINE__, pid_dir, &buf);
4527
4528 if (status < 0 && errno == ENOENT)
4529 {
4530 status = mkdir (pid_dir, 0777);
4531 if (status < 0)
4532 {
4533 sh_error_handle ((-1), FIL__, __LINE__, status,
4534 MSG_E_SUBGEN,
4535 _("Cannot create PID directory"),
4536 _("sh_unix_check_piddir"));
4537 SH_FREE(pid_dir);
4538 SL_RETURN((-1),_("sh_unix_check_piddir"));
4539 }
4540 }
4541 else if (!S_ISDIR(buf.st_mode))
4542 {
4543 sh_error_handle ((-1), FIL__, __LINE__, status,
4544 MSG_E_SUBGEN,
4545 _("Path of PID directory refers to a non-directory object"),
4546 _("sh_unix_check_piddir"));
4547 SH_FREE(pid_dir);
4548 SL_RETURN((-1),_("sh_unix_check_piddir"));
4549 }
4550 SH_FREE(pid_dir);
4551 SL_RETURN((0),_("sh_unix_check_piddir"));
4552}
4553
[169]4554int sh_unix_lock (char * lockfile, char * flag)
4555{
4556 int filed;
4557 int errnum;
4558 char myPid[64];
4559 SL_TICKET fd;
4560 extern int get_the_fd (SL_TICKET ticket);
4561
4562 SL_ENTER(_("sh_unix_lock"));
4563
4564 sprintf (myPid, "%ld\n", (long) sh.pid); /* known to fit */
4565
[246]4566 if (flag == NULL) /* PID file, check for directory */
4567 {
4568 if (0 != sh_unix_check_piddir (lockfile))
4569 {
4570 SL_RETURN((-1),_("sh_unix_lock"));
4571 }
4572 }
4573
[248]4574 fd = sl_open_safe_rdwr (FIL__, __LINE__,
4575 lockfile, SL_YESPRIV); /* fails if file exists */
[169]4576
4577 if (!SL_ISERROR(fd))
4578 {
4579 errnum = sl_write (fd, myPid, sl_strlen(myPid));
4580 filed = get_the_fd(fd);
4581 fchmod (filed, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
4582 sl_close (fd);
4583
4584 if (!SL_ISERROR(errnum))
4585 {
4586 if (flag != NULL)
4587 sh.flag.islocked = GOOD;
4588 SL_RETURN((0),_("sh_unix_lock"));
4589 }
4590 }
4591
4592 TPT((0, FIL__, __LINE__, _("msg=<open pid file failed>\n")));
4593 if (flag != NULL)
4594 sh.flag.islocked = BAD;
4595 SL_RETURN((-1),_("sh_unix_lock"));
4596
4597 /* notreached */
4598}
4599
4600
[1]4601/* check whether file is locked
4602 */
4603int sh_unix_test_and_lock (char * filename, char * lockfile)
4604{
4605 static struct stat buf;
4606 int status = 0;
4607
4608
4609 SL_TICKET fd;
4610 char line_in[128];
4611
4612 SL_ENTER(_("sh_unix_test_and_lock"));
4613
4614 status = retry_lstat (FIL__, __LINE__, lockfile, &buf);
4615
4616 /* --- No lock file found, try to lock. ---
4617 */
4618
4619 if (status < 0 && errno == ENOENT)
4620 {
4621 if (0 == sh_unix_lock (lockfile, filename))
4622 {
4623 if (filename != NULL)
4624 sh.flag.islocked = GOOD;
4625 SL_RETURN((0),_("sh_unix_test_and_lock"));
4626 }
[76]4627 else
4628 {
4629 sh_error_handle ((-1), FIL__, __LINE__, status,
4630 MSG_E_SUBGEN,
[246]4631 (filename == NULL) ? _("Cannot create PID file (1)") : _("Cannot create lock file (1)"),
[76]4632 _("sh_unix_test_and_lock"));
4633 SL_RETURN((-1),_("sh_unix_test_and_lock"));
4634 }
[1]4635 }
4636 else if (status == 0 && buf.st_size == 0)
4637 {
4638 if (filename != NULL)
4639 sh.flag.islocked = GOOD;
4640 sh_unix_unlock (lockfile, filename);
4641 if (filename != NULL)
4642 sh.flag.islocked = BAD;
4643 if (0 == sh_unix_lock (lockfile, filename))
4644 {
4645 if (filename != NULL)
4646 sh.flag.islocked = GOOD;
4647 SL_RETURN((0),_("sh_unix_test_and_lock"));
4648 }
4649 else
4650 {
[76]4651 sh_error_handle ((-1), FIL__, __LINE__, status,
4652 MSG_E_SUBGEN,
[246]4653 (filename == NULL) ? _("Cannot create PID file (2)") : _("Cannot create lock file (2)"),
[76]4654 _("sh_unix_test_and_lock"));
[1]4655 SL_RETURN((-1),_("sh_unix_test_and_lock"));
4656 }
4657 }
4658
4659 /* --- Check on lock. ---
4660 */
4661
4662 if (status >= 0)
4663 {
[248]4664 fd = sl_open_read (FIL__, __LINE__, lockfile, SL_YESPRIV);
[1]4665 if (SL_ISERROR(fd))
4666 sh_error_handle ((-1), FIL__, __LINE__, fd,
4667 MSG_E_SUBGEN,
4668 (filename == NULL) ? _("Cannot open PID file for read") : _("Cannot open lock file for read"),
4669 _("sh_unix_test_and_lock"));
4670 }
4671 else
4672 fd = -1;
4673
4674 if (!SL_ISERROR(fd))
4675 {
4676 /* read the PID in the lock file
4677 */
[76]4678 status = sl_read (fd, line_in, sizeof(line_in));
4679 line_in[sizeof(line_in)-1] = '\0';
[1]4680
4681 /* convert to numeric
4682 */
4683 if (status > 0)
4684 {
4685 errno = 0;
4686 status = strtol(line_in, (char **)NULL, 10);
4687 if (errno == ERANGE || status <= 0)
4688 {
4689 sh_error_handle ((-1), FIL__, __LINE__, status,
4690 MSG_E_SUBGEN,
4691 (filename == NULL) ? _("Bad PID in PID file") : _("Bad PID in lock file"),
4692 _("sh_unix_test_and_lock"));
4693
4694 status = -1;
4695 }
4696 }
4697 else
4698 {
4699 sh_error_handle ((-1), FIL__, __LINE__, status,
4700 MSG_E_SUBGEN,
4701 (filename == NULL) ? _("Cannot read PID file") : _("Cannot read lock file"),
4702 _("sh_unix_test_and_lock"));
4703 }
4704 sl_close(fd);
4705
[162]4706 if (status > 0 && (unsigned int) status == sh.pid)
[1]4707 {
4708 if (filename != NULL)
4709 sh.flag.islocked = GOOD;
4710 SL_RETURN((0),_("sh_unix_test_and_lock"));
4711 }
4712
4713
4714 /* --- Check whether the process exists. ---
4715 */
4716 if (status > 0)
4717 {
4718 errno = 0;
4719 status = aud_kill (FIL__, __LINE__, status, 0);
4720
4721 /* Does not exist, so remove the stale lock
4722 * and create a new one.
4723 */
4724 if (status < 0 && errno == ESRCH)
4725 {
4726 if (filename != NULL)
4727 sh.flag.islocked = GOOD;
4728 if (0 != sh_unix_unlock(lockfile, filename) && (filename !=NULL))
4729 sh.flag.islocked = BAD;
4730 else
4731 {
4732 if (0 == sh_unix_lock (lockfile, filename))
4733 {
4734 if (filename != NULL)
4735 sh.flag.islocked = GOOD;
4736 SL_RETURN((0),_("sh_unix_test_and_lock"));
4737 }
4738 else
4739 {
4740 sh_error_handle ((-1), FIL__, __LINE__, status,
4741 MSG_E_SUBGEN,
[246]4742 (filename == NULL) ? _("Cannot create PID file (3)") : _("Cannot create lock file (3)"),
[1]4743 _("sh_unix_test_and_lock"));
4744 }
4745 if (filename != NULL)
4746 sh.flag.islocked = BAD;
4747 }
4748 }
4749 else
4750 {
4751 sh_error_handle ((-1), FIL__, __LINE__, status,
4752 MSG_E_SUBGEN,
4753 (filename == NULL) ? _("Cannot remove stale PID file, PID may be a running process") : _("Cannot remove stale lock file, PID may be a running process"),
4754 _("sh_unix_test_and_lock"));
4755 if (filename != NULL)
4756 sh.flag.islocked = BAD;
4757 }
4758 }
4759 }
4760 SL_RETURN((-1),_("sh_unix_testlock"));
4761}
4762
4763/* write the PID file
4764 */
4765int sh_unix_write_pid_file()
4766{
4767 return sh_unix_test_and_lock(NULL, sh.srvlog.alt);
4768}
4769
4770/* write lock for filename
4771 */
4772int sh_unix_write_lock_file(char * filename)
4773{
[34]4774 size_t len;
4775 int res;
[1]4776 char * lockfile;
4777
4778 if (filename == NULL)
4779 return (-1);
4780
[34]4781 len = sl_strlen(filename);
4782 if (sl_ok_adds(len, 6))
4783 len += 6;
4784 lockfile = SH_ALLOC(len);
4785 sl_strlcpy(lockfile, filename, len);
4786 sl_strlcat(lockfile, _(".lock"), len);
4787 res = sh_unix_test_and_lock(filename, lockfile);
[1]4788 SH_FREE(lockfile);
[34]4789 return res;
[1]4790}
4791
4792/* rm lock for filename
4793 */
4794int sh_unix_rm_lock_file(char * filename)
4795{
[34]4796 size_t len;
4797 int res;
[1]4798 char * lockfile;
4799
4800 if (filename == NULL)
4801 return (-1);
4802
[34]4803 len = sl_strlen(filename);
4804 if (sl_ok_adds(len, 6))
4805 len += 6;
4806 lockfile = SH_ALLOC(len);
4807 sl_strlcpy(lockfile, filename, len);
4808 sl_strlcat(lockfile, _(".lock"), len);
4809
4810 res = sh_unix_unlock(lockfile, filename);
[1]4811 SH_FREE(lockfile);
[34]4812 return res;
[1]4813}
4814
4815/* rm lock for filename
4816 */
4817int sh_unix_rm_pid_file()
4818{
4819 return sh_unix_unlock(sh.srvlog.alt, NULL);
4820}
4821
4822/* Test whether file exists
4823 */
[78]4824int sh_unix_file_exists(char * path)
[1]4825{
4826 struct stat buf;
4827
[78]4828 SL_ENTER(_("sh_unix_file_exists"));
[1]4829
[221]4830 if (0 == retry_lstat(FIL__, __LINE__, path, &buf))
4831 SL_RETURN( S_TRUE, _("sh_unix_file_exists"));
[1]4832 else
[221]4833 SL_RETURN( S_FALSE, _("sh_unix_file_exists"));
[1]4834}
4835
4836
[78]4837/* Test whether file exists, is a character device, and allows read
4838 * access.
[1]4839 */
[78]4840int sh_unix_device_readable(int fd)
[1]4841{
4842 struct stat buf;
4843
[78]4844 SL_ENTER(_("sh_unix_device_readable"));
[1]4845
4846 if (retry_fstat(FIL__, __LINE__, fd, &buf) == -1)
[78]4847 SL_RETURN( (-1), _("sh_unix_device_readable"));
4848 else if ( S_ISCHR(buf.st_mode) && 0 != (S_IROTH & buf.st_mode) )
4849 SL_RETURN( (0), _("sh_unix_device_readable"));
[1]4850 else
[78]4851 SL_RETURN( (-1), _("sh_unix_device_readable"));
[1]4852}
4853
4854static char preq[16];
4855
4856/* return true if database is remote
4857 */
4858int file_is_remote ()
4859{
4860 static int init = 0;
[42]4861 struct stat buf;
[1]4862
4863 SL_ENTER(_("file_is_remote"));
4864
4865 if (init == 0)
4866 {
4867 sl_strlcpy(preq, _("REQ_FROM_SERVER"), 16);
4868 ++init;
4869 }
4870 if (0 == sl_strncmp (sh.data.path, preq, 15))
4871 {
[42]4872 if (sh.data.path[15] != '\0') /* should be start of path */
4873 {
4874 if (0 == stat(&(sh.data.path[15]), &buf))
4875 {
4876 SL_RETURN( S_FALSE, _("file_is_remote"));
4877 }
[460]4878 else
4879 {
4880 char * tmp = sh_util_safe_name (&(sh.data.path[15]));
4881 sh_error_handle((-1), FIL__, __LINE__, S_FALSE, MSG_E_SUBGPATH,
4882 _("No local baseline database at expected path"),
4883 _("file_is_remote"),
4884 tmp);
4885 SH_FREE(tmp);
4886 }
[42]4887 }
[460]4888 else
4889 {
4890 sh_error_handle((-1), FIL__, __LINE__, S_FALSE, MSG_E_SUBGEN,
4891 _("No local baseline database path known"),
4892 _("file_is_remote"));
4893 }
[1]4894 SL_RETURN( S_TRUE, _("file_is_remote"));
4895 }
4896 SL_RETURN( S_FALSE, _("file_is_remote"));
4897}
4898
4899/* Return the path to the configuration/database file.
4900 */
4901char * file_path(char what, char flag)
4902{
4903 static int init = 0;
4904
4905 SL_ENTER(_("file_path"));
4906
4907 if (init == 0)
4908 {
4909 sl_strlcpy(preq, _("REQ_FROM_SERVER"), 16);
4910 ++init;
4911 }
4912
4913 switch (what)
4914 {
4915
4916 case 'C':
4917 if (0 == sl_strncmp (sh.conf.path, preq, 15))
4918 {
4919#if defined(SH_WITH_SERVER)
4920 if (sh.flag.isserver == S_TRUE && sl_strlen(sh.conf.path) == 15)
4921 SL_RETURN( NULL, _("file_path"));
4922 if (sh.flag.isserver == S_TRUE)
4923 SL_RETURN( &(sh.conf.path[15]), _("file_path"));
4924#endif
4925 if (flag == 'R')
4926 SL_RETURN( preq, _("file_path"));
4927 if (flag == 'I')
4928 {
4929 if (sl_strlen(sh.conf.path) == 15)
4930 SL_RETURN( NULL, _("file_path"));
4931 else
4932 SL_RETURN( &(sh.conf.path[15]), _("file_path"));
4933 }
4934 SL_RETURN ( preq, _("file_path"));
4935 }
4936 else
4937 SL_RETURN( sh.conf.path, _("file_path"));
4938 /* break; *//* unreachable */
4939
4940 case 'D':
4941 if (0 == sl_strncmp (sh.data.path, preq, 15))
4942 {
4943 if (flag == 'R')
4944 SL_RETURN( preq, _("file_path"));
4945 if (flag == 'W' && sl_strlen(sh.data.path) == 15)
4946 SL_RETURN (NULL, _("file_path"));
4947 if (flag == 'W')
4948 SL_RETURN( &(sh.data.path[15]), _("file_path"));
4949 }
4950 else
4951 SL_RETURN( sh.data.path, _("file_path"));
4952 break;
4953
4954 default:
4955 SL_RETURN( NULL, _("file_path"));
4956 }
4957
4958 return NULL; /* notreached */
4959}
4960/************************************************/
4961/**** Mlock Utilities ****/
4962/************************************************/
4963
4964#include <limits.h>
4965
4966int sh_unix_pagesize()
4967{
4968 int pagesize = 4096;
4969#if defined(_SC_PAGESIZE)
4970 pagesize = sysconf(_SC_PAGESIZE);
4971#elif defined(_SC_PAGE_SIZE)
4972 pagesize = sysconf(_SC_PAGE_SIZE);
4973#elif defined(HAVE_GETPAGESIZE)
4974 pagesize = getpagesize();
4975#elif defined(PAGESIZE)
4976 pagesize = PAGESIZE;
4977#endif
4978
4979 return ((pagesize > 0) ? pagesize : 4096);
4980}
4981
4982typedef struct sh_page_lt {
4983 unsigned long page_start;
4984 int page_refcount;
[19]4985 char file[64];
4986 int line;
[1]4987 struct sh_page_lt * next;
4988} sh_page_l;
4989
4990sh_page_l * sh_page_locked = NULL;
4991volatile int page_locking = 0;
4992
4993unsigned long sh_unix_lookup_page (void * in_addr, size_t len, int * num_pages)
4994{
4995 int pagesize = sh_unix_pagesize();
4996 unsigned long addr = (unsigned long) in_addr;
4997
4998 unsigned long pagebase;
4999 unsigned long pagediff;
5000 unsigned long pagenum = addr / pagesize;
5001
5002 SL_ENTER(_("sh_unix_lookup_page"));
5003#if 0
5004 fprintf(stderr, "mlock: --> base %ld, pagenum: %ld\n",
5005 addr, pagenum);
5006#endif
5007
5008 /* address of first page
5009 */
5010 pagebase = pagenum * pagesize;
5011
5012 /* number of pages
5013 */
5014 pagediff = (addr + len) - pagebase;
5015 pagenum = pagediff / pagesize;
5016 if (pagenum * pagesize < pagediff)
5017 ++pagenum;
5018
5019#if 0
5020 fprintf(stderr, "mlock: --> pagebase %ld, pagediff %ld, (addr + len) %ld\n",
5021 pagebase, pagediff, (addr + len));
5022#endif
5023
5024 *num_pages = pagenum;
5025 SL_RETURN((pagebase), _("sh_unix_lookup_page"));
5026}
5027
5028
5029#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
[134]5030
5031SH_MUTEX_STATIC(mutex_mlock,PTHREAD_MUTEX_INITIALIZER);
5032
[170]5033int sh_unix_mlock (const char * file, int line, void * in_addr, size_t len)
[1]5034{
5035 int num_pages;
5036 int status = 0;
5037 int pagesize;
[253]5038 sh_page_l * page_list;
[1]5039 unsigned long addr;
5040#ifdef TEST_MLOCK
5041 int i = 0;
5042#endif
5043
5044 SL_ENTER(_("sh_unix_mlock"));
5045
[134]5046 /* There's no cancellation point here, except if tracing is on
5047 */
5048 SH_MUTEX_LOCK_UNSAFE(mutex_mlock);
5049
[253]5050 page_list = sh_page_locked;
5051
[1]5052 if (0 != page_locking)
5053 {
[143]5054 status = -1;
5055 goto exit_mlock;
[1]5056 }
[134]5057
[1]5058 page_locking = 1;
5059
5060 pagesize = sh_unix_pagesize();
5061 addr = sh_unix_lookup_page (in_addr, len, &num_pages);
5062
5063#ifdef TEST_MLOCK
5064 fprintf(stderr, "mlock: addr %ld, base %ld, pages: %d, length %d\n",
5065 (unsigned long) in_addr, addr, num_pages, len);
5066#endif
5067
5068 /* increase refcount of locked pages
5069 * addr is first page; num_pages is #(consecutive pages) to lock
5070 */
[134]5071
[1]5072 while ((page_list != NULL) && (num_pages > 0))
5073 {
5074#ifdef TEST_MLOCK
5075 fprintf(stderr, "mlock: check page %d: %ld [%d]\n",
5076 i, page_list->page_start, page_list->page_refcount);
5077#endif
5078 if (page_list->page_start == addr)
5079 {
5080 page_list->page_refcount += 1;
5081 num_pages -= 1;
5082 addr += pagesize;
5083#ifdef TEST_MLOCK
5084 fprintf(stderr, "mlock: found page %d: %ld [%d], next page %ld\n",
5085 i, page_list->page_start, page_list->page_refcount, addr);
5086#endif
5087 }
5088#ifdef TEST_MLOCK
5089 ++i;
5090#endif
5091 page_list = page_list->next;
5092 }
5093
5094 /* mlock some more pages, if needed
5095 */
5096 while (num_pages > 0)
5097 {
5098#ifdef TEST_MLOCK
5099 fprintf(stderr, "mlock: lock page %d: mlock %ld [num_pages %d]\n",
5100 i, addr, num_pages);
5101 ++i;
5102#endif
5103 page_list = SH_ALLOC(sizeof(sh_page_l));
5104 page_list->page_start = addr;
5105 page_list->page_refcount = 1;
[19]5106 sl_strlcpy(page_list->file, file, 64);
5107 page_list->line = line;
[1]5108 status = mlock( (void *) addr, pagesize);
5109 if (status != 0)
5110 {
5111#ifdef TEST_MLOCK
[132]5112 char errbuf[SH_ERRBUF_SIZE];
5113 fprintf(stderr, "mlock: error: %s\n",
5114 sh_error_message(errno, errbuf, sizeof(errbuf)));
[1]5115#endif
5116 SH_FREE(page_list);
5117 page_locking = 0;
[143]5118 goto exit_mlock;
[1]5119 }
5120 page_list->next = sh_page_locked;
5121 sh_page_locked = page_list;
5122 num_pages -= 1;
5123 addr += pagesize;
5124 }
[134]5125 page_locking = 0;
[143]5126
5127 exit_mlock:
[134]5128 SH_MUTEX_UNLOCK_UNSAFE(mutex_mlock);
[1]5129
5130 SL_RETURN((status), _("sh_unix_mlock"));
5131}
5132#else
[175]5133int sh_unix_mlock (const char * file, int line, void * in_addr, size_t len)
[1]5134{
[49]5135 (void) file; (void) line;
[1]5136 (void) in_addr; (void) len;
5137 return -1;
5138}
5139#endif
5140
5141#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
5142int sh_unix_munlock (void * in_addr, size_t len)
5143{
5144 int num_pages;
[253]5145 int unlocked;
5146 int status;
[1]5147 int pagesize;
[253]5148 sh_page_l * page_list;
[1]5149 sh_page_l * page_last;
5150 unsigned long addr;
5151
5152 int test_count;
5153 int test_status;
5154 int test_pages;
5155
5156#ifdef TEST_MLOCK
5157 int i = 0;
5158#endif
5159
5160 SL_ENTER(_("sh_unix_munlock"));
5161
[134]5162 /* There's no cancellation point here, except if tracing is on
5163 */
5164 SH_MUTEX_LOCK_UNSAFE(mutex_mlock);
5165
[253]5166 unlocked = 0;
5167 status = 0;
5168 page_list = sh_page_locked;
5169
[1]5170 if (0 != page_locking)
5171 {
[143]5172 status = -1;
5173 goto exit_munlock;
[1]5174 }
5175 page_locking = 1;
5176
5177 pagesize = sh_unix_pagesize();
5178 addr = sh_unix_lookup_page (in_addr, len, &num_pages);
5179
5180#ifdef TEST_MLOCK
5181 fprintf(stderr, "munlock: in_addr %ld, addr %ld, pages: %d, length %d\n",
5182 (unsigned long) in_addr, addr, num_pages, len);
5183#endif
5184
5185 test_pages = num_pages;
5186
5187 /* reduce refcount of locked pages
5188 * addr is first page; num_pages is #(consecutive pages) to lock
5189 */
5190 while ((page_list != NULL) && (num_pages > 0))
5191 {
5192#ifdef TEST_MLOCK
5193 fprintf(stderr, "munlock: page %d: %ld [%d]\n",
5194 i, page_list->page_start, page_list->page_refcount);
5195#endif
5196
5197 test_status = 0;
5198 for (test_count = 0; test_count < test_pages; ++test_count)
5199 {
5200 if (page_list->page_start == (addr + (test_count * pagesize)))
5201 {
5202 test_status = 1;
5203 break;
5204 }
5205 }
5206
5207 if (test_status == 1)
5208 {
5209 page_list->page_refcount -= 1;
5210 if (page_list->page_refcount == 0)
5211 {
5212 status = munlock ( (void *) addr, pagesize);
5213 ++unlocked;
5214 }
5215 num_pages -= 1;
5216#ifdef TEST_MLOCK
5217 fprintf(stderr,
5218 "munlock: page %d: %ld [refcount %d], refcount reduced\n",
5219 i, page_list->page_start, page_list->page_refcount);
5220#endif
5221 }
5222#ifdef TEST_MLOCK
5223 ++i;
5224#endif
5225 page_list = page_list->next;
5226 }
5227
5228#ifdef TEST_MLOCK
5229 i = 0;
5230#endif
5231
5232 if (unlocked > 0)
5233 {
5234 page_list = sh_page_locked;
5235 page_last = sh_page_locked;
5236
5237 while ((page_list != NULL) && (unlocked > 0))
5238 {
5239 if (page_list->page_refcount == 0)
5240 {
5241#ifdef TEST_MLOCK
5242 fprintf(stderr, "munlock: remove page %d: %ld [refcount %d]\n",
5243 i, page_list->page_start, page_list->page_refcount);
5244#endif
5245 if (page_last != page_list)
5246 {
5247 page_last->next = page_list->next;
5248 SH_FREE(page_list);
5249 page_list = page_last->next;
5250 }
5251 else
5252 {
5253 page_last = page_list->next;
5254 if (page_list == sh_page_locked)
5255 sh_page_locked = page_list->next;
5256 SH_FREE(page_list);
5257 page_list = page_last;
5258 }
5259 --unlocked;
5260 }
5261 else
5262 {
5263#ifdef TEST_MLOCK
5264 fprintf(stderr, "munlock: skip page %d: %ld [refcount %d]\n",
5265 i, page_list->page_start, page_list->page_refcount);
5266#endif
5267
5268 page_last = page_list;
5269 page_list = page_list->next;
5270 }
5271#ifdef TEST_MLOCK
5272 ++i;
5273#endif
5274 }
5275 }
5276
5277 page_locking = 0;
[143]5278
5279 exit_munlock:
[134]5280 SH_MUTEX_UNLOCK_UNSAFE(mutex_mlock);
[1]5281 SL_RETURN((status), _("sh_unix_munlock"));
5282}
5283#else
5284int sh_unix_munlock (void * in_addr, size_t len)
5285{
5286 (void) in_addr; (void) len;
5287 return -1;
5288}
5289#endif
5290
5291int sh_unix_count_mlock()
5292{
5293 int i = 0;
[253]5294 char str[32][64];
5295 sh_page_l * page_list;
[1]5296
5297 SL_ENTER(_("sh_unix_count_mlock"));
[253]5298
[263]5299#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
[253]5300 /* There's no cancellation point here, except if tracing is on
5301 */
5302 SH_MUTEX_LOCK_UNSAFE(mutex_mlock);
[263]5303#endif
[253]5304
5305 page_list = sh_page_locked;
5306
[1]5307 while (page_list != NULL)
5308 {
[19]5309#ifdef WITH_TPT
[253]5310 if (i < 32)
5311 sl_snprintf(str[i], 64, _("file: %s line: %d page: %d"),
5312 page_list->file, page_list->line, i+1);
[19]5313#endif
[1]5314 page_list = page_list->next;
5315 ++i;
5316 }
[253]5317
[263]5318#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
[253]5319 SH_MUTEX_UNLOCK_UNSAFE(mutex_mlock);
[263]5320#endif
[253]5321
5322#ifdef WITH_TPT
5323 {
5324 int j = 0;
5325 while (j < i && j < 32)
5326 {
5327 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, j, MSG_E_SUBGEN,
5328 str[j], _("sh_unix_count_mlock"));
5329 ++j;
5330 }
5331 }
5332#endif
5333
5334 sl_snprintf(str[0], 64, _("%d pages locked"), i);
[1]5335 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, i, MSG_E_SUBGEN,
[253]5336 str[0], _("sh_unix_count_mlock"));
[1]5337 SL_RETURN((i), _("sh_unix_count_mlock"));
5338}
5339
5340/************************************************/
5341/************************************************/
5342/**** Stealth Utilities ****/
5343/************************************************/
5344/************************************************/
5345#ifdef SH_STEALTH
5346
5347void sh_unix_xor_code (char * str, int len)
5348{
5349 register int i;
5350
5351 for (i = 0; i < len; ++i) str[i] ^= (char) XOR_CODE;
5352 return;
5353}
5354
5355#if !defined(SH_STEALTH_MICRO)
5356
5357
[89]5358int hideout_hex_block(SL_TICKET fd, unsigned char * str, int len,
5359 unsigned long * bytes_read);
[1]5360unsigned long first_hex_block(SL_TICKET fd, unsigned long * max);
5361
5362/*
5363 * --- Get hidden data from a block of hex data. ---
5364 */
5365int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len)
5366{
[89]5367 int add_off = 0, llen;
5368 static unsigned long off_data = 0;
5369 static unsigned long max_data = 0;
5370 static unsigned long bytes_read = 0;
[52]5371 static int stealth_init = BAD;
[1]5372
5373 SL_ENTER(_("sh_unix_getline_stealth"));
5374
[194]5375 if (str == NULL)
5376 {
5377 off_data = 0;
5378 max_data = 0;
5379 bytes_read = 0;
5380 stealth_init = BAD;
5381 SL_RETURN(0, _("sh_unix_getline_stealth"));
5382 }
[34]5383
[1]5384 /* --- Initialize. ---
5385 */
5386 if (stealth_init == BAD)
5387 {
5388 off_data = first_hex_block(fd, &max_data);
5389 if (off_data == 0)
5390 {
5391 dlog(1, FIL__, __LINE__,
5392 _("The stealth config file does not contain any steganographically\nhidden data. This file must be an image file in _uncompressed_\npostscript format.\nTo hide data in it, use:\n samhain_stealth -s postscript_file orig_config_file\n mv postscript_file /path/to/config/file\n"));
5393 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_P_NODATA,
5394 _("Stealth config file."));
5395 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
5396 }
5397 stealth_init = GOOD;
[52]5398 max_data += off_data;
[1]5399 }
5400
5401 /* --- Seek to proper position. ---
5402 */
[89]5403 if (bytes_read >= max_data || add_off < 0)
[52]5404 {
5405 dlog(1, FIL__, __LINE__,
5406 _("The capacity of the container image file for the stealth config file seems to be too small. Your config file is likely truncated.\n"));
5407 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_P_NODATA,
5408 _("Stealth config file."));
5409 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
5410 }
[1]5411 sl_seek(fd, off_data);
5412
5413 /* --- Read one line. ---
5414 */
[89]5415 add_off = hideout_hex_block(fd, (unsigned char *) str, len, &bytes_read);
[1]5416 off_data += add_off;
5417
5418 llen = sl_strlen(str);
5419 SL_RETURN(llen, _("sh_unix_getline_stealth"));
5420}
5421
[89]5422int hideout_hex_block(SL_TICKET fd, unsigned char * str, int len,
5423 unsigned long * bytes_read)
[1]5424{
5425
5426 register int i, j, k;
5427 unsigned char c, e;
5428 register int num;
5429 unsigned char mask[9] = { 0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01 };
5430 unsigned long here = 0;
5431 unsigned long retval = 0;
[89]5432 unsigned long bread = 0;
[1]5433
5434 SL_ENTER(_("hideout_hex_block"));
5435
[34]5436 ASSERT_RET((len > 1), _("len > 1"), (0));
5437
5438 --len;
5439
[1]5440 i = 0;
5441 while (i < len)
5442 {
5443 for (j = 0; j < 8; ++j)
5444 {
5445
5446 /* --- Get a low byte, modify, read back. ---
5447 */
5448 for (k = 0; k < 2; ++k)
5449 {
5450 /* -- Skip whitespace. ---
5451 */
5452 c = ' ';
5453 do {
5454 do {
5455 num = sl_read (fd, &c, 1);
5456 } while (num == 0 && errno == EINTR);
[89]5457 if (num > 0)
5458 ++here;
5459 else if (num == 0)
[34]5460 SL_RETURN((0), _("hideout_hex_block"));
[89]5461 else
5462 SL_RETURN((-1), _("hideout_hex_block"));
[1]5463 } while (c == '\n' || c == '\t' || c == '\r' ||
5464 c == ' ');
5465 }
5466
5467
5468 /* --- e is the value of the low byte. ---
5469 */
5470 e = (unsigned char) sh_util_hexchar( c );
5471 if ((e & mask[7]) != 0) /* bit is set */
5472 str[i] |= mask[j];
5473 else /* bit is not set */
5474 str[i] &= ~mask[j];
5475
[89]5476 bread += 1;
[1]5477 }
5478 if (str[i] == '\n') break;
5479 ++i;
5480 }
5481
5482 if (i != 0)
5483 str[i] = '\0';
5484 else
[34]5485 str[i+1] = '\0'; /* keep newline and terminate */
[1]5486 retval += here;
[89]5487 *bytes_read += (bread/8);
[1]5488
5489 SL_RETURN(retval, _("hideout_hex_block"));
5490}
5491
5492/* --- Get offset of first data block. ---
5493 */
5494unsigned long first_hex_block(SL_TICKET fd, unsigned long * max)
5495{
[34]5496 unsigned int i;
5497 long num = 1;
5498 unsigned long lnum;
[1]5499 char c;
5500 int nothex = 0;
5501 unsigned long retval = 0;
[34]5502 unsigned int this_line = 0;
[1]5503 char theline[SH_BUFSIZE];
5504
5505 SL_ENTER(_("first_hex_block"));
5506
5507 *max = 0;
5508
5509 while (1)
5510 {
5511 theline[0] = '\0';
5512 this_line = 0;
5513 c = '\0';
[34]5514 while (c != '\n' && num > 0 && this_line < (sizeof(theline)-1))
[1]5515 {
5516 do {
5517 num = sl_read (fd, &c, 1);
5518 } while (num == 0 && errno == EINTR);
5519 if (num > 0)
5520 theline[this_line] = c;
5521 else
5522 SL_RETURN((0), _("first_hex_block"));
[34]5523 ++this_line;
[1]5524 }
5525 theline[this_line] = '\0';
5526
5527 /* not only 'newline' */
5528 if (this_line > 60)
5529 {
5530 nothex = 0;
5531 i = 0;
5532 while (nothex == 0 && i < (this_line-1))
5533 {
5534 if (! isxdigit((int)theline[i])) nothex = 1;
5535 ++i;
5536 }
5537 if (nothex == 1) retval += this_line;
5538 }
5539 else
5540 {
5541 nothex = 1;
5542 retval += this_line;
5543 }
5544
5545 if (nothex == 0)
5546 {
5547 *max = 0;
5548 do {
5549 do {
5550 num = sl_read (fd, theline, SH_BUFSIZE);
5551 } while (num == 0 && errno == EINTR);
[34]5552 if (num > 0)
5553 {
5554 lnum = (unsigned long) num;
5555 for (i = 0; i < lnum; ++i)
5556 {
5557 c = theline[i];
5558 if (c == '\n' || c == '\t' || c == '\r' || c == ' ')
5559 ;
5560 else if (!isxdigit((int)c))
5561 break;
5562 else
5563 *max += 1;
5564 }
[1]5565 }
5566 } while (num > 0);
5567
5568 *max /= 16;
5569 SL_RETURN((retval), _("first_hex_block"));
5570 }
5571
5572 }
5573 /* SL_RETURN((0), _("first_hex_block")); *//* unreachable */
5574}
5575
5576 /* if !defined(SH_STEALTH_MICRO) */
5577#endif
5578
5579 /* ifdef SH_STEALTH */
5580#endif
5581
5582/*
5583 * anti-debugger code
5584 */
5585#if defined(SCREW_IT_UP)
[408]5586
5587#if defined(HAVE_PTHREAD)
5588
[411]5589static pthread_key_t gSigtrapVariables_key;
5590static pthread_once_t gSigtrapVariables_key_once = PTHREAD_ONCE_INIT;
[408]5591
[411]5592static inline void make_gSigtrapVariables_key()
[408]5593{
[411]5594 (void) pthread_key_create(&gSigtrapVariables_key, free);
[408]5595}
5596
[411]5597struct sh_sigtrap_variables * sh_sigtrap_variables_get()
[408]5598{
5599 void * ptr;
5600
[411]5601 (void) pthread_once(&gSigtrapVariables_key_once, make_gSigtrapVariables_key);
[408]5602
[411]5603 ptr = pthread_getspecific(gSigtrapVariables_key);
5604 if (ptr == NULL) {
[454]5605 ptr = calloc(1,sizeof(struct sh_sigtrap_variables));
[411]5606 if (ptr == NULL) {
5607 return NULL;
[408]5608 }
[411]5609 (void) pthread_setspecific(gSigtrapVariables_key, ptr);
5610 }
[408]5611
[411]5612 return (struct sh_sigtrap_variables *) ptr;
[408]5613}
5614
5615/* !defined(HAVE_PTHREAD) */
5616#else
5617
[411]5618static struct sh_sigtrap_variables global_sigtrap_variables;
5619struct sh_sigtrap_variables * sh_sigtrap_variables_get()
[408]5620{
[411]5621 return &global_sigtrap_variables;
[408]5622}
[411]5623
[1]5624#endif
5625
[411]5626int sh_sigtrap_max_duration_set (const char * str)
[409]5627{
[411]5628 /* For security (prevent reloading with larger value)
5629 * this value can only be set once.
5630 */
5631 static int once = 0;
5632 int i;
[409]5633
[411]5634 SL_ENTER(_("sh_sigtrap_max_duration_set"));
[408]5635
[411]5636 i = atoi (str);
[409]5637
[411]5638 if (i >= 0 && once == 0)
5639 {
5640 sh.sigtrap_max_duration = i;
5641 once = 1;
5642 }
5643 else
5644 {
5645 SL_RETURN ((-1), _("sh_sigtrap_max_duration_set"));
5646 }
5647 SL_RETURN( (0), _("sh_sigtrap_max_duration_set"));
5648}
5649
[1]5650void sh_sigtrap_handler (int signum)
5651{
[411]5652 struct sh_sigtrap_variables * sigtrap_variables;
5653 sigtrap_variables = sh_sigtrap_variables_get();
5654 if (sigtrap_variables == NULL) {
5655 /* Perhaps, it's better to not die, and to continue using Samhain,
5656 even if this part does not work. */
5657 return;
5658 }
5659
[1]5660#ifdef HAVE_GETTIMEOFDAY
[411]5661 {
5662 struct timeval tv;
5663 long difftv;
5664
5665 gettimeofday(&tv, NULL);
5666 difftv = (tv.tv_sec - sigtrap_variables->save_tv.tv_sec) * 1000000 +
5667 (tv.tv_usec - sigtrap_variables->save_tv.tv_usec);
5668 if (difftv > sh.sigtrap_max_duration)
5669 raise(SIGKILL);
5670 }
5671#endif
[408]5672
[411]5673 sigtrap_variables->not_traced = signum;
[1]5674 return;
5675}
5676#endif
Note: See TracBrowser for help on using the repository browser.