source: trunk/src/sh_unix.c@ 36

Last change on this file since 36 was 34, checked in by rainer, 19 years ago

Code cleanup and minor fixes
File size: 97.9 KB
Line 
1/* SAMHAIN file system integrity testing */
2/* Copyright (C) 1999 Rainer Wichmann */
3/* */
4/* This program is free software; you can redistribute it */
5/* and/or modify */
6/* it under the terms of the GNU General Public License as */
7/* published by */
8/* the Free Software Foundation; either version 2 of the License, or */
9/* (at your option) any later version. */
10/* */
11/* This program is distributed in the hope that it will be useful, */
12/* but WITHOUT ANY WARRANTY; without even the implied warranty of */
13/* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the */
14/* GNU General Public License for more details. */
15/* */
16/* You should have received a copy of the GNU General Public License */
17/* along with this program; if not, write to the Free Software */
18/* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. */
19
20#include "config_xor.h"
21
22
23#include <stdio.h>
24#include <stdlib.h>
25#include <string.h>
26#include <ctype.h>
27
28
29#ifdef HAVE_MEMORY_H
30#include <memory.h>
31#endif
32
33#ifdef HAVE_UNISTD_H
34#include <errno.h>
35#include <signal.h>
36#include <pwd.h>
37#include <grp.h>
38#include <sys/types.h>
39#include <sys/stat.h>
40#include <sys/resource.h>
41#include <fcntl.h>
42#include <unistd.h>
43#include <sys/wait.h>
44
45/*********************
46#ifdef HAVE_SYS_VFS_H
47#include <sys/vfs.h>
48#endif
49**********************/
50#endif
51
52#if TIME_WITH_SYS_TIME
53#include <sys/time.h>
54#include <time.h>
55#else
56#if HAVE_SYS_TIME_H
57#include <sys/time.h>
58#else
59#include <time.h>
60#endif
61#endif
62
63#ifdef HAVE_SYS_SELECT_H
64#include <sys/select.h>
65#endif
66
67#ifndef FD_SET
68#define NFDBITS 32
69#define FD_SET(n, p) ((p)->fds_bits[(n)/NFDBITS] |= (1 << ((n) % NFDBITS)))
70#define FD_CLR(n, p) ((p)->fds_bits[(n)/NFDBITS] &= ~(1 << ((n) % NFDBITS)))
71#define FD_ISSET(n, p) ((p)->fds_bits[(n)/NFDBITS] & (1 << ((n) % NFDBITS)))
72#endif /* !FD_SET */
73#ifndef FD_SETSIZE
74#define FD_SETSIZE 32
75#endif
76#ifndef FD_ZERO
77#define FD_ZERO(p) memset((char *)(p), '\0', sizeof(*(p)))
78#endif
79
80
81#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
82#include <sys/mman.h>
83#endif
84
85#include "samhain.h"
86#include "sh_error.h"
87#include "sh_unix.h"
88#include "sh_utils.h"
89#include "sh_mem.h"
90#include "sh_hash.h"
91#include "sh_tools.h"
92#include "sh_tiger.h"
93#include "sh_prelink.h"
94
95/* moved here from far below
96 */
97#include <netdb.h>
98
99#define SH_NEED_PWD_GRP
100#define SH_NEED_GETHOSTBYXXX
101#include "sh_static.h"
102
103#ifndef HAVE_LSTAT
104#define lstat stat
105#endif
106
107#if defined(S_IFLNK) && !defined(S_ISLNK)
108#define S_ISLNK(mode) (((mode) & S_IFMT) == S_IFLNK)
109#else
110#if !defined(S_ISLNK)
111#define S_ISLNK(mode) (0)
112#endif
113#endif
114
115#if defined(S_IFSOCK) && !defined(S_ISSOCK)
116#define S_ISSOCK(mode) (((mode) & S_IFMT) == S_IFSOCK)
117#else
118#if !defined(S_ISSOCK)
119#define S_ISSOCK(mode) (0)
120#endif
121#endif
122
123#undef FIL__
124#define FIL__ _("sh_unix.c")
125
126unsigned long mask_PRELINK = MASK_PRELINK_;
127unsigned long mask_USER0 = MASK_USER_;
128unsigned long mask_USER1 = MASK_USER_;
129unsigned long mask_USER2 = MASK_USER_;
130unsigned long mask_USER3 = MASK_USER_;
131unsigned long mask_USER4 = MASK_USER_;
132unsigned long mask_ALLIGNORE = MASK_ALLIGNORE_;
133unsigned long mask_ATTRIBUTES = MASK_ATTRIBUTES_;
134unsigned long mask_LOGFILES = MASK_LOGFILES_;
135unsigned long mask_LOGGROW = MASK_LOGGROW_;
136unsigned long mask_READONLY = MASK_READONLY_;
137unsigned long mask_NOIGNORE = MASK_NOIGNORE_;
138
139
140extern char **environ;
141
142int sh_unix_maskreset()
143{
144 mask_PRELINK = MASK_PRELINK_;
145 mask_USER0 = MASK_USER_;
146 mask_USER1 = MASK_USER_;
147 mask_USER2 = MASK_USER_;
148 mask_USER3 = MASK_USER_;
149 mask_USER4 = MASK_USER_;
150 mask_ALLIGNORE = MASK_ALLIGNORE_;
151 mask_ATTRIBUTES = MASK_ATTRIBUTES_;
152 mask_LOGFILES = MASK_LOGFILES_;
153 mask_LOGGROW = MASK_LOGGROW_;
154 mask_READONLY = MASK_READONLY_;
155 mask_NOIGNORE = MASK_NOIGNORE_;
156 return 0;
157}
158
159
160#ifdef SYS_SIGLIST_DECLARED
161/* extern const char * const sys_siglist[]; */
162#else
163char * sh_unix_siglist (int signum)
164{
165 switch (signum)
166 {
167#ifdef SIGHUP
168 case SIGHUP:
169 return _("Hangup");
170#endif
171#ifdef SIGINT
172 case SIGINT:
173 return _("Interrupt");
174#endif
175#ifdef SIGQUIT
176 case SIGQUIT:
177 return _("Quit");
178#endif
179#ifdef SIGILL
180 case SIGILL:
181 return _("Illegal instruction");
182#endif
183#ifdef SIGTRAP
184 case SIGTRAP:
185 return _("Trace/breakpoint trap");
186#endif
187#ifdef SIGABRT
188 case SIGABRT:
189 return _("IOT trap/Abort");
190#endif
191#ifdef SIGBUS
192 case SIGBUS:
193 return _("Bus error");
194#endif
195#ifdef SIGFPE
196 case SIGFPE:
197 return _("Floating point exception");
198#endif
199#ifdef SIGUSR1
200 case SIGUSR1:
201 return _("User defined signal 1");
202#endif
203#ifdef SIGSEGV
204 case SIGSEGV:
205 return _("Segmentation fault");
206#endif
207#ifdef SIGUSR2
208 case SIGUSR2:
209 return _("User defined signal 2");
210#endif
211#ifdef SIGPIPE
212 case SIGPIPE:
213 return _("Broken pipe");
214#endif
215#ifdef SIGALRM
216 case SIGALRM:
217 return _("Alarm clock");
218#endif
219#ifdef SIGTERM
220 case SIGTERM:
221 return _("Terminated");
222#endif
223#ifdef SIGSTKFLT
224 case SIGSTKFLT:
225 return _("Stack fault");
226#endif
227#ifdef SIGCHLD
228 case SIGCHLD:
229 return _("Child exited");
230#endif
231#ifdef SIGCONT
232 case SIGCONT:
233 return _("Continued");
234#endif
235#ifdef SIGSTOP
236 case SIGSTOP:
237 return _("Stopped");
238#endif
239#ifdef SIGTSTP
240 case SIGTSTP:
241 return _("Stop typed at tty");
242#endif
243#ifdef SIGTTIN
244 case SIGTTIN:
245 return _("Stopped (tty input)");
246#endif
247#ifdef SIGTTOU
248 case SIGTTOU:
249 return _("Stopped (tty output)");
250#endif
251#ifdef SIGURG
252 case SIGURG:
253 return _("Urgent condition");
254#endif
255#ifdef SIGXCPU
256 case SIGXCPU:
257 return _("CPU time limit exceeded");
258#endif
259#ifdef SIGXFSZ
260 case SIGXFSZ:
261 return _("File size limit exceeded");
262#endif
263#ifdef SIGVTALRM
264 case SIGVTALRM:
265 return _("Virtual time alarm");
266#endif
267#ifdef SIGPROF
268 case SIGPROF:
269 return _("Profile signal");
270#endif
271#ifdef SIGWINCH
272 case SIGWINCH:
273 return _("Window size changed");
274#endif
275#ifdef SIGIO
276 case SIGIO:
277 return _("Possible I/O");
278#endif
279#ifdef SIGPWR
280 case SIGPWR:
281 return _("Power failure");
282#endif
283#ifdef SIGUNUSED
284 case SIGUNUSED:
285 return _("Unused signal");
286#endif
287 }
288 return _("Unknown");
289}
290#endif
291
292
293/* Log from within a signal handler without using any
294 * functions that are not async signal safe.
295 *
296 * This is the safe_itoa helper function.
297 */
298char * safe_itoa(int i, char * str, int size)
299{
300 unsigned int u;
301 int iisneg = 0;
302 char *p = &str[size-1];
303
304 *p = '\0';
305 if (i < 0) {
306 iisneg = 1;
307 u = ((unsigned int)(-(1+i))) + 1;
308 } else {
309 u = i;
310 }
311 do {
312 --p;
313 *p = '0' + (u % 10);
314 u /= 10;
315 } while (u && (p != str));
316 if ((iisneg == 1) && (p != str)) {
317 --p;
318 *p = '-';
319 }
320 return p;
321}
322
323/* Log from within a signal handler without using any
324 * functions that are not async signal safe.
325 *
326 * This is the safe_logger function.
327 * Arguments: signal (signal number), method (0=logger, 1=stderr), thepid (pid)
328 */
329extern int OnlyStderr;
330
331int safe_logger (int signal, int method, char * details)
332{
333 unsigned int i = 0;
334 int status = -1;
335 struct stat buf;
336 pid_t newpid;
337 char str[128];
338 char * p;
339
340 char l0[64], l1[64], l2[64], l3[64];
341 char a0[32], a1[32], a2[32];
342 char e0[128];
343 char msg[128];
344
345 char * locations[] = { NULL, NULL, NULL, NULL, NULL };
346 char * envp[] = { NULL, NULL };
347 char * argp[] = { NULL, NULL, NULL, NULL, NULL };
348
349 pid_t thepid = getpid();
350
351 if ((sh.flag.isdaemon == S_FALSE) || (OnlyStderr == S_TRUE))
352 method = 1;
353
354 /* seems that solaris cc needs this way of initializing ...
355 */
356 locations[0] = l0;
357 locations[1] = l1;
358 locations[2] = l2;
359 locations[3] = l3;
360
361 envp[0] = e0;
362
363 argp[0] = a0;
364 argp[1] = a1;
365 argp[2] = a2;
366
367 sl_strlcpy(msg, _("samhain["), 128);
368 p = safe_itoa((int) thepid, str, 128);
369 if (p && *p)
370 sl_strlcat(msg, p, 128);
371 if (signal == 0)
372 {
373 if (details == NULL) {
374 sl_strlcat(msg, _("]: out of memory"), 128);
375 } else {
376 sl_strlcat(msg, _("]: "), 128);
377 sl_strlcat(msg, details, 128);
378 }
379 }
380 else
381 {
382 sl_strlcat(msg, _("]: exit on signal "), 128);
383 p = safe_itoa(signal, str, 128);
384 if (p && *p)
385 sl_strlcat(msg, p, 128);
386 }
387
388 if (method == 1) {
389#ifndef STDERR_FILENO
390#define STDERR_FILENO 2
391#endif
392 write(STDERR_FILENO, msg, strlen(msg));
393 write(STDERR_FILENO, "\n", 1);
394 return 0;
395 }
396
397 sl_strlcpy (l0, _("/usr/bin/logger"), 64);
398 sl_strlcpy (l1, _("/usr/sbin/logger"), 64);
399 sl_strlcpy (l2, _("/usr/ucb/logger"), 64);
400 sl_strlcpy (l3, _("/bin/logger"), 64);
401
402 sl_strlcpy (a0, _("logger"), 32);
403 sl_strlcpy (a1, _("-p"), 32);
404 sl_strlcpy (a2, _("daemon.alert"), 32);
405
406 sl_strlcpy (e0,
407 _("PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/ucb:/usr/local/bin"),
408 128);
409
410 while (locations[i] != NULL) {
411 status = stat(locations[i], &buf);
412 if (status == 0)
413 break;
414 ++i;
415 }
416
417 if (locations[i] != NULL) {
418 argp[3] = msg;
419 newpid = fork();
420 if (newpid == 0) {
421 execve(locations[i], argp, envp);
422 _exit(1);
423 }
424 else if (newpid > 0) {
425 waitpid(newpid, &status, WUNTRACED);
426 }
427 }
428 return 0;
429}
430
431void safe_fatal (char * details,
432 char * file, int line)
433{
434 char msg[128];
435 char str[128];
436 char * p;
437 int signal = 0;
438 int method = 0;
439
440 p = safe_itoa((int) line, str, 128);
441 sl_strlcpy(msg, _("FATAL: "), 128);
442 sl_strlcat(msg, file, 128);
443 sl_strlcat(msg, ": ", 128);
444 if (p && (*p)) {
445 sl_strlcat(msg, p , 128);
446 sl_strlcat(msg, ": ", 128);
447 }
448 sl_strlcat(msg, details, 128);
449 safe_logger (signal, method, msg);
450 _exit(EXIT_FAILURE);
451}
452
453extern char sh_sig_msg[64];
454
455volatile int immediate_exit_normal = 0;
456
457#if defined(SA_SIGACTION_WORKS)
458static
459void sh_unix_sigexit (int mysignal, siginfo_t * signal_info, void * signal_add)
460#else
461static
462void sh_unix_sigexit (int mysignal)
463#endif
464{
465
466#if defined(SA_SIGACTION_WORKS)
467 if (signal_info != NULL && signal_info->si_code == SI_USER &&
468 mysignal != SIGTERM && mysignal != SIGINT)
469 {
470 return;
471 }
472
473 /* avoid compiler warning (unused var)
474 */
475 (void) signal_add;
476#endif
477
478 /*
479 * Block re-entry
480 */
481 if (immediate_exit_normal > 0)
482 {
483 ++immediate_exit_normal;
484 if ((skey != NULL) && (immediate_exit_normal == 2))
485 memset (skey, '\0', sizeof(sh_key_t));
486 if (immediate_exit_normal == 2)
487 {
488 chdir ("/");
489 safe_logger (mysignal, 0, NULL);
490 }
491 _exit(mysignal);
492 }
493 else
494 {
495 immediate_exit_normal = 1;
496 }
497
498#ifdef SYS_SIGLIST_DECLARED
499 strncpy (sh_sig_msg, sys_siglist[mysignal], 40);
500#else
501 strncpy (sh_sig_msg, sh_unix_siglist(mysignal), 40);
502#endif
503 sh_sig_msg[63] = '\0';
504
505 ++sig_raised;
506 ++sig_urgent;
507 sig_termfast = 1;
508 return;
509}
510
511volatile int immediate_exit_fast = 0;
512
513#if defined(SA_SIGACTION_WORKS)
514static
515void sh_unix_sigexit_fast (int mysignal, siginfo_t * signal_info,
516 void * signal_add)
517#else
518static
519void sh_unix_sigexit_fast (int mysignal)
520#endif
521{
522#if defined(SA_SIGACTION_WORKS)
523 if (signal_info != NULL && signal_info->si_code == SI_USER)
524 {
525 return;
526 }
527#endif
528
529 /* avoid compiler warning (unused var)
530 */
531#if defined(SA_SIGACTION_WORKS)
532 (void) signal_add;
533#endif
534
535 /* Check whether the heap is ok; otherwise _exit
536 */
537#if !defined(SL_DEBUG)
538 ++immediate_exit_fast;
539 if (skey != NULL && immediate_exit_fast < 2)
540 memset (skey, '\0', sizeof(sh_key_t));
541 if (immediate_exit_fast < 2)
542 safe_logger (mysignal, 0, NULL);
543 _exit(mysignal);
544#else
545
546 /* debug code
547 */
548 if (immediate_exit_fast == 1)
549 {
550 ++immediate_exit_fast;
551 if (skey != NULL)
552 memset (skey, '\0', sizeof(sh_key_t));
553#ifdef WITH_MESSAGE_QUEUE
554 close_ipc ();
555#endif
556 safe_logger (mysignal, 0, NULL);
557 chdir ("/");
558 raise(SIGFPE);
559 }
560 else if (immediate_exit_fast == 2)
561 {
562 chdir ("/");
563 raise(SIGFPE);
564 }
565 else if (immediate_exit_fast != 0)
566 {
567 _exit(mysignal);
568 }
569
570 ++immediate_exit_fast;
571
572 /* The FPE|BUS|SEGV|ILL signals leave the system in an undefined
573 * state, thus it is best to exit immediately.
574 */
575#ifdef SYS_SIGLIST_DECLARED
576 strncpy (sh_sig_msg, sys_siglist[mysignal], 40);
577#else
578 strncpy (sh_sig_msg, sh_unix_siglist(mysignal), 40);
579#endif
580
581 sl_stack_print();
582
583 /* Try to push out an error message.
584 */
585 sh_error_handle ((-1), FIL__, __LINE__, mysignal, MSG_EXIT_NORMAL,
586 sh.prg_name, sh_sig_msg);
587
588 if (skey != NULL)
589 memset (skey, '\0', sizeof(sh_key_t));
590#ifdef WITH_MESSAGE_QUEUE
591 close_ipc ();
592#endif
593
594 chdir ("/");
595 raise(SIGFPE);
596#endif
597}
598
599
600static
601void sh_unix_sigaction (int mysignal)
602{
603 ++sig_raised;
604#ifdef SIGUSR1
605 if (mysignal == SIGUSR1)
606 sig_debug_switch = 1;
607#endif
608#ifdef SIGUSR2
609 if (mysignal == SIGUSR2)
610 {
611 ++sig_suspend_switch;
612 ++sig_urgent;
613 }
614#endif
615#ifdef SIGHUP
616 if (mysignal == SIGHUP)
617 sig_config_read_again = 1;
618#endif
619#ifdef SIGTTOU
620 if (mysignal == SIGTTOU)
621 sig_force_check = 1;
622#endif
623#ifdef SIGABRT
624 if (mysignal == SIGABRT)
625 sig_fresh_trail = 1;
626#endif
627#ifdef SIGQUIT
628 if (mysignal == SIGQUIT)
629 {
630 sig_terminate = 1;
631 ++sig_urgent;
632 }
633#endif
634#ifdef SIGTERM
635 if (mysignal == SIGTERM)
636 {
637 strncpy (sh_sig_msg, _("Terminated"), 40);
638 sig_termfast = 1;
639 ++sig_urgent;
640 }
641#endif
642
643 return;
644}
645
646static
647void sh_unix_siginstall (int goDaemon)
648{
649 struct sigaction act, act_fast, act2, oldact, ignact;
650#if defined (SH_WITH_SERVER)
651 (void) goDaemon;
652#endif
653
654 SL_ENTER(_("sh_unix_siginstall"));
655
656 ignact.sa_handler = SIG_IGN; /* signal action */
657 sigemptyset( &ignact.sa_mask ); /* set an empty mask */
658 ignact.sa_flags = 0; /* init sa_flags */
659
660#if defined(SA_SIGACTION_WORKS)
661 act.sa_sigaction = &sh_unix_sigexit; /* signal action */
662#else
663 act.sa_handler = &sh_unix_sigexit; /* signal action */
664#endif
665
666 sigfillset ( &act.sa_mask ); /* set a full mask */
667
668
669 /* Block all but deadly signals.
670 */
671#ifdef SIGILL
672 sigdelset ( &act.sa_mask, SIGILL );
673#endif
674#ifndef SL_DEBUG
675#ifdef SIGFPE
676 sigdelset ( &act.sa_mask, SIGFPE );
677#endif
678#endif
679#ifdef SIGSEGV
680 sigdelset ( &act.sa_mask, SIGSEGV );
681#endif
682#ifdef SIGBUS
683 sigdelset ( &act.sa_mask, SIGBUS );
684#endif
685
686#if defined(SA_SIGACTION_WORKS)
687 act_fast.sa_sigaction = &sh_unix_sigexit_fast; /* signal action */
688#else
689 act_fast.sa_handler = &sh_unix_sigexit_fast; /* signal action */
690#endif
691
692 sigfillset ( &act_fast.sa_mask ); /* set a full mask */
693
694#ifdef SIGILL
695 sigdelset ( &act_fast.sa_mask, SIGILL );
696#endif
697#ifndef SL_DEBUG
698#ifdef SIGFPE
699 sigdelset ( &act_fast.sa_mask, SIGFPE );
700#endif
701#endif
702#ifdef SIGSEGV
703 sigdelset ( &act_fast.sa_mask, SIGSEGV );
704#endif
705#ifdef SIGBUS
706 sigdelset ( &act_fast.sa_mask, SIGBUS );
707#endif
708
709
710 /* Use siginfo to verify origin of signal, if possible.
711 */
712#if defined(SA_SIGACTION_WORKS)
713 act.sa_flags = SA_SIGINFO;
714 act_fast.sa_flags = SA_SIGINFO;
715#else
716 act.sa_flags = 0;
717 act_fast.sa_flags = 0;
718#endif
719
720 /* Do not block the signal from being received in its handler ...
721 * (is this a good or a bad idea ??).
722 */
723#if defined(SA_NOMASK)
724 act_fast.sa_flags |= SA_NOMASK;
725#elif defined(SA_NODEFER)
726 act_fast.sa_flags |= SA_NODEFER;
727#endif
728
729
730 act2.sa_handler = &sh_unix_sigaction; /* signal action */
731 sigemptyset( &act2.sa_mask ); /* set an empty mask */
732 act2.sa_flags = 0; /* init sa_flags */
733
734 /* signals to control the daemon */
735
736#ifdef SIGHUP
737 retry_sigaction(FIL__, __LINE__, SIGHUP, &act2, &oldact);
738#endif
739#ifdef SIGABRT
740 retry_sigaction(FIL__, __LINE__, SIGABRT, &act2, &oldact);
741#endif
742#ifdef SIGUSR1
743 retry_sigaction(FIL__, __LINE__, SIGUSR1, &act2, &oldact);
744#endif
745#ifdef SIGUSR2
746 retry_sigaction(FIL__, __LINE__, SIGUSR2, &act2, &oldact);
747#endif
748#ifdef SIGQUIT
749 retry_sigaction(FIL__, __LINE__, SIGQUIT, &act2, &oldact);
750#endif
751#ifdef SIGTERM
752 retry_sigaction(FIL__, __LINE__, SIGTERM, &act, &oldact);
753#endif
754
755 /* fatal signals that may cause termination */
756
757#ifdef SIGILL
758 retry_sigaction(FIL__, __LINE__, SIGILL, &act_fast, &oldact);
759#endif
760#ifndef SL_DEBUG
761#ifdef SIGFPE
762 retry_sigaction(FIL__, __LINE__, SIGFPE, &act_fast, &oldact);
763#endif
764#endif
765#ifdef SIGSEGV
766 retry_sigaction(FIL__, __LINE__, SIGSEGV, &act_fast, &oldact);
767#endif
768#ifdef SIGBUS
769 retry_sigaction(FIL__, __LINE__, SIGBUS, &act_fast, &oldact);
770#endif
771
772 /* other signals */
773
774#ifdef SIGINT
775 retry_sigaction(FIL__, __LINE__, SIGINT, &act, &oldact);
776#endif
777#ifdef SIGPIPE
778 retry_sigaction(FIL__, __LINE__, SIGPIPE, &act, &oldact);
779#endif
780#ifdef SIGALRM
781 retry_sigaction(FIL__, __LINE__, SIGALRM, &ignact, &oldact);
782#endif
783#ifdef SIGTSTP
784 retry_sigaction(FIL__, __LINE__, SIGTSTP, &ignact, &oldact);
785#endif
786#ifdef SIGTTIN
787 retry_sigaction(FIL__, __LINE__, SIGTTIN, &ignact, &oldact);
788#endif
789#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
790#ifdef SIGTTOU
791 if (goDaemon == 1)
792 retry_sigaction(FIL__, __LINE__, SIGTTOU, &act2, &oldact);
793 else
794 retry_sigaction(FIL__, __LINE__, SIGTTOU, &ignact, &oldact);
795#endif
796#else
797#ifdef SIGTTOU
798 retry_sigaction(FIL__, __LINE__, SIGTTOU, &ignact, &oldact);
799#endif
800#endif
801
802#ifdef SIGTRAP
803#if !defined(SCREW_IT_UP)
804 retry_sigaction(FIL__, __LINE__, SIGTRAP, &act, &oldact);
805#endif
806#endif
807
808#ifdef SIGPOLL
809 retry_sigaction(FIL__, __LINE__, SIGPOLL, &ignact, &oldact);
810#endif
811#if defined(SIGPROF) && !defined(SH_PROFILE)
812 retry_sigaction(FIL__, __LINE__, SIGPROF, &ignact, &oldact);
813#endif
814#ifdef SIGSYS
815 retry_sigaction(FIL__, __LINE__, SIGSYS, &act, &oldact);
816#endif
817#ifdef SIGURG
818 retry_sigaction(FIL__, __LINE__, SIGURG, &ignact, &oldact);
819#endif
820#if defined(SIGVTALRM) && !defined(SH_PROFILE)
821 retry_sigaction(FIL__, __LINE__, SIGVTALRM, &ignact, &oldact);
822#endif
823#ifdef SIGXCPU
824 retry_sigaction(FIL__, __LINE__, SIGXCPU, &act, &oldact);
825#endif
826#ifdef SIGXFSZ
827 retry_sigaction(FIL__, __LINE__, SIGXFSZ, &act, &oldact);
828#endif
829
830#ifdef SIGEMT
831 retry_sigaction(FIL__, __LINE__, SIGEMT, &ignact, &oldact);
832#endif
833#ifdef SIGSTKFLT
834 retry_sigaction(FIL__, __LINE__, SIGSTKFLT, &act, &oldact);
835#endif
836#ifdef SIGIO
837 retry_sigaction(FIL__, __LINE__, SIGIO, &ignact, &oldact);
838#endif
839#ifdef SIGPWR
840 retry_sigaction(FIL__, __LINE__, SIGPWR, &act, &oldact);
841#endif
842
843#ifdef SIGLOST
844 retry_sigaction(FIL__, __LINE__, SIGLOST, &ignact, &oldact);
845#endif
846#ifdef SIGUNUSED
847 retry_sigaction(FIL__, __LINE__, SIGUNUSED, &ignact, &oldact);
848#endif
849
850 SL_RET0(_("sh_unix_siginstall"));
851}
852
853/* ---------------------------------------------------------------- */
854
855/* checksum the own binary
856 */
857int sh_unix_self_hash (const char * c)
858{
859 char message[512];
860
861 SL_ENTER(_("sh_unix_self_hash"));
862
863 if (c == NULL)
864 {
865 sh.exec.path[0] = '\0';
866 SL_RETURN((0), _("sh_unix_self_hash"));
867 }
868 sl_strlcpy(sh.exec.path, c, SH_PATHBUF);
869
870 sl_strlcpy(sh.exec.hash,
871 sh_tiger_hash (c, TIGER_FILE, 0),
872 KEY_LEN+1);
873 sl_snprintf(message, 512, _("%s has checksum: %s"),
874 sh.exec.path, sh.exec.hash);
875 message[511] = '\0';
876 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
877 message, _("sh_unix_self_hash"));
878 if (0 == sl_strcmp(sh.exec.hash,
879 _("000000000000000000000000000000000000000000000000")
880 ))
881 {
882 dlog(1, FIL__, __LINE__,
883 _("Could not checksum my own executable because of the\nfollowing error: %s: %s\n\nPossible reasons include:\n Wrong path in configure file option SamhainPath=/path/to/executable\n No read permission for the effective UID: %d\n"),
884 sh.exec.path, sl_get_errmsg(), (int) sl_ret_euid());
885 sh_error_handle ((-1), FIL__, __LINE__, EACCES, MSG_NOACCESS,
886 (long) sh.real.uid, c);
887 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
888 }
889 SL_RETURN((0), _("sh_unix_self_hash"));
890}
891
892int sh_unix_self_check ()
893{
894 char newhash[KEY_LEN+1];
895 char message[512];
896
897 SL_ENTER(_("sh_unix_self_check"));
898 if (sh.exec.path == NULL || sh.exec.path[0] == '\0')
899 SL_RETURN((0), _("sh_unix_self_check"));
900
901 sl_strlcpy(newhash, sh_tiger_hash (sh.exec.path, TIGER_FILE, 0), KEY_LEN+1);
902 if (0 == sl_strncmp(sh.exec.hash,
903 newhash,
904 KEY_LEN))
905 SL_RETURN((0), _("sh_unix_self_check"));
906
907
908 dlog(1, FIL__, __LINE__,
909 _("The checksum of the executable: %s has changed since startup (%s -> %s).\n"),
910 sh.exec.path, sh.exec.hash, newhash);
911
912 sl_snprintf(message, 512,
913 _("The checksum of %s has changed since startup (%s -> %s)"),
914 sh.exec.path, sh.exec.hash, newhash);
915 message[511] = '\0';
916
917 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, 0, MSG_E_SUBGEN,
918 message, _("sh_unix_self_check"));
919 sh_error_handle ((-1), FIL__, __LINE__, EACCES, MSG_E_AUTH,
920 sh.exec.path);
921 SL_RETURN((-1), _("sh_unix_self_check"));
922}
923
924
925/* ---------------------------------------------------------------- */
926
927
928/* added Tue Feb 22 10:36:44 NFT 2000 Rainer Wichmann */
929static int tf_add_trusted_user_int(const char * c)
930{
931 register struct passwd * w;
932 int count;
933 uid_t pwid = (uid_t)-1;
934
935 SL_ENTER(_("tf_add_trusted_user_int"));
936
937 /* First check for a user name.
938 */
939 if ((w = sh_getpwnam(c)) != NULL && ((pwid = w->pw_uid) > 0))
940 goto succe;
941
942 /* Failed, so check for a numerical value.
943 */
944 pwid = strtol(c, (char **)NULL, 10);
945 if (pwid > 0 && pwid < 65535)
946 goto succe;
947
948 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
949 _("add trusted user"), c);
950 SL_RETURN((-1), _("tf_add_trusted_user_int"));
951
952 succe:
953 count = sl_trust_add_user(pwid);
954 SL_RETURN((count), _("tf_add_trusted_user_int"));
955}
956
957int tf_add_trusted_user(const char * c)
958{
959 int i;
960 char * q;
961 char * p = sh_util_strdup (c);
962
963 SL_ENTER(_("tf_add_trusted_user"));
964
965 q = strtok(p, ", \t");
966 if (!q)
967 {
968 SH_FREE(p);
969 SL_RETURN((-1), _("tf_add_trusted_user"));
970 }
971 while (q)
972 {
973 i = tf_add_trusted_user_int(q);
974 if (SL_ISERROR(i))
975 {
976 SH_FREE(p);
977 SL_RETURN((i), _("tf_add_trusted_user"));
978 }
979 q = strtok(NULL, ", \t");
980 }
981 SH_FREE(p);
982 SL_RETURN((0), _("tf_add_trusted_user"));
983}
984
985extern uid_t sl_trust_baduid();
986extern gid_t sl_trust_badgid();
987
988#if defined(HOST_IS_CYGWIN) || defined(__cygwin__) || defined(__CYGWIN32__) || defined(__CYGWIN__)
989int tf_trust_check (char * file, int mode)
990{
991 (void) file;
992 (void) mode;
993 return 0;
994}
995#else
996int tf_trust_check (char * file, int mode)
997{
998 char * tmp;
999 char * tmp2;
1000 char * p;
1001 int status;
1002 int level;
1003 uid_t ff_euid;
1004
1005 SL_ENTER(_("tf_trust_check"));
1006
1007 if (mode == SL_YESPRIV)
1008 sl_get_euid(&ff_euid);
1009 else
1010 sl_get_ruid(&ff_euid);
1011
1012#if defined(SH_WITH_SERVER)
1013 if (0 == sl_ret_euid()) /* privileges not dropped yet */
1014 {
1015 struct passwd * tempres = sh_getpwnam(DEFAULT_IDENT);
1016
1017 if (!tempres)
1018 {
1019 dlog(1, FIL__, __LINE__,
1020 _("User %s does not exist. Please add the user to your system.\n"),
1021 DEFAULT_IDENT);
1022 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
1023 }
1024 ff_euid = tempres->pw_uid;
1025 }
1026#endif
1027
1028 status = sl_trustfile_euid(file, ff_euid);
1029
1030 if ( SL_ENONE != status)
1031 {
1032 if (status == SL_ESTAT)
1033 level = SH_ERR_ALL;
1034 else
1035 level = SH_ERR_ERR;
1036
1037 tmp = sh_util_safe_name (file);
1038 p = sl_trust_errfile();
1039 if (p && *p != '\0')
1040 {
1041 tmp2 = sh_util_safe_name (sl_trust_errfile());
1042 sh_error_handle(level, FIL__, __LINE__, status, MSG_E_TRUST2,
1043 sl_error_string(status), tmp, tmp2);
1044 SH_FREE(tmp2);
1045 }
1046 else
1047 {
1048 sh_error_handle(level, FIL__, __LINE__, status, MSG_E_TRUST1,
1049 sl_error_string(status), tmp);
1050 }
1051 SH_FREE(tmp);
1052
1053 if (status == SL_EBADUID || status == SL_EBADGID ||
1054 status == SL_EBADOTH || status == SL_ETRUNC ||
1055 status == SL_EINTERNAL )
1056 {
1057 switch (status) {
1058 case SL_EINTERNAL:
1059 dlog(1, FIL__, __LINE__,
1060 _("An internal error occured in the trustfile function.\n"));
1061 break;
1062 case SL_ETRUNC:
1063 tmp = sh_util_safe_name (file);
1064 dlog(1, FIL__, __LINE__,
1065 _("A filename truncation occured in the trustfile function.\nProbably the normalized filename for %s\nis too long. This may be due e.g. to deep or circular softlinks.\n"),
1066 tmp);
1067 SH_FREE(tmp);
1068 break;
1069 case SL_EBADOTH:
1070 tmp = sh_util_safe_name (file);
1071 p = sl_trust_errfile();
1072 dlog(1, FIL__, __LINE__,
1073 _("The path element: %s\nin the filename: %s is world writeable.\n"),
1074 p, tmp);
1075 SH_FREE(tmp);
1076 break;
1077 case SL_EBADUID:
1078 tmp = sh_util_safe_name (file);
1079 p = sl_trust_errfile();
1080 dlog(1, FIL__, __LINE__,
1081 _("The owner (UID = %ld) of the path element: %s\nin the filename: %s\nis not in the list of trusted users.\nTo fix the problem, you can:\n - run ./configure again with the option --with-trusted=0,...,UID\n where UID is the UID of the untrusted user, or\n - use the option TrustedUser=UID in the configuration file.\n"),
1082 (UID_CAST)sl_trust_baduid(), p, tmp);
1083 SH_FREE(tmp);
1084 break;
1085 case SL_EBADGID:
1086 tmp = sh_util_safe_name (file);
1087 p = sl_trust_errfile();
1088 dlog(1, FIL__, __LINE__,
1089 _("The path element: %s\nin the filename: %s\nis group writeable (GID = %ld), and at least one of the group\nmembers (UID = %ld) is not in the list of trusted users.\nTo fix the problem, you can:\n - run ./configure again with the option --with-trusted=0,...,UID\n where UID is the UID of the untrusted user, or\n - use the option TrustedUser=UID in the configuration file.\n"),
1090 p, tmp, (UID_CAST)sl_trust_badgid(),
1091 (UID_CAST)sl_trust_baduid());
1092 SH_FREE(tmp);
1093 break;
1094 default:
1095 break;
1096 }
1097
1098 SL_RETURN((-1), _("tf_trust_check"));
1099 }
1100 }
1101
1102 SL_RETURN((0), _("tf_trust_check"));
1103}
1104#endif
1105
1106#ifdef HAVE_INITGROUPS
1107#ifdef HOST_IS_OSF
1108int sh_unix_initgroups ( char * in_user, gid_t in_gid)
1109#else
1110int sh_unix_initgroups (const char * in_user, gid_t in_gid)
1111#endif
1112{
1113 int status = -1;
1114 status = sh_initgroups (in_user, in_gid);
1115 if (status < 0)
1116 {
1117 if (errno == EPERM)
1118 return 0;
1119 if (errno == EINVAL)
1120 return 0;
1121 return -1;
1122 }
1123 return 0;
1124}
1125#else
1126int sh_unix_initgroups (const char * in_user, gid_t in_gid)
1127{
1128 (void) in_user;
1129 (void) in_gid;
1130 return 0;
1131}
1132#endif
1133
1134#ifdef HAVE_INITGROUPS
1135char * sh_unix_getUIDname (int level, uid_t uid);
1136int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid)
1137{
1138 int status = -1;
1139 char * user = NULL;
1140
1141 SL_ENTER(_("sh_unix_initgroups2"));
1142
1143 user = sh_unix_getUIDname (SH_ERR_ERR, in_pid);
1144 if (user == NULL)
1145 SL_RETURN((-1), _("sh_unix_initgroups2"));
1146 status = sh_initgroups (user, in_gid);
1147 if (status < 0)
1148 {
1149 if (errno == EPERM)
1150 status = 0;
1151 if (errno == EINVAL)
1152 status = 0;
1153 }
1154 SL_RETURN((status), _("sh_unix_initgroups2"));
1155}
1156#else
1157int sh_unix_initgroups2 (uid_t in_pid, gid_t in_gid)
1158{
1159 (void) in_pid;
1160 (void) in_gid;
1161 return 0;
1162}
1163#endif
1164
1165void sh_unix_closeall (int fd, int except)
1166{
1167 int fdx = fd;
1168#ifdef _SC_OPEN_MAX
1169 int fdlimit = sysconf (_SC_OPEN_MAX);
1170#else
1171#ifdef OPEN_MAX
1172 int fdlimit = OPEN_MAX;
1173#else
1174 int fdlimit = _POSIX_OPEN_MAX;
1175#endif
1176#endif
1177
1178 SL_ENTER(_("sh_unix_closeall"));
1179
1180 /* can't happen - so fix it :-(
1181 */
1182 if (fdlimit < 0)
1183 fdlimit = 8; /* POSIX lower limit */
1184
1185 if (fdlimit > 65536)
1186 fdlimit = 65536;
1187
1188 /* Close everything from fd (inclusive) up to fdlimit (exclusive).
1189 */
1190 while (fd < fdlimit)
1191 {
1192 if (fd == except)
1193 fd++;
1194 else if (slib_do_trace != 0 && fd == slib_trace_fd)
1195 fd++;
1196 else
1197 close(fd++);
1198 }
1199
1200 sl_dropall (fdx, except);
1201
1202 SL_RET0(_("sh_unix_closeall"));
1203}
1204
1205static void sh_unix_setlimits(void)
1206{
1207 struct rlimit limits;
1208
1209 SL_ENTER(_("sh_unix_setlimits"));
1210
1211 limits.rlim_cur = RLIM_INFINITY;
1212 limits.rlim_max = RLIM_INFINITY;
1213
1214#ifdef RLIMIT_CPU
1215 setrlimit (RLIMIT_CPU, &limits);
1216#endif
1217#ifdef RLIMIT_FSIZE
1218 setrlimit (RLIMIT_FSIZE, &limits);
1219#endif
1220#ifdef RLIMIT_DATA
1221 setrlimit (RLIMIT_DATA, &limits);
1222#endif
1223#ifdef RLIMIT_STACK
1224 setrlimit (RLIMIT_STACK, &limits);
1225#endif
1226#ifdef RLIMIT_RSS
1227 setrlimit (RLIMIT_RSS, &limits);
1228#endif
1229#ifdef RLIMIT_NPROC
1230 setrlimit (RLIMIT_NPROC, &limits);
1231#endif
1232#ifdef RLIMIT_MEMLOCK
1233 setrlimit (RLIMIT_MEMLOCK, &limits);
1234#endif
1235
1236#if !defined(SL_DEBUG)
1237 /* no core dumps
1238 */
1239 limits.rlim_cur = 0;
1240 limits.rlim_max = 0;
1241#ifdef RLIMIT_CORE
1242 setrlimit (RLIMIT_CORE, &limits);
1243#endif
1244#else
1245#ifdef RLIMIT_CORE
1246 setrlimit (RLIMIT_CORE, &limits);
1247#endif
1248#endif
1249
1250 limits.rlim_cur = 1024;
1251 limits.rlim_max = 1024;
1252
1253#if defined(RLIMIT_NOFILE)
1254 setrlimit (RLIMIT_NOFILE, &limits);
1255#elif defined(RLIMIT_OFILE)
1256 setrlimit (RLIMIT_OFILE, &limits);
1257#endif
1258
1259 SL_RET0(_("sh_unix_setlimits"));
1260}
1261
1262static void sh_unix_copyenv(void)
1263{
1264 char ** env0 = environ;
1265 char ** env1;
1266 int envlen = 0;
1267 size_t len;
1268
1269 SL_ENTER(_("sh_unix_copyenv"));
1270
1271 while (env0 != NULL && env0[envlen] != NULL) {
1272 /* printf("%2d: %s\n", envlen, env0[envlen]); */
1273 ++envlen;
1274 }
1275 ++envlen;
1276
1277 /* printf("-> %2d: slots allocated\n", envlen); */
1278 env1 = malloc (sizeof(char *) * envlen); /* only once */
1279 if (env1 == NULL)
1280 {
1281 fprintf(stderr, _("%s: %d: Out of memory\n"), FIL__, __LINE__);
1282 SL_RET0(_("sh_unix_copyenv"));
1283 }
1284 env0 = environ;
1285 envlen = 0;
1286
1287 while (env0 != NULL && env0[envlen] != NULL) {
1288 len = strlen(env0[envlen]) + 1;
1289 env1[envlen] = malloc (len); /* only once */
1290 if (env1[envlen] == NULL)
1291 {
1292 fprintf(stderr, _("%s: %d: Out of memory\n"), FIL__, __LINE__);
1293 SL_RET0(_("sh_unix_copyenv"));
1294 }
1295 sl_strlcpy(env1[envlen], env0[envlen], len);
1296 ++envlen;
1297 }
1298 env1[envlen] = NULL;
1299
1300 environ = env1;
1301 SL_RET0(_("sh_unix_copyenv"));
1302}
1303
1304/* delete all environment variables
1305 */
1306static void sh_unix_zeroenv(void)
1307{
1308 char * c;
1309 char ** env;
1310
1311 SL_ENTER(_("sh_unix_zeroenv"));
1312
1313 sh_unix_copyenv();
1314 env = environ;
1315
1316 while (env != NULL && *env != NULL) {
1317 c = strchr ((*env), '=');
1318#ifdef WITH_MYSQL
1319 /*
1320 * Skip the MYSQL_UNIX_PORT environment variable; MySQL may need it.
1321 */
1322 if (0 == sl_strncmp((*env), _("MYSQL_UNIX_PORT="), 16))
1323 {
1324 ++(env);
1325 continue;
1326 }
1327 if (0 == sl_strncmp((*env), _("MYSQL_TCP_PORT="), 15))
1328 {
1329 ++(env);
1330 continue;
1331 }
1332 if (0 == sl_strncmp((*env), _("MYSQL_HOME="), 11))
1333 {
1334 ++(env);
1335 continue;
1336 }
1337#endif
1338#ifdef WITH_ORACLE
1339 /*
1340 * Skip the ORACLE_HOME environment variable; Oracle may need it.
1341 */
1342 if (0 == sl_strncmp((*env), _("ORACLE_HOME="), 12))
1343 {
1344 ++(env);
1345 continue;
1346 }
1347#endif
1348 /*
1349 * Skip the TZ environment variable.
1350 */
1351 if (0 == sl_strncmp((*env), _("TZ="), 3))
1352 {
1353 ++(env);
1354 continue;
1355 }
1356 ++(env);
1357 if (c != NULL)
1358 {
1359 ++c;
1360 while ((*c) != '\0') {
1361 (*c) = '\0';
1362 ++c;
1363 }
1364 }
1365 }
1366
1367 SL_RET0(_("sh_unix_zeroenv"));
1368}
1369
1370
1371static void sh_unix_resettimer(void)
1372{
1373 struct itimerval this_timer;
1374
1375 SL_ENTER(_("sh_unix_resettimer"));
1376
1377 this_timer.it_value.tv_sec = 0;
1378 this_timer.it_value.tv_usec = 0;
1379
1380 this_timer.it_interval.tv_sec = 0;
1381 this_timer.it_interval.tv_usec = 0;
1382
1383 setitimer(ITIMER_REAL, &this_timer, NULL);
1384#if !defined(SH_PROFILE)
1385 setitimer(ITIMER_VIRTUAL, &this_timer, NULL);
1386 setitimer(ITIMER_PROF, &this_timer, NULL);
1387#endif
1388
1389 SL_RET0(_("sh_unix_resettimer"));
1390}
1391
1392static void sh_unix_resetsignals(void)
1393{
1394 int sig_num;
1395#ifdef NSIG
1396 int max_sig = NSIG;
1397#else
1398 int max_sig = 255;
1399#endif
1400 int test;
1401 struct sigaction act, oldact;
1402 int status;
1403
1404 sigset_t set_proc;
1405
1406 SL_ENTER(_("sh_unix_resetsignals"));
1407 /*
1408 * Reset the current signal mask (inherited from parent process).
1409 */
1410
1411 sigfillset(&set_proc);
1412
1413 do {
1414 errno = 0;
1415 test = sigprocmask(SIG_UNBLOCK, &set_proc, NULL);
1416 } while (test < 0 && errno == EINTR);
1417
1418 /*
1419 * Reset signal handling.
1420 */
1421
1422 act.sa_handler = SIG_DFL; /* signal action */
1423 sigemptyset( &act.sa_mask ); /* set an empty mask */
1424 act.sa_flags = 0; /* init sa_flags */
1425
1426 for (sig_num = 1; sig_num <= max_sig; ++sig_num)
1427 {
1428#if !defined(SH_PROFILE)
1429 test = retry_sigaction(FIL__, __LINE__, sig_num, &act, &oldact);
1430#else
1431 test = 0;
1432#endif
1433 if ((test == -1) && (errno != EINVAL))
1434 {
1435 status = errno;
1436 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_W_SIG,
1437 sh_error_message (status), sig_num);
1438 }
1439 }
1440
1441 SL_RET0(_("sh_unix_resetsignals"));
1442}
1443
1444/* Get the local hostname (FQDN)
1445 */
1446#include <sys/socket.h>
1447
1448/* Required for BSD
1449 */
1450#ifdef HAVE_NETINET_IN_H
1451#include <netinet/in.h>
1452#endif
1453
1454#include <arpa/inet.h>
1455
1456char * sh_unix_h_name (struct hostent * host_entry)
1457{
1458 char ** p;
1459 if (strchr(host_entry->h_name, '.')) {
1460 return host_entry->h_name;
1461 } else {
1462 for (p = host_entry->h_aliases; *p; ++p) {
1463 if (strchr(*p, '.'))
1464 return *p;
1465 }
1466 }
1467 return host_entry->h_name;
1468}
1469
1470/* uname() on FreeBSD is broken, because the 'nodename' buf is too small
1471 * to hold a valid (leftmost) domain label.
1472 */
1473#if defined(HAVE_UNAME) && !defined(HOST_IS_FREEBSD)
1474#include <sys/utsname.h>
1475void sh_unix_localhost()
1476{
1477 struct utsname buf;
1478 struct hostent * he1;
1479 int i;
1480 int ddot = 0;
1481 int len;
1482 char * p;
1483 char hostname[256];
1484
1485
1486 SL_ENTER(_("sh_unix_localhost"));
1487
1488 (void) uname (&buf);
1489 /* flawfinder: ignore */ /* ff bug, ff sees system() */
1490 sl_strlcpy (sh.host.system, buf.sysname, SH_MINIBUF);
1491 sl_strlcpy (sh.host.release, buf.release, SH_MINIBUF);
1492 sl_strlcpy (sh.host.machine, buf.machine, SH_MINIBUF);
1493
1494 /* Workaround for cases where nodename could be
1495 * a truncated FQDN.
1496 */
1497 if (strlen(buf.nodename) == (sizeof(buf.nodename)-1))
1498 {
1499 p = strchr(buf.nodename, '.');
1500 if (NULL != p) {
1501 *p = '\0';
1502 sl_strlcpy(hostname, buf.nodename, 256);
1503 } else {
1504#ifdef HAVE_GETHOSTNAME
1505 if (0 != gethostname(hostname, 256))
1506 {
1507 sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1508 _("nodename returned by uname may be truncated"),
1509 _("sh_unix_localhost"));
1510 sl_strlcpy (hostname, buf.nodename, 256);
1511 }
1512 else
1513 {
1514 hostname[255] = '\0';
1515 }
1516#else
1517 sh_error_handle(SH_ERR_WARN, FIL__, __LINE__, 0, MSG_E_SUBGEN,
1518 _("nodename returned by uname may be truncated"),
1519 _("sh_unix_localhost"));
1520 sl_strlcpy(hostname, buf.nodename, 256);
1521#endif
1522 }
1523 }
1524 else
1525 {
1526 sl_strlcpy(hostname, buf.nodename, 256);
1527 }
1528
1529 he1 = sh_gethostbyname(hostname);
1530
1531 if (he1 == NULL)
1532 {
1533 dlog(1, FIL__, __LINE__,
1534 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN. For more information, see the entry about self-resolving under 'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1535 hostname);
1536 sl_strlcpy (sh.host.name, hostname, SH_PATHBUF);
1537 }
1538 else
1539 {
1540 sl_strlcpy (sh.host.name, sh_unix_h_name(he1), SH_PATHBUF);
1541 }
1542
1543
1544 /* check whether it looks like a FQDN
1545 */
1546 len = sl_strlen(sh.host.name);
1547 for (i = 0; i < len; ++i)
1548 if (sh.host.name[i] == '.') ++ddot;
1549
1550 if (ddot == 0 && he1 != NULL)
1551 {
1552 dlog(1, FIL__, __LINE__,
1553 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1554 hostname, sh.host.name);
1555 sl_strlcpy (sh.host.name,
1556 inet_ntoa (*(struct in_addr *) he1->h_addr),
1557 SH_PATHBUF);
1558 SL_RET0(_("sh_unix_localhost"));
1559 }
1560
1561 if (is_numeric(sh.host.name))
1562 {
1563 dlog(1, FIL__, __LINE__,
1564 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1565 hostname, sh.host.name);
1566 }
1567
1568 SL_RET0(_("sh_unix_localhost"));
1569}
1570#else
1571void sh_unix_localhost()
1572{
1573 struct hostent * he1;
1574 int i;
1575 int ddot = 0;
1576 int len;
1577 char hostname[1024];
1578
1579
1580 SL_ENTER(_("sh_unix_localhost"));
1581
1582 (void) gethostname (hostname, 1024);
1583 hostname[1023] = '\0';
1584 he1 = sh_gethostbyname(hostname);
1585
1586 if (he1 != NULL)
1587 {
1588 sl_strlcpy (sh.host.name, sh_unix_h_name(he1), SH_PATHBUF);
1589 }
1590 else
1591 {
1592 dlog(1, FIL__, __LINE__,
1593 _("According to gethostname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1594 hostname);
1595 sl_strlcpy (sh.host.name, _("localhost"), SH_PATHBUF);
1596 SL_RET0(_("sh_unix_localhost"));
1597 }
1598
1599 /* check whether it looks like a FQDN
1600 */
1601 len = sl_strlen(sh.host.name);
1602 for (i = 0; i < len; ++i)
1603 if (sh.host.name[i] == '.') ++ddot;
1604 if (ddot == 0)
1605 {
1606 dlog(1, FIL__, __LINE__,
1607 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1608 hostname, sh.host.name);
1609 sl_strlcpy (sh.host.name,
1610 inet_ntoa (*(struct in_addr *) he1->h_addr),
1611 SH_PATHBUF);
1612 SL_RET0(_("sh_unix_localhost"));
1613 }
1614
1615 if (is_numeric(sh.host.name))
1616 {
1617 dlog(1, FIL__, __LINE__,
1618 _("According to uname, your nodename is %s, but your resolver\nlibrary cannot resolve this nodename to a FQDN.\nRather, it resolves this to %s.\nFor more information, see the entry about self-resolving under\n'Most frequently' in the FAQ that you will find in the docs/ subdirectory.\n"),
1619 hostname, sh.host.name);
1620 }
1621
1622 SL_RET0(_("sh_unix_localhost"));
1623}
1624#endif
1625
1626
1627void sh_unix_memlock()
1628{
1629 SL_ENTER(_("sh_unix_memlock"));
1630
1631 /* do this before dropping privileges
1632 */
1633#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
1634 if (skey->mlock_failed == SL_FALSE)
1635 {
1636 if ( (-1) == sh_unix_mlock( FIL__, __LINE__,
1637 (char *) skey, sizeof (sh_key_t)) )
1638 {
1639 skey->mlock_failed = SL_TRUE;
1640 }
1641 }
1642#else
1643 if (skey->mlock_failed == SL_FALSE)
1644 {
1645 skey->mlock_failed = SL_TRUE;
1646 }
1647#endif
1648
1649 SL_RET0(_("sh_unix_memlock"));
1650}
1651
1652#ifdef SH_WITH_SERVER
1653char * chroot_dir = NULL;
1654
1655int sh_unix_set_chroot(const char * str)
1656{
1657 size_t len;
1658 static int block = 0;
1659
1660 if (block == 1)
1661 return 0;
1662
1663 if (str && *str == '/')
1664 {
1665 len = strlen(str) + 1;
1666 chroot_dir = malloc(strlen(str) + 1); /* only once */
1667 if (!chroot_dir)
1668 {
1669 fprintf(stderr, _("%s: %d: Out of memory\n"), FIL__, __LINE__);
1670 return 1;
1671 }
1672 sl_strlcpy(chroot_dir, str, len);
1673 block = 1;
1674 return 0;
1675 }
1676 return 1;
1677}
1678
1679int sh_unix_chroot()
1680{
1681 int status;
1682
1683 if (chroot_dir != NULL)
1684 {
1685 status = retry_aud_chdir(FIL__, __LINE__, chroot_dir);
1686 if ( (-1) == status )
1687 {
1688 status = errno;
1689 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_W_CHDIR,
1690 sh_error_message (status), chroot_dir);
1691 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
1692 }
1693 /* flawfinder: ignore */
1694 return (chroot(chroot_dir));
1695 }
1696 return 0;
1697}
1698/* #ifdef SH_WITH_SERVER */
1699#else
1700int sh_unix_chroot() { return 0; }
1701#endif
1702
1703/* daemon mode
1704 */
1705static int block_setdeamon = 0;
1706
1707int sh_unix_setdeamon(const char * dummy)
1708{
1709 int res = 0;
1710
1711 SL_ENTER(_("sh_unix_setdeamon"));
1712
1713 if (block_setdeamon != 0)
1714 SL_RETURN((0),_("sh_unix_setdeamon"));
1715
1716 if (dummy == NULL)
1717 sh.flag.isdaemon = ON;
1718 else
1719 res = sh_util_flagval (dummy, &sh.flag.isdaemon);
1720
1721 if (sh.flag.opts == S_TRUE)
1722 block_setdeamon = 1;
1723
1724 SL_RETURN(res, _("sh_unix_setdeamon"));
1725}
1726#if defined(HAVE_LIBPRELUDE)
1727#include "sh_prelude.h"
1728#endif
1729
1730int sh_unix_setnodeamon(const char * dummy)
1731{
1732 int res = 0;
1733
1734 SL_ENTER(_("sh_unix_setnodeamon"));
1735
1736 if (block_setdeamon != 0)
1737 SL_RETURN((0),_("sh_unix_setmodeamon"));
1738
1739 if (dummy == NULL)
1740 sh.flag.isdaemon = OFF;
1741 else
1742 res = sh_util_flagval (dummy, &sh.flag.isdaemon);
1743
1744 if (sh.flag.opts == S_TRUE)
1745 block_setdeamon = 1;
1746
1747 SL_RETURN(res, _("sh_unix_setnodeamon"));
1748}
1749
1750int sh_unix_init(int goDaemon)
1751{
1752 int status;
1753 uid_t uid;
1754 pid_t oldpid = getpid();
1755#if defined(SH_WITH_SERVER)
1756 extern int sh_socket_open_int ();
1757#endif
1758
1759 SL_ENTER(_("sh_unix_init"));
1760
1761 /* fork twice, exit the parent process
1762 */
1763 if (goDaemon == 1) {
1764
1765 switch (aud_fork(FIL__, __LINE__)) {
1766 case 0: break; /* child process continues */
1767 case -1: SL_RETURN((-1),_("sh_unix_init")); /* error */
1768 default: aud__exit(FIL__, __LINE__, 0); /* parent process exits */
1769 }
1770
1771 /* Child processes do not inherit page locks across a fork.
1772 * Error in next fork would return in this (?) thread of execution.
1773 */
1774 sh_unix_memlock();
1775
1776 setsid(); /* should not fail */
1777
1778 switch (aud_fork(FIL__, __LINE__)) {
1779 case 0: break; /* child process continues */
1780 case -1: SL_RETURN((-1),_("sh_unix_init")); /* error */
1781 default: aud__exit(FIL__, __LINE__, 0); /* parent process exits */
1782 }
1783
1784 /* Child processes do not inherit page locks across a fork.
1785 */
1786 sh_unix_memlock();
1787
1788 } else {
1789 setsid(); /* should not fail */
1790 }
1791
1792 /* set working directory
1793 */
1794#ifdef SH_PROFILE
1795 status = 0;
1796#else
1797 status = retry_aud_chdir(FIL__, __LINE__, "/");
1798#endif
1799 if ( (-1) == status )
1800 {
1801 status = errno;
1802 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_W_CHDIR,
1803 sh_error_message (status), "/");
1804 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
1805 }
1806
1807 /* reset timers
1808 */
1809 sh_unix_resettimer();
1810
1811 /* signal handlers
1812 */
1813 sh_unix_resetsignals();
1814#if defined(SCREW_IT_UP)
1815 sh_sigtrap_prepare();
1816#endif
1817 sh_unix_siginstall (goDaemon);
1818
1819 /* set file creation mask
1820 */
1821 (void) umask (0); /* should not fail */
1822
1823 /* set resource limits to maximum, and
1824 * core dump size to zero
1825 */
1826 sh_unix_setlimits();
1827
1828 /* zero out the environment (like PATH='\0')
1829 */
1830 sh_unix_zeroenv();
1831
1832
1833 /* close all file descriptors, and
1834 * open first three streams to /dev/null
1835 */
1836 if (goDaemon == 1)
1837 {
1838 sh_unix_closeall (0, -1); /* if running as daemon */
1839 aud_open(FIL__, __LINE__, SL_NOPRIV, _("/dev/null"), O_RDWR, 0);
1840 retry_aud_dup(FIL__, __LINE__, 0);
1841 retry_aud_dup(FIL__, __LINE__, 0);
1842#if defined(HAVE_LIBPRELUDE)
1843 sh_prelude_reset ();
1844#endif
1845
1846 /* --- wait until parent has exited ---
1847 */
1848 while (1 == 1)
1849 {
1850 errno = 0;
1851 if (0 > aud_kill (FIL__, __LINE__, oldpid, 0) && errno == ESRCH)
1852 {
1853 break;
1854 }
1855 retry_msleep(0, 1);
1856 }
1857
1858 /* write PID file
1859 */
1860 status = sh_unix_write_pid_file();
1861 if (status < 0)
1862 {
1863 sl_get_euid(&uid);
1864 sh_error_handle ((-1), FIL__, __LINE__, status, MSG_PIDFILE,
1865 (long) uid, sh.srvlog.alt);
1866 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
1867 }
1868#if defined(SH_WITH_SERVER)
1869 sh_socket_open_int ();
1870#endif
1871 }
1872 else
1873 {
1874 sh_unix_closeall(3, -1); /* if not daemon */
1875#if defined(HAVE_LIBPRELUDE)
1876 sh_prelude_reset ();
1877#endif
1878#if defined(SH_WITH_SERVER)
1879 sh_socket_open_int ();
1880#endif
1881 }
1882
1883 /* chroot (this is a no-op if no chroot dir is specified
1884 */
1885 status = sh_unix_chroot();
1886 if (status < 0)
1887 {
1888 status = errno;
1889 sh_error_handle((-1), FIL__, __LINE__, status, MSG_E_SUBGEN,
1890 sh_error_message(status), _("chroot"));
1891 aud_exit(FIL__, __LINE__, EXIT_FAILURE);
1892 }
1893
1894 /* drop capabilities
1895 */
1896 sl_drop_cap();
1897
1898 SL_RETURN((0),_("sh_unix_init"));
1899}
1900
1901/********************************************************
1902 *
1903 * TIME
1904 *
1905 ********************************************************/
1906
1907/* Figure out the time offset of the current timezone
1908 * in a portable way.
1909 */
1910char * t_zone(const time_t * xx)
1911{
1912 struct tm aa;
1913 struct tm bb;
1914 struct tm * cc;
1915 int sign = 0;
1916 int diff = 0;
1917 int hh, mm;
1918 static char tz[64];
1919
1920 SL_ENTER(_("t_zone"));
1921
1922
1923 cc = gmtime (xx);
1924 memcpy (&aa, cc, sizeof(struct tm));
1925 cc = localtime (xx);
1926 memcpy (&bb, cc, sizeof(struct tm));
1927
1928 /* Check for datum wrap-around.
1929 */
1930 if (aa.tm_year < bb.tm_year)
1931 sign = (-1);
1932 else if (aa.tm_mon < bb.tm_mon)
1933 sign = (-1);
1934 else if (aa.tm_mday < bb.tm_mday)
1935 sign = (-1);
1936 else if (bb.tm_year < aa.tm_year)
1937 sign = ( 1);
1938 else if (bb.tm_mon < aa.tm_mon)
1939 sign = ( 1);
1940 else if (bb.tm_mday < aa.tm_mday)
1941 sign = ( 1);
1942
1943 diff = aa.tm_hour * 60 + aa.tm_min;
1944 diff = (bb.tm_hour * 60 + bb.tm_min) - diff;
1945 diff = diff - (sign * 24 * 60); /* datum wrap-around correction */
1946 hh = diff / 60;
1947 mm = diff - (hh * 60);
1948 sprintf (tz, _("%+03d%02d"), hh, mm); /* known to fit */
1949
1950 SL_RETURN(tz, _("t_zone"));
1951}
1952
1953unsigned long sh_unix_longtime ()
1954{
1955 return ((unsigned long)time(NULL));
1956}
1957
1958#ifdef HAVE_GETTIMEOFDAY
1959unsigned long sh_unix_notime ()
1960{
1961 struct timeval tv;
1962
1963 gettimeofday (&tv, NULL);
1964
1965 return ((unsigned long)(tv.tv_sec + tv.tv_usec * 10835 + getpid() + getppid()));
1966
1967}
1968#endif
1969
1970static int count_dev_time = 0;
1971
1972void reset_count_dev_time(void)
1973{
1974 count_dev_time = 0;
1975 return;
1976}
1977
1978int sh_unix_settimeserver (const char * address)
1979{
1980
1981 SL_ENTER(_("sh_unix_settimeserver"));
1982
1983 if (address != NULL && count_dev_time < 2
1984 && sl_strlen(address) < SH_PATHBUF)
1985 {
1986 if (count_dev_time == 0)
1987 sl_strlcpy (sh.srvtime.name, address, SH_PATHBUF);
1988 else
1989 sl_strlcpy (sh.srvtime.alt, address, SH_PATHBUF);
1990
1991 ++count_dev_time;
1992 SL_RETURN((0), _("sh_unix_settimeserver"));
1993 }
1994 SL_RETURN((-1), _("sh_unix_settimeserver"));
1995}
1996
1997
1998#ifdef HAVE_NTIME
1999#define UNIXEPOCH 2208988800UL /* difference between Unix time and net time
2000 * The UNIX EPOCH starts in 1970.
2001 */
2002#include <sys/socket.h>
2003#include <netinet/in.h>
2004#include <arpa/inet.h>
2005#include <netdb.h>
2006#include <ctype.h>
2007#endif
2008
2009/* Timeserver service. */
2010/* define is missing on HP-UX 10.20 */
2011#ifndef IPPORT_TIMESERVER
2012#define IPPORT_TIMESERVER 37
2013#endif
2014
2015char * sh_unix_time (time_t thetime)
2016{
2017
2018 int status;
2019
2020 time_t time_now;
2021 struct tm * time_ptr;
2022 static char AsciiTime[81]; /* local time */
2023 static char RetTime[81]; /* local time */
2024#ifdef SH_USE_XML
2025 static char deftime[] = N_("0000-00-00T00:00:00"); /* default time */
2026#else
2027 static char deftime[] = N_("[0000-00-00T00:00:00]"); /* default time */
2028#endif
2029
2030#ifdef HAVE_NTIME
2031 int fd; /* network file descriptor */
2032 u_char net_time[4]; /* remote time in network format */
2033 static int failerr = 0; /* no net time */
2034 int fail = 0; /* no net time */
2035 int errflag;
2036 char errmsg[256];
2037 char error_call[SH_MINIBUF];
2038 int error_num;
2039#endif
2040
2041 SL_ENTER(_("sh_unix_time"));
2042
2043#ifdef HAVE_NTIME
2044 if (thetime == 0)
2045 {
2046 if (sh.srvtime.name[0] == '\0')
2047 {
2048 fail = 1;
2049 (void) time (&time_now);
2050 }
2051 else /* have a timeserver address */
2052 {
2053 fd = connect_port_2 (sh.srvtime.name, sh.srvtime.alt,
2054 IPPORT_TIMESERVER,
2055 error_call, &error_num, errmsg, sizeof(errmsg));
2056 if (fd >= 0)
2057 {
2058 if (4 != read_port (fd, (char *) net_time, 4, &errflag, 2))
2059 {
2060 fail = 1;
2061 sh_error_handle ((-1), FIL__, __LINE__, errflag,
2062 MSG_E_NLOST,
2063 _("time"), sh.srvtime.name);
2064 }
2065 close(fd);
2066 }
2067 else
2068 {
2069 sh_error_handle ((-1), FIL__, __LINE__, error_num,
2070 MSG_E_NET, errmsg, error_call,
2071 _("time"), sh.srvtime.name);
2072 fail = 1;
2073 }
2074
2075 if (fail == 0)
2076 {
2077 time_now = ntohl(* (long *) net_time) - UNIXEPOCH;
2078 /* fprintf(stderr, "TIME IS %ld\n", time_now); */
2079 if (failerr == 1) {
2080 failerr = 0;
2081 sh_error_handle ((-1), FIL__, __LINE__, 0,
2082 MSG_E_NEST,
2083 _("time"), sh.srvtime.name);
2084 }
2085 }
2086 else
2087 {
2088 (void) time (&time_now);
2089 if (failerr == 0)
2090 {
2091 failerr = 1;
2092 sh_error_handle ((-1), FIL__, __LINE__, errflag,
2093 MSG_SRV_FAIL,
2094 _("time"), sh.srvtime.name);
2095 }
2096 }
2097 }
2098 }
2099 else
2100 {
2101 time_now = thetime;
2102 }
2103
2104 /* #ifdef HAVE_NTIME */
2105#else
2106
2107 if (thetime == 0)
2108 {
2109 (void) time (&time_now);
2110 }
2111 else
2112 {
2113 time_now = thetime;
2114 }
2115
2116 /* #ifdef HAVE_NTIME */
2117#endif
2118
2119 if (time_now == (-1) )
2120 SL_RETURN( _(deftime), _("sh_unix_time"));
2121 else
2122 time_ptr = localtime (&time_now);
2123
2124 if (time_ptr != NULL)
2125 {
2126 status = strftime (AsciiTime, 80,
2127#ifdef SH_USE_XML
2128 _("%Y-%m-%dT%H:%M:%S%%s"),
2129#else
2130 _("[%Y-%m-%dT%H:%M:%S%%s]"),
2131#endif
2132 time_ptr);
2133
2134 sl_snprintf(RetTime, 80, AsciiTime, t_zone(&time_now));
2135
2136 if ( (status == 0) || (status == 80) )
2137 SL_RETURN( _(deftime), _("sh_unix_time"));
2138 else
2139 SL_RETURN( &RetTime[0], _("sh_unix_time"));
2140 }
2141
2142 /* last resort
2143 */
2144 SL_RETURN( _(deftime), _("sh_unix_time"));
2145}
2146
2147static int sh_unix_use_localtime = S_FALSE;
2148
2149/* whether to use localtime for file timesatams in logs
2150 */
2151int sh_unix_uselocaltime (const char * c)
2152{
2153 int i;
2154 SL_ENTER(_("sh_unix_uselocaltime"));
2155 i = sh_util_flagval(c, &(sh_unix_use_localtime));
2156
2157 SL_RETURN(i, _("sh_unix_uselocaltime"));
2158}
2159
2160char * sh_unix_gmttime (time_t thetime)
2161{
2162
2163 int status;
2164
2165 struct tm * time_ptr;
2166 static char AsciiTime[81]; /* GMT time */
2167#ifdef SH_USE_XML
2168 static char deftime[] = N_("0000-00-00T00:00:00"); /* default time */
2169#else
2170 static char deftime[] = N_("[0000-00-00T00:00:00]"); /* default time */
2171#endif
2172
2173 SL_ENTER(_("sh_unix_gmttime"));
2174
2175 if (sh_unix_use_localtime == S_FALSE)
2176 time_ptr = gmtime (&thetime);
2177 else
2178 time_ptr = localtime (&thetime);
2179
2180 if (time_ptr != NULL)
2181 {
2182 status = strftime (AsciiTime, 80,
2183#ifdef SH_USE_XML
2184 _("%Y-%m-%dT%H:%M:%S"),
2185#else
2186 _("[%Y-%m-%dT%H:%M:%S]"),
2187#endif
2188 time_ptr);
2189
2190 if ( (status == 0) || (status == 80) )
2191 SL_RETURN( _(deftime), _("sh_unix_gmttime"));
2192 else
2193 SL_RETURN( &AsciiTime[0], _("sh_unix_gmttime"));
2194 }
2195
2196 /* last resort
2197 */
2198 SL_RETURN( _(deftime), _("sh_unix_gmttime"));
2199}
2200
2201
2202
2203char * sh_unix_getUIDdir (int level, uid_t uid)
2204{
2205 struct passwd * tempres;
2206 int status = 0;
2207
2208 SL_ENTER(_("sh_unix_getUIDdir"));
2209
2210 errno = 0;
2211 tempres = sh_getpwuid(uid);
2212 status = errno;
2213
2214 if (tempres == NULL) {
2215 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
2216 sh_error_message(status),
2217 _("getpwuid"), (long) uid, _("completely missing"));
2218 SL_RETURN( NULL, _("sh_unix_getUIDdir"));
2219 }
2220
2221 if (tempres->pw_dir != NULL) {
2222 SL_RETURN( tempres->pw_dir, _("sh_unix_getUIDdir"));
2223 } else {
2224 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
2225 sh_error_message(status),
2226 _("getpwuid"), (long) uid, _("pw_dir"));
2227 SL_RETURN( NULL, _("sh_unix_getUIDdir"));
2228 }
2229}
2230
2231char * sh_unix_getUIDname (int level, uid_t uid)
2232{
2233 struct passwd * tempres;
2234 int status = 0;
2235 static uid_t old_uid;
2236 static char name[32] = { '\0' };
2237
2238 SL_ENTER(_("sh_unix_getUIDname"));
2239
2240 if ((uid == old_uid) && (name[0] != '\0')) {
2241 SL_RETURN( name, _("sh_unix_getUIDname"));
2242 }
2243
2244 errno = 0;
2245 tempres = sh_getpwuid(uid);
2246 status = errno;
2247
2248 if (tempres == NULL) {
2249 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
2250 sh_error_message(status),
2251 _("getpwuid"), (long) uid, _("completely missing"));
2252 SL_RETURN( NULL, _("sh_unix_getUIDname"));
2253 }
2254
2255
2256 if (tempres->pw_name != NULL) {
2257 sl_strlcpy(name, tempres->pw_name, sizeof(name));
2258 old_uid = uid;
2259 SL_RETURN( name, _("sh_unix_getUIDname"));
2260 } else {
2261 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_PWNULL,
2262 sh_error_message(status),
2263 _("getpwuid"), (long) uid, _("pw_user"));
2264 SL_RETURN( NULL, _("sh_unix_getUIDname"));
2265 }
2266}
2267
2268char * sh_unix_getGIDname (int level, gid_t gid)
2269{
2270 struct group * tempres;
2271 int status = 0;
2272 static gid_t old_gid;
2273 static char name[32] = { '\0' };
2274
2275 SL_ENTER(_("sh_unix_getGIDname"));
2276
2277 if ((gid == old_gid) && (name[0] != '\0')) {
2278 SL_RETURN( name, _("sh_unix_getUIDname"));
2279 }
2280
2281 errno = 0;
2282 tempres = sh_getgrgid(gid);
2283 status = errno;
2284
2285 if (tempres == NULL) {
2286 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_GRNULL,
2287 sh_error_message(status),
2288 _("getgrgid"), (long) gid, _("completely missing"));
2289
2290 SL_RETURN( NULL, _("sh_unix_getGIDname"));
2291 }
2292
2293 if (tempres->gr_name != NULL) {
2294 sl_strlcpy(name, tempres->gr_name, sizeof(name));
2295 old_gid = gid;
2296 SL_RETURN( name, _("sh_unix_getGIDname"));
2297 } else {
2298 sh_error_handle (level, FIL__, __LINE__, EINVAL, MSG_E_GRNULL,
2299 sh_error_message(status),
2300 _("getgrgid"), (long) gid, _("gr_name"));
2301 SL_RETURN( NULL, _("sh_unix_getGIDname"));
2302 }
2303}
2304
2305int sh_unix_getUser ()
2306{
2307 char * p;
2308 uid_t seuid, sruid;
2309
2310 SL_ENTER(_("sh_unix_getUser"));
2311
2312 seuid = geteuid();
2313
2314 sh.effective.uid = seuid;
2315
2316 p = sh_unix_getUIDdir (SH_ERR_ERR, seuid);
2317
2318 if (p == NULL)
2319 SL_RETURN((-1), _("sh_unix_getUser"));
2320 else
2321 {
2322 if (sl_strlen(p) >= SH_PATHBUF) {
2323 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_PWLONG,
2324 _("getpwuid"), (long) seuid, _("pw_home"));
2325 SL_RETURN((-1), _("sh_unix_getUser"));
2326 } else {
2327 sl_strlcpy ( sh.effective.home, p, SH_PATHBUF);
2328 }
2329 }
2330
2331 sruid = getuid();
2332
2333 sh.real.uid = sruid;
2334
2335 p = sh_unix_getUIDname (SH_ERR_ERR, sruid);
2336 if (p == NULL)
2337 SL_RETURN((-1), _("sh_unix_getUser"));
2338 else
2339 {
2340 if (sl_strlen(p) >= USER_MAX) {
2341 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_PWLONG,
2342 _("getpwuid"), (long) sruid, _("pw_user"));
2343 SL_RETURN((-1), _("sh_unix_getUser"));
2344 } else {
2345 sl_strlcpy ( sh.real.user, p, USER_MAX);
2346 }
2347 }
2348
2349 p = sh_unix_getUIDdir (SH_ERR_ERR, sruid);
2350
2351 if (p == NULL)
2352 SL_RETURN((-1), _("sh_unix_getUser"));
2353 else
2354 {
2355 if (sl_strlen(p) >= SH_PATHBUF) {
2356 sh_error_handle (SH_ERR_ERR, FIL__, __LINE__, EINVAL, MSG_E_PWLONG,
2357 _("getpwuid"), (long) sruid, _("pw_home"));
2358 SL_RETURN((-1), _("sh_unix_getUser"));
2359 } else {
2360 sl_strlcpy ( sh.real.home, p, SH_PATHBUF);
2361 }
2362 }
2363
2364 SL_RETURN((0), _("sh_unix_getUser"));
2365
2366 /* notreached */
2367}
2368
2369
2370int sh_unix_getline (SL_TICKET fd, char * line, int sizeofline)
2371{
2372 register int count;
2373 register int n = 0;
2374 char c;
2375
2376 SL_ENTER(_("sh_unix_getline"));
2377
2378 if (sizeofline < 2) {
2379 line[0] = '\0';
2380 SL_RETURN((0), _("sh_unix_getline"));
2381 }
2382
2383 --sizeofline;
2384
2385 while (n < sizeofline) {
2386
2387 count = sl_read (fd, &c, 1);
2388
2389 /* end of file
2390 */
2391 if (count < 1) {
2392 line[n] = '\0';
2393 n = -1;
2394 break;
2395 }
2396
2397 if (/* c != '\0' && */ c != '\n') {
2398 line[n] = c;
2399 ++n;
2400 } else if (c == '\n') {
2401 if (n > 0) {
2402 line[n] = '\0';
2403 break;
2404 } else {
2405 line[n] = '\n'; /* get newline only if only char on line */
2406 ++n;
2407 line[n] = '\0';
2408 break;
2409 }
2410 } else {
2411 line[n] = '\0';
2412 break;
2413 }
2414
2415 }
2416
2417
2418 line[sizeofline] = '\0'; /* make sure line is terminated */
2419 SL_RETURN((n), _("sh_unix_getline"));
2420}
2421
2422
2423#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
2424
2425/**************************************************************
2426 *
2427 * --- FILE INFO ---
2428 *
2429 **************************************************************/
2430
2431#if (defined(__linux__) && (defined(HAVE_LINUX_EXT2_FS_H) || defined(HAVE_EXT2FS_EXT2_FS_H))) || defined(HAVE_STAT_FLAGS)
2432
2433#if defined(__linux__)
2434
2435/* --- Determine ext2fs file attributes. ---
2436 */
2437#include <sys/ioctl.h>
2438#if defined(HAVE_EXT2FS_EXT2_FS_H)
2439#include <ext2fs/ext2_fs.h>
2440#else
2441#include <linux/ext2_fs.h>
2442#endif
2443
2444/* __linux__ includes */
2445#endif
2446
2447static
2448int sh_unix_getinfo_attr (char * name,
2449 unsigned long * flags,
2450 char * c_attr,
2451 int fd, struct stat * buf)
2452{
2453
2454/* TAKEN FROM:
2455 *
2456 * lsattr.c - List file attributes on an ext2 file system
2457 *
2458 * Copyright (C) 1993, 1994 Remy Card <card@masi.ibp.fr>
2459 * Laboratoire MASI, Institut Blaise Pascal
2460 * Universite Pierre et Marie Curie (Paris VI)
2461 *
2462 * This file can be redistributed under the terms of the GNU General
2463 * Public License
2464 */
2465
2466#ifdef HAVE_STAT_FLAGS
2467
2468 SL_ENTER(_("sh_unix_getinfo_attr"));
2469
2470 *flags = 0;
2471
2472 /* cast to void to avoid compiler warning about unused parameters */
2473 (void) fd;
2474 (void) name;
2475
2476#ifdef UF_NODUMP
2477 if (buf->st_flags & UF_NODUMP) {
2478 *flags |= UF_NODUMP;
2479 c_attr[0] = 'd';
2480 }
2481#endif
2482#ifdef UF_IMMUTABLE
2483 if (buf->st_flags & UF_IMMUTABLE) {
2484 *flags |= UF_IMMUTABLE;
2485 c_attr[1] = 'i';
2486 }
2487#endif
2488#ifdef UF_APPEND
2489 if (buf->st_flags & UF_APPEND) {
2490 *flags |= UF_APPEND;
2491 c_attr[2] = 'a';
2492 }
2493#endif
2494#ifdef UF_NOUNLINK
2495 if (buf->st_flags & UF_NOUNLINK) {
2496 *flags |= UF_NOUNLINK;
2497 c_attr[3] = 'u';
2498 }
2499#endif
2500#ifdef UF_OPAQUE
2501 if (buf->st_flags & UF_OPAQUE) {
2502 *flags |= UF_OPAQUE;
2503 c_attr[4] = 'o';
2504 }
2505#endif
2506#ifdef SF_ARCHIVED
2507 if (buf->st_flags & SF_ARCHIVED) {
2508 *flags |= SF_ARCHIVED;
2509 c_attr[5] = 'R';
2510 }
2511
2512#endif
2513#ifdef SF_IMMUTABLE
2514 if (buf->st_flags & SF_IMMUTABLE) {
2515 *flags |= SF_IMMUTABLE;
2516 c_attr[6] = 'I';
2517 }
2518#endif
2519#ifdef SF_APPEND
2520 if (buf->st_flags & SF_APPEND) {
2521 *flags |= SF_APPEND;
2522 c_attr[7] = 'A';
2523 }
2524#endif
2525#ifdef SF_NOUNLINK
2526 if (buf->st_flags & SF_NOUNLINK) {
2527 *flags |= SF_NOUNLINK;
2528 c_attr[8] = 'U';
2529 }
2530#endif
2531
2532 /* ! HAVE_STAT_FLAGS */
2533#else
2534
2535#ifdef HAVE_EXT2_IOCTLS
2536 int /* fd, */ r, f;
2537
2538 SL_ENTER(_("sh_unix_getinfo_attr"));
2539
2540 *flags = 0;
2541 (void) buf;
2542
2543 /* open() -> aud_open() R.Wichmann
2544 fd = aud_open (FIL__, __LINE__, SL_YESPRIV, name, O_RDONLY|O_NONBLOCK, 0);
2545 */
2546
2547 if (fd == -1 || name == NULL)
2548 SL_RETURN(-1, _("sh_unix_getinfo_attr"));
2549
2550
2551 r = ioctl (fd, EXT2_IOC_GETFLAGS, &f);
2552 /* close (fd); */
2553
2554 if (r == -1)
2555 SL_RETURN(-1, _("sh_unix_getinfo_attr"));
2556
2557 if (f == 0)
2558 SL_RETURN(0, _("sh_unix_getinfo_attr"));
2559
2560 *flags = f;
2561
2562/* ! HAVE_EXT2_IOCTLS */
2563#else
2564
2565 SL_ENTER(_("sh_unix_getinfo_attr"));
2566
2567 *flags = 0; /* modified by R.Wichmann */
2568
2569/* ! HAVE_EXT2_IOCTLS */
2570#endif
2571/*
2572 * END
2573 *
2574 * lsattr.c - List file attributes on an ext2 file system
2575 */
2576
2577 if (*flags == 0)
2578 goto theend;
2579
2580#ifdef EXT2_SECRM_FL
2581 if ( (*flags & EXT2_SECRM_FL) != 0 ) c_attr[0] = 's';
2582#endif
2583#ifdef EXT2_UNRM_FL
2584 if ( (*flags & EXT2_UNRM_FL) != 0 ) c_attr[1] = 'u';
2585#endif
2586#ifdef EXT2_SYNC_FL
2587 if ( (*flags & EXT2_SYNC_FL) != 0 ) c_attr[2] = 'S';
2588#endif
2589#ifdef EXT2_IMMUTABLE_FL
2590 if ( (*flags & EXT2_IMMUTABLE_FL) != 0) c_attr[3] = 'i';
2591#endif
2592#ifdef EXT2_APPEND_FL
2593 if ( (*flags & EXT2_APPEND_FL) != 0 ) c_attr[4] = 'a';
2594#endif
2595#ifdef EXT2_NODUMP_FL
2596 if ( (*flags & EXT2_NODUMP_FL) != 0 ) c_attr[5] = 'd';
2597#endif
2598#ifdef EXT2_NOATIME_FL
2599 if ( (*flags & EXT2_NOATIME_FL) != 0) c_attr[6] = 'A';
2600#endif
2601#ifdef EXT2_COMPR_FL
2602 if ( (*flags & EXT2_COMPR_FL) != 0 ) c_attr[7] = 'c';
2603#endif
2604
2605#ifdef EXT2_TOPDIR_FL
2606 if ( (*flags & EXT2_TOPDIR_FL) != 0 ) c_attr[8] = 'T';
2607#endif
2608#ifdef EXT2_DIRSYNC_FL
2609 if ( (*flags & EXT2_DIRSYNC_FL) != 0 ) c_attr[9] = 'D';
2610#endif
2611#ifdef EXT2_NOTAIL_FL
2612 if ( (*flags & EXT2_NOTAIL_FL) != 0 ) c_attr[10] = 't';
2613#endif
2614#ifdef EXT2_JOURNAL_DATA_FL
2615 if ( (*flags & EXT2_JOURNAL_DATA_FL) != 0) c_attr[11] = 'j';
2616#endif
2617
2618 theend:
2619 /* ext2 */
2620#endif
2621
2622 c_attr[12] = '\0';
2623
2624 SL_RETURN(0, _("sh_unix_getinfo_attr"));
2625}
2626#else
2627static
2628int sh_unix_getinfo_attr (char * name,
2629 unsigned long * flags,
2630 char * c_attr,
2631 int fd, struct stat * buf)
2632{
2633 return 0;
2634}
2635
2636/* defined(__linux__) || defined(HAVE_STAT_FLAGS) */
2637#endif
2638
2639/* determine file type
2640 */
2641static
2642int sh_unix_getinfo_type (struct stat * buf,
2643 ShFileType * type,
2644 char * c_mode)
2645{
2646 SL_ENTER(_("sh_unix_getinfo_type"));
2647
2648 if ( S_ISREG(buf->st_mode) ) {
2649 (*type) = SH_FILE_REGULAR;
2650 c_mode[0] = '-';
2651 }
2652 else if ( S_ISLNK(buf->st_mode) ) {
2653 (*type) = SH_FILE_SYMLINK;
2654 c_mode[0] = 'l';
2655 }
2656 else if ( S_ISDIR(buf->st_mode) ) {
2657 (*type) = SH_FILE_DIRECTORY;
2658 c_mode[0] = 'd';
2659 }
2660 else if ( S_ISCHR(buf->st_mode) ) {
2661 (*type) = SH_FILE_CDEV;
2662 c_mode[0] = 'c';
2663 }
2664 else if ( S_ISBLK(buf->st_mode) ) {
2665 (*type) = SH_FILE_BDEV;
2666 c_mode[0] = 'b';
2667 }
2668 else if ( S_ISFIFO(buf->st_mode) ) {
2669 (*type) = SH_FILE_FIFO;
2670 c_mode[0] = '|';
2671 }
2672 else if ( S_ISSOCK(buf->st_mode) ) {
2673 (*type) = SH_FILE_SOCKET;
2674 c_mode[0] = 's';
2675 }
2676 else {
2677 (*type) = SH_FILE_UNKNOWN;
2678 c_mode[0] = '?';
2679 }
2680
2681 SL_RETURN(0, _("sh_unix_getinfo_type"));
2682}
2683
2684int sh_unix_get_ftype(char * fullpath)
2685{
2686 char c_mode[16];
2687 struct stat buf;
2688 ShFileType type;
2689 int res;
2690
2691 SL_ENTER(_("sh_unix_get_ftype"));
2692
2693 res = retry_lstat(FIL__, __LINE__, fullpath, &buf);
2694
2695 if (res < 0)
2696 SL_RETURN(SH_FILE_UNKNOWN, _("sh_unix_getinfo_type"));
2697
2698 sh_unix_getinfo_type (&buf, &type, c_mode);
2699
2700 SL_RETURN(type, _("sh_unix_get_ftype"));
2701}
2702
2703
2704static
2705int sh_unix_getinfo_mode (struct stat *buf,
2706 unsigned int * mode,
2707 char * c_mode)
2708{
2709
2710 SL_ENTER(_("sh_unix_getinfo_mode"));
2711
2712 (*mode) = buf->st_mode;
2713
2714 /* make 'ls'-like string */
2715
2716 if ( (buf->st_mode & S_IRUSR) != 0 ) c_mode[1] = 'r';
2717 if ( (buf->st_mode & S_IWUSR) != 0 ) c_mode[2] = 'w';
2718 if ( (buf->st_mode & S_IXUSR) != 0 ) {
2719 if ((buf->st_mode & S_ISUID) != 0 ) c_mode[3] = 's';
2720 else c_mode[3] = 'x';
2721 } else {
2722 if ((buf->st_mode & S_ISUID) != 0 ) c_mode[3] = 'S';
2723 }
2724
2725 if ( (buf->st_mode & S_IRGRP) != 0 ) c_mode[4] = 'r';
2726 if ( (buf->st_mode & S_IWGRP) != 0 ) c_mode[5] = 'w';
2727 if ( (buf->st_mode & S_IXGRP) != 0 ) {
2728 if ((buf->st_mode & S_ISGID) != 0 ) c_mode[6] = 's';
2729 else c_mode[6] = 'x';
2730 } else {
2731 if ((buf->st_mode & S_ISGID) != 0 ) c_mode[6] = 'S';
2732 }
2733
2734 if ( (buf->st_mode & S_IROTH) != 0 ) c_mode[7] = 'r';
2735 if ( (buf->st_mode & S_IWOTH) != 0 ) c_mode[8] = 'w';
2736#ifdef S_ISVTX /* not POSIX */
2737 if ( (buf->st_mode & S_IXOTH) != 0 ) {
2738 if ((buf->st_mode & S_ISVTX) != 0 ) c_mode[9] = 't';
2739 else c_mode[9] = 'x';
2740 } else {
2741 if ((buf->st_mode & S_ISVTX) != 0 ) c_mode[9] = 'T';
2742 }
2743#else
2744 if ( (buf->st_mode & S_IXOTH) != 0 ) c_mode[9] = 'x';
2745#endif
2746
2747 SL_RETURN(0, _("sh_unix_getinfo_mode"));
2748}
2749
2750
2751long IO_Limit = 0;
2752
2753void sh_unix_io_pause ()
2754{
2755 long runtime;
2756 float someval;
2757 unsigned long sometime;
2758
2759 if (IO_Limit == 0)
2760 {
2761 return;
2762 }
2763 else
2764 {
2765 runtime = (long) (time(NULL) - sh.statistics.time_start);
2766
2767 if (runtime > 0 && (long)(sh.statistics.bytes_hashed/runtime) > IO_Limit)
2768 {
2769 someval = sh.statistics.bytes_hashed - (IO_Limit * runtime);
2770 someval /= (float) IO_Limit;
2771 if (someval < 1.0)
2772 {
2773 someval *= 1000; /* milliseconds in a second */
2774 sometime = (unsigned long) someval;
2775 /* fprintf(stderr, "FIXME PAUSE %ld\n", sometime); */
2776 retry_msleep(0, sometime);
2777 }
2778 else
2779 {
2780 sometime = (unsigned long) someval;
2781 /* fprintf(stderr, "FIXME PAUSE %ld sec\n", sometime); */
2782 retry_msleep (sometime, 0);
2783 }
2784 }
2785 }
2786 return;
2787}
2788
2789int sh_unix_set_io_limit (const char * c)
2790{
2791 long val;
2792
2793 SL_ENTER(_("sh_unix_set_io_limit"));
2794
2795 val = strtol (c, (char **)NULL, 10);
2796 if (val < 0)
2797 sh_error_handle ((-1), FIL__, __LINE__, EINVAL, MSG_EINVALS,
2798 _("set I/O limit"), c);
2799
2800 val = (val < 0 ? 0 : val);
2801
2802 IO_Limit = val * 1024;
2803 SL_RETURN( 0, _("sh_unix_set_io_limit"));
2804}
2805
2806/* obtain file info
2807 */
2808extern int flag_err_debug;
2809
2810#include "sh_ignore.h"
2811
2812int sh_unix_checksum_size (char * filename, struct stat * fbuf,
2813 char * fileHash, int alert_timeout)
2814{
2815 file_type tmpFile;
2816 int status;
2817
2818 SL_ENTER(_("sh_unix_checksum_size"));
2819
2820 /* lookup file in database */
2821 status = sh_hash_get_it (filename, &tmpFile);
2822 if (status != 0) {
2823 goto out;
2824 }
2825
2826 /* if last < current get checksum */
2827 if (tmpFile.size < fbuf->st_size)
2828 {
2829 sl_strlcpy(fileHash,
2830 sh_tiger_generic_hash (filename, TIGER_FD, tmpFile.size,
2831 alert_timeout),
2832 KEY_LEN+1);
2833
2834 /* return */
2835 SL_RETURN( 0, _("sh_unix_checksum_size"));
2836 }
2837
2838 out:
2839 sl_strlcpy(fileHash,
2840 _("000000000000000000000000000000000000000000000000"),
2841 KEY_LEN+1);
2842 SL_RETURN( -1, _("sh_unix_checksum_size"));
2843}
2844
2845int sh_unix_getinfo (int level, char * filename, file_type * theFile,
2846 char * fileHash, int policy)
2847{
2848 char timestr[81];
2849 long runtim;
2850 struct stat buf;
2851 struct stat lbuf;
2852 struct stat fbuf;
2853 int stat_return;
2854
2855 ShFileType type;
2856 unsigned int mode;
2857 char * name;
2858 char * tmp;
2859 char * tmp2;
2860
2861 char * linknamebuf;
2862 int linksize;
2863
2864 extern int get_the_fd (SL_TICKET ticket);
2865
2866 SL_TICKET rval_open;
2867 int fd;
2868 int fstat_return;
2869
2870 time_t tend;
2871 time_t tstart;
2872
2873
2874 char * path = NULL;
2875
2876 int alert_timeout = 120;
2877
2878 path = theFile->fullpath;
2879
2880 SL_ENTER(_("sh_unix_getinfo"));
2881
2882 /* --- Stat the file, and get checksum. ---
2883 */
2884 tstart = time(NULL);
2885
2886 stat_return = retry_lstat (FIL__, __LINE__,
2887 path /* theFile->fullpath */, &buf);
2888
2889 fd = -1;
2890 fstat_return = -1;
2891 rval_open = -1;
2892
2893 if (stat_return == 0 && S_ISREG(buf.st_mode))
2894 {
2895 rval_open = sl_open_fastread (path /* theFile->fullpath */, SL_YESPRIV);
2896
2897 alert_timeout = 120; /* this is per 8K block now ! */
2898
2899 if (path[1] == 'p' && path[5] == '/' && path[2] == 'r' &&
2900 path[3] == 'o' && path[4] == 'c' && path[0] == '/')
2901 {
2902 /* seven is magic */
2903 alert_timeout = 7;
2904 }
2905
2906 fd = get_the_fd(rval_open);
2907 }
2908
2909 tend = time(NULL);
2910
2911 /* An unprivileged user may slow lstat/open to a crawl
2912 * with clever path/symlink setup
2913 */
2914 if ((tend - tstart) > (time_t) /* 60 */ 6)
2915 {
2916 tmp2 = sh_util_safe_name (theFile->fullpath);
2917 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_TOOLATE,
2918 (long)(tend - tstart), tmp2);
2919 SH_FREE(tmp2);
2920 }
2921
2922 if (fd >= 0)
2923 fstat_return = retry_fstat (FIL__, __LINE__, fd, &fbuf);
2924 else
2925 fd = -1;
2926
2927
2928 /* --- case 1: lstat failed ---
2929 */
2930 if (stat_return != 0)
2931 {
2932 stat_return = errno;
2933 if (!SL_ISERROR(rval_open))
2934 sl_close(rval_open);
2935 if (sh.flag.checkSum == SH_CHECK_INIT ||
2936 (sh_hash_have_it (theFile->fullpath) >= 0 &&
2937 theFile->reported == S_FALSE))
2938 {
2939 if (S_FALSE == sh_ignore_chk_del(theFile->fullpath)) {
2940 tmp2 = sh_util_safe_name (theFile->fullpath);
2941 sh_error_handle (level, FIL__, __LINE__, stat_return, MSG_FI_LSTAT,
2942 sh_error_message (stat_return), tmp2);
2943 SH_FREE(tmp2);
2944 }
2945 }
2946 SL_RETURN((-1),_("sh_unix_getinfo"));
2947 }
2948
2949 /* --- case 2: not a regular file ---
2950 */
2951 else if (! S_ISREG(buf.st_mode))
2952 {
2953 if (fileHash != NULL)
2954 sl_strlcpy(fileHash,
2955 _("000000000000000000000000000000000000000000000000"),
2956 KEY_LEN+1);
2957 }
2958
2959 /* --- case 3a: a regular file, fstat ok ---
2960 */
2961 else if (fstat_return == 0 &&
2962 buf.st_mode == fbuf.st_mode &&
2963 buf.st_ino == fbuf.st_ino &&
2964 buf.st_uid == fbuf.st_uid &&
2965 buf.st_gid == fbuf.st_gid &&
2966 buf.st_dev == fbuf.st_dev )
2967 {
2968 if (fileHash != NULL)
2969 {
2970 if ((theFile->check_mask & MODI_CHK) == 0)
2971 {
2972 sl_strlcpy(fileHash,
2973 _("000000000000000000000000000000000000000000000000"),
2974 KEY_LEN+1);
2975 }
2976 else if ((theFile->check_mask & MODI_PREL) != 0 &&
2977 S_TRUE == sh_prelink_iself(rval_open, fbuf.st_size,
2978 alert_timeout))
2979 {
2980 if (0 != sh_prelink_run (theFile->fullpath,
2981 fileHash, alert_timeout))
2982 sl_strlcpy(fileHash,
2983 _("000000000000000000000000000000000000000000000000"),
2984 KEY_LEN+1);
2985 }
2986 else
2987 {
2988 tiger_fd = rval_open;
2989 sl_strlcpy(fileHash,
2990 sh_tiger_generic_hash (theFile->fullpath,
2991 TIGER_FD, 0,
2992 alert_timeout),
2993 KEY_LEN+1);
2994 if ((theFile->check_mask & MODI_SGROW) != 0)
2995 {
2996 sl_rewind(rval_open);
2997 tiger_fd = rval_open;
2998 sh_unix_checksum_size (theFile->fullpath, &fbuf,
2999 &fileHash[KEY_LEN + 1],
3000 alert_timeout);
3001 }
3002 }
3003 }
3004 }
3005
3006 /* --- case 3b: a regular file, fstat ok, but different ---
3007 */
3008 else if (fstat_return == 0 && S_ISREG(fbuf.st_mode))
3009 {
3010 memcpy (&buf, &fbuf, sizeof( struct stat ));
3011
3012 if (fileHash != NULL)
3013 {
3014 if ((theFile->check_mask & MODI_CHK) == 0)
3015 {
3016 sl_strlcpy(fileHash,
3017 _("000000000000000000000000000000000000000000000000"),
3018 KEY_LEN+1);
3019 }
3020 else if (policy == SH_LEVEL_PRELINK &&
3021 S_TRUE == sh_prelink_iself(rval_open, fbuf.st_size,
3022 alert_timeout))
3023 {
3024 if (0 != sh_prelink_run (theFile->fullpath,
3025 fileHash, alert_timeout))
3026 sl_strlcpy(fileHash,
3027 _("000000000000000000000000000000000000000000000000"),
3028 KEY_LEN+1);
3029 }
3030 else
3031 {
3032 tiger_fd = rval_open;
3033 sl_strlcpy(fileHash,
3034 sh_tiger_generic_hash (theFile->fullpath, TIGER_FD, 0,
3035 alert_timeout),
3036 KEY_LEN + 1);
3037 if ((theFile->check_mask & MODI_SGROW) != 0)
3038 {
3039 sl_rewind(rval_open);
3040 tiger_fd = rval_open;
3041 sh_unix_checksum_size (theFile->fullpath, &fbuf,
3042 &fileHash[KEY_LEN + 1],
3043 alert_timeout);
3044 }
3045 }
3046 }
3047 }
3048
3049 /* --- case 4: a regular file, fstat failed ---
3050 */
3051
3052 else /* fstat_return != 0 or !S_ISREG(fbuf->st_mode) */
3053 {
3054 fstat_return = errno;
3055 if (fileHash != NULL)
3056 sl_strlcpy(fileHash,
3057 _("000000000000000000000000000000000000000000000000"),
3058 KEY_LEN + 1);
3059
3060 tmp2 = sh_util_safe_name (theFile->fullpath);
3061 sh_error_handle (level, FIL__, __LINE__, fstat_return, MSG_E_READ,
3062 tmp2);
3063 SH_FREE(tmp2);
3064 }
3065
3066
3067 /* --- Determine file type. ---
3068 */
3069 memset (theFile->c_mode, '-', 10);
3070 theFile->c_mode[10] = '\0';
3071
3072 memset (theFile->link_c_mode, '-', 10);
3073 theFile->link_c_mode[10] = '\0';
3074
3075 sh_unix_getinfo_type (&buf, &type, theFile->c_mode);
3076 theFile->type = type;
3077
3078#if defined(__linux__) || defined(HAVE_STAT_FLAGS)
3079
3080 /* --- Determine file attributes. ---
3081 */
3082 memset (theFile->c_attributes, '-', 12);
3083 theFile->c_attributes[12] = '\0';
3084 theFile->attributes = 0;
3085
3086 if (theFile->c_mode[0] != 'c' && theFile->c_mode[0] != 'b' &&
3087 theFile->c_mode[0] != 'l' )
3088 sh_unix_getinfo_attr(theFile->fullpath,
3089 &theFile->attributes, theFile->c_attributes,
3090 fd, &buf);
3091#endif
3092
3093 if (!SL_ISERROR(rval_open))
3094 sl_close(rval_open);
3095
3096
3097 /* --- I/O limit. ---
3098 */
3099 if (IO_Limit > 0)
3100 {
3101 runtim = (long) (time(NULL) - sh.statistics.time_start);
3102
3103 if (runtim > 0 && (long)(sh.statistics.bytes_hashed/runtim) > IO_Limit)
3104 retry_msleep(1, 0);
3105 }
3106
3107 /* --- Determine permissions. ---
3108 */
3109 sh_unix_getinfo_mode (&buf, &mode, theFile->c_mode);
3110
3111 /* --- Trivia. ---
3112 */
3113 theFile->dev = buf.st_dev;
3114 theFile->ino = buf.st_ino;
3115 theFile->mode = buf.st_mode;
3116 theFile->hardlinks = buf.st_nlink;
3117 theFile->owner = buf.st_uid;
3118 theFile->group = buf.st_gid;
3119 theFile->rdev = buf.st_rdev;
3120 theFile->size = buf.st_size;
3121 theFile->blksize = (unsigned long) buf.st_blksize;
3122 theFile->blocks = (unsigned long) buf.st_blocks;
3123 theFile->atime = buf.st_atime;
3124 theFile->mtime = buf.st_mtime;
3125 theFile->ctime = buf.st_ctime;
3126
3127
3128 /* --- Owner and group. ---
3129 */
3130
3131 if ( (name = sh_unix_getGIDname(SH_ERR_ALL,
3132 buf.st_gid)) != NULL) {
3133 sl_strlcpy (theFile->c_group, name, GROUP_MAX+1);
3134 } else {
3135
3136 tmp2 = sh_util_safe_name (theFile->fullpath);
3137
3138 if (policy == SH_LEVEL_ALLIGNORE)
3139 {
3140 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, ENOENT,
3141 MSG_FI_NOGRP,
3142 (long) buf.st_gid, tmp2);
3143 }
3144 else
3145 {
3146 sh_error_handle (ShDFLevel[SH_ERR_T_NAME], FIL__, __LINE__, ENOENT,
3147 MSG_FI_NOGRP,
3148 (long) buf.st_gid, tmp2);
3149 }
3150 SH_FREE(tmp2);
3151 sl_snprintf(theFile->c_group, GROUP_MAX+1, "%d", (long) buf.st_gid);
3152 }
3153
3154
3155 if ( (name = sh_unix_getUIDname(SH_ERR_ALL,
3156 buf.st_uid)) != NULL) {
3157 sl_strlcpy (theFile->c_owner, name, USER_MAX+1);
3158 } else {
3159
3160 tmp2 = sh_util_safe_name (theFile->fullpath);
3161
3162 if (policy == SH_LEVEL_ALLIGNORE)
3163 {
3164 sh_error_handle (SH_ERR_ALL, FIL__, __LINE__, ENOENT,
3165 MSG_FI_NOUSR,
3166 (long) buf.st_uid, tmp2);
3167 }
3168 else
3169 {
3170 sh_error_handle (ShDFLevel[SH_ERR_T_NAME], FIL__, __LINE__, ENOENT,
3171 MSG_FI_NOUSR,
3172 (long) buf.st_uid, tmp2);
3173 }
3174 SH_FREE(tmp2);
3175 sl_snprintf(theFile->c_owner, USER_MAX+1, "%d", (long) buf.st_uid);
3176 }
3177
3178 /* --- Output the file. ---
3179 */
3180 if (flag_err_debug == SL_TRUE)
3181 {
3182 tmp2 = sh_util_safe_name ((filename == NULL) ?
3183 theFile->fullpath : filename);
3184 sl_strlcpy(timestr, sh_unix_time(theFile->mtime), 81);
3185 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_LIST,
3186 theFile->c_mode,
3187 theFile->hardlinks,
3188 theFile->c_owner,
3189 theFile->c_group,
3190 (unsigned long) theFile->size,
3191 timestr,
3192 tmp2);
3193 SH_FREE(tmp2);
3194 }
3195
3196 /* --- Check for links. ---
3197 */
3198 if (theFile->c_mode[0] == 'l')
3199 {
3200
3201 linknamebuf = SH_ALLOC(PATH_MAX);
3202
3203 /* flawfinder: ignore */
3204 linksize = readlink (theFile->fullpath, linknamebuf, PATH_MAX-1);
3205
3206 if (linksize < (PATH_MAX-1) && linksize >= 0)
3207 linknamebuf[linksize] = '\0';
3208 else
3209 linknamebuf[PATH_MAX-1] = '\0';
3210
3211 if (linksize < 0)
3212 {
3213 linksize = errno;
3214 tmp2 = sh_util_safe_name (theFile->fullpath);
3215 sh_error_handle (level, FIL__, __LINE__, linksize, MSG_FI_RDLNK,
3216 sh_error_message (linksize), tmp2);
3217 SH_FREE(tmp2);
3218 SH_FREE(linknamebuf);
3219 theFile->linkpath[0] = '-';
3220 theFile->linkpath[1] = '\0';
3221 SL_RETURN((-1),_("sh_unix_getinfo"));
3222 }
3223
3224 if (linknamebuf[0] == '/')
3225 {
3226 sl_strlcpy (theFile->linkpath, linknamebuf, PATH_MAX);
3227 }
3228 else
3229 {
3230 tmp = sh_util_dirname(theFile->fullpath);
3231 sl_strlcpy (theFile->linkpath,
3232 tmp,
3233 PATH_MAX);
3234 SH_FREE(tmp);
3235 sl_strlcat (theFile->linkpath,
3236 "/", PATH_MAX);
3237 sl_strlcat (theFile->linkpath,
3238 linknamebuf,
3239 PATH_MAX);
3240 }
3241
3242 /* stat the link
3243 */
3244 stat_return = retry_lstat (FIL__, __LINE__, theFile->linkpath, &lbuf);
3245
3246 /* check for error
3247 */
3248 if (stat_return != 0)
3249 {
3250 stat_return = errno;
3251 tmp = sh_util_safe_name (theFile->fullpath);
3252 tmp2 = sh_util_safe_name (theFile->linkpath);
3253 if (stat_return != ENOENT)
3254 {
3255 sh_error_handle (level, FIL__, __LINE__, stat_return,
3256 MSG_FI_LSTAT,
3257 sh_error_message (stat_return), tmp2);
3258 }
3259 else
3260 {
3261 /* a dangling link -- everybody seems to have plenty of them
3262 */
3263 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_DLNK,
3264 tmp, tmp2);
3265 }
3266 theFile->linkisok = BAD;
3267 SH_FREE(tmp);
3268 SH_FREE(tmp2);
3269 SH_FREE(linknamebuf);
3270 /*
3271 * changed Tue Feb 10 16:16:13 CET 2004:
3272 * add dangling symlinks into database
3273 * SL_RETURN((-1),_("sh_unix_getinfo"));
3274 */
3275 theFile->linkmode = 0;
3276 SL_RETURN((0),_("sh_unix_getinfo"));
3277 }
3278
3279 theFile->linkisok = GOOD;
3280
3281
3282 /* --- Determine file type. ---
3283 */
3284 sh_unix_getinfo_type (&lbuf, &type, theFile->link_c_mode);
3285 theFile->type = type;
3286
3287 /* --- Determine permissions. ---
3288 */
3289 sh_unix_getinfo_mode (&lbuf, &mode, theFile->link_c_mode);
3290 theFile->linkmode = lbuf.st_mode;
3291
3292 /* --- Output the link. ---
3293 */
3294 if (theFile->linkisok == GOOD)
3295 {
3296 tmp2 = sh_util_safe_name (linknamebuf);
3297 sh_error_handle ((-1), FIL__, __LINE__, 0, MSG_FI_LLNK,
3298 theFile->link_c_mode, tmp2);
3299 SH_FREE(tmp2);
3300 }
3301 SH_FREE(linknamebuf);
3302 }
3303 SL_RETURN((0),_("sh_unix_getinfo"));
3304}
3305
3306/* #if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE) */
3307#endif
3308
3309int sh_unix_unlock (char * lockfile, char * flag);
3310int sh_unix_lock (char * lockfile, char * flag);
3311
3312/* check whether file is locked
3313 */
3314int sh_unix_test_and_lock (char * filename, char * lockfile)
3315{
3316 static struct stat buf;
3317 int status = 0;
3318
3319
3320 SL_TICKET fd;
3321 char line_in[128];
3322
3323 SL_ENTER(_("sh_unix_test_and_lock"));
3324
3325 if (filename != NULL)
3326 {
3327 status = retry_lstat (FIL__, __LINE__, filename, &buf);
3328
3329 /* no logfile to lock
3330 */
3331 if (status < 0)
3332 SL_RETURN((-1),_("sh_unix_test_and_lock"));
3333 }
3334
3335 status = retry_lstat (FIL__, __LINE__, lockfile, &buf);
3336
3337 /* --- No lock file found, try to lock. ---
3338 */
3339
3340 if (status < 0 && errno == ENOENT)
3341 {
3342 if (0 == sh_unix_lock (lockfile, filename))
3343 {
3344 if (filename != NULL)
3345 sh.flag.islocked = GOOD;
3346 SL_RETURN((0),_("sh_unix_test_and_lock"));
3347 }
3348 }
3349 else if (status == 0 && buf.st_size == 0)
3350 {
3351 if (filename != NULL)
3352 sh.flag.islocked = GOOD;
3353 sh_unix_unlock (lockfile, filename);
3354 if (filename != NULL)
3355 sh.flag.islocked = BAD;
3356 if (0 == sh_unix_lock (lockfile, filename))
3357 {
3358 if (filename != NULL)
3359 sh.flag.islocked = GOOD;
3360 SL_RETURN((0),_("sh_unix_test_and_lock"));
3361 }
3362 else
3363 {
3364 sh_error_handle ((-1), FIL__, __LINE__, status,
3365 MSG_E_SUBGEN,
3366 (filename == NULL) ? _("Cannot create PID file") : _("Cannot create lock file"),
3367 _("sh_unix_test_and_lock"));
3368 SL_RETURN((-1),_("sh_unix_test_and_lock"));
3369 }
3370 }
3371
3372 /* --- Check on lock. ---
3373 */
3374
3375 if (status >= 0)
3376 {
3377 fd = sl_open_read (lockfile, SL_YESPRIV);
3378 if (SL_ISERROR(fd))
3379 sh_error_handle ((-1), FIL__, __LINE__, fd,
3380 MSG_E_SUBGEN,
3381 (filename == NULL) ? _("Cannot open PID file for read") : _("Cannot open lock file for read"),
3382 _("sh_unix_test_and_lock"));
3383 }
3384 else
3385 fd = -1;
3386
3387 if (!SL_ISERROR(fd))
3388 {
3389 /* read the PID in the lock file
3390 */
3391 status = sh_unix_getline (fd, line_in, sizeof(line_in));
3392
3393 /* convert to numeric
3394 */
3395 if (status > 0)
3396 {
3397 errno = 0;
3398 status = strtol(line_in, (char **)NULL, 10);
3399 if (errno == ERANGE || status <= 0)
3400 {
3401 sh_error_handle ((-1), FIL__, __LINE__, status,
3402 MSG_E_SUBGEN,
3403 (filename == NULL) ? _("Bad PID in PID file") : _("Bad PID in lock file"),
3404 _("sh_unix_test_and_lock"));
3405
3406 status = -1;
3407 }
3408 }
3409 else
3410 {
3411 sh_error_handle ((-1), FIL__, __LINE__, status,
3412 MSG_E_SUBGEN,
3413 (filename == NULL) ? _("Cannot read PID file") : _("Cannot read lock file"),
3414 _("sh_unix_test_and_lock"));
3415 }
3416 sl_close(fd);
3417
3418 if (status == (int) getpid())
3419 {
3420 if (filename != NULL)
3421 sh.flag.islocked = GOOD;
3422 SL_RETURN((0),_("sh_unix_test_and_lock"));
3423 }
3424
3425
3426 /* --- Check whether the process exists. ---
3427 */
3428 if (status > 0)
3429 {
3430 errno = 0;
3431 status = aud_kill (FIL__, __LINE__, status, 0);
3432
3433 /* Does not exist, so remove the stale lock
3434 * and create a new one.
3435 */
3436 if (status < 0 && errno == ESRCH)
3437 {
3438 if (filename != NULL)
3439 sh.flag.islocked = GOOD;
3440 if (0 != sh_unix_unlock(lockfile, filename) && (filename !=NULL))
3441 sh.flag.islocked = BAD;
3442 else
3443 {
3444 if (0 == sh_unix_lock (lockfile, filename))
3445 {
3446 if (filename != NULL)
3447 sh.flag.islocked = GOOD;
3448 SL_RETURN((0),_("sh_unix_test_and_lock"));
3449 }
3450 else
3451 {
3452 sh_error_handle ((-1), FIL__, __LINE__, status,
3453 MSG_E_SUBGEN,
3454 (filename == NULL) ? _("Cannot create PID file") : _("Cannot create lock file"),
3455 _("sh_unix_test_and_lock"));
3456 }
3457 if (filename != NULL)
3458 sh.flag.islocked = BAD;
3459 }
3460 }
3461 else
3462 {
3463 sh_error_handle ((-1), FIL__, __LINE__, status,
3464 MSG_E_SUBGEN,
3465 (filename == NULL) ? _("Cannot remove stale PID file, PID may be a running process") : _("Cannot remove stale lock file, PID may be a running process"),
3466 _("sh_unix_test_and_lock"));
3467 if (filename != NULL)
3468 sh.flag.islocked = BAD;
3469 }
3470 }
3471 }
3472 SL_RETURN((-1),_("sh_unix_testlock"));
3473}
3474
3475/* write the PID file
3476 */
3477int sh_unix_write_pid_file()
3478{
3479 return sh_unix_test_and_lock(NULL, sh.srvlog.alt);
3480}
3481
3482/* write lock for filename
3483 */
3484int sh_unix_write_lock_file(char * filename)
3485{
3486 size_t len;
3487 int res;
3488 char * lockfile;
3489
3490 if (filename == NULL)
3491 return (-1);
3492
3493 len = sl_strlen(filename);
3494 if (sl_ok_adds(len, 6))
3495 len += 6;
3496 lockfile = SH_ALLOC(len);
3497 sl_strlcpy(lockfile, filename, len);
3498 sl_strlcat(lockfile, _(".lock"), len);
3499 res = sh_unix_test_and_lock(filename, lockfile);
3500 SH_FREE(lockfile);
3501 return res;
3502}
3503
3504int sh_unix_unlock(char * lockfile, char * flag)
3505{
3506 int error = 0;
3507
3508 SL_ENTER(_("sh_unix_unlock"));
3509
3510 /* --- Logfile is not locked to us. ---
3511 */
3512 if (sh.flag.islocked == BAD && flag != NULL)
3513 SL_RETURN((-1),_("sh_unix_unlock"));
3514
3515 /* --- Check whether the directory is secure. ---
3516 */
3517 if (0 != tf_trust_check (lockfile, SL_YESPRIV))
3518 SL_RETURN((-1),_("sh_unix_unlock"));
3519
3520 /* --- Delete the lock file. ---
3521 */
3522 error = retry_aud_unlink (FIL__, __LINE__, lockfile);
3523
3524 if (error == 0)
3525 {
3526 if (flag != NULL)
3527 sh.flag.islocked = BAD; /* not locked anymore */
3528 }
3529 else if (flag != NULL)
3530 {
3531 error = errno;
3532 sh_error_handle ((-1), FIL__, __LINE__, error, MSG_E_UNLNK,
3533 sh_error_message(error), lockfile);
3534 SL_RETURN((-1),_("sh_unix_unlock"));
3535 }
3536 SL_RETURN((0),_("sh_unix_unlock"));
3537}
3538
3539/* rm lock for filename
3540 */
3541int sh_unix_rm_lock_file(char * filename)
3542{
3543 size_t len;
3544 int res;
3545 char * lockfile;
3546
3547 if (filename == NULL)
3548 return (-1);
3549
3550 len = sl_strlen(filename);
3551 if (sl_ok_adds(len, 6))
3552 len += 6;
3553 lockfile = SH_ALLOC(len);
3554 sl_strlcpy(lockfile, filename, len);
3555 sl_strlcat(lockfile, _(".lock"), len);
3556
3557 res = sh_unix_unlock(lockfile, filename);
3558 SH_FREE(lockfile);
3559 return res;
3560}
3561
3562/* rm lock for filename
3563 */
3564int sh_unix_rm_pid_file()
3565{
3566 return sh_unix_unlock(sh.srvlog.alt, NULL);
3567}
3568
3569int sh_unix_lock (char * lockfile, char * flag)
3570{
3571 struct stat buf;
3572 int status;
3573 int filed;
3574 int errnum;
3575 char myPid[64];
3576 SL_TICKET fd;
3577 extern int get_the_fd (SL_TICKET ticket);
3578
3579
3580 status = retry_lstat (FIL__, __LINE__, lockfile, &buf);
3581
3582 SL_ENTER(_("sh_unix_lock"));
3583
3584 if (0 == status)
3585 {
3586 if (flag != NULL)
3587 sh.flag.islocked = BAD;
3588 SL_RETURN((-1),_("sh_unix_lock"));
3589 }
3590
3591 sprintf (myPid, "%ld\n", (long) getpid()); /* known to fit */
3592
3593 fd = sl_open_write (lockfile, SL_YESPRIV);
3594
3595 if (!SL_ISERROR(fd))
3596 {
3597 errnum = sl_write (fd, myPid, sl_strlen(myPid));
3598 filed = get_the_fd(fd);
3599 fchmod (filed, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
3600 sl_close (fd);
3601
3602 if (!SL_ISERROR(errnum))
3603 {
3604 if (flag != NULL)
3605 sh.flag.islocked = GOOD;
3606 SL_RETURN((0),_("sh_unix_lock"));
3607 }
3608 }
3609
3610 TPT((0, FIL__, __LINE__, _("msg=<open pid file failed>\n")));
3611 if (flag != NULL)
3612 sh.flag.islocked = BAD;
3613 SL_RETURN((-1),_("sh_unix_lock"));
3614
3615 /* notreached */
3616}
3617
3618/* Test whether file exists
3619 */
3620int sh_unix_file_stat(char * path)
3621{
3622 struct stat buf;
3623
3624 SL_ENTER(_("sh_unix_file_stat"));
3625
3626 if (-1 == retry_stat(FIL__, __LINE__, path, &buf))
3627 SL_RETURN( (0), _("sh_unix_file_stat"));
3628 else
3629 SL_RETURN( (-1), _("sh_unix_file_stat"));
3630}
3631
3632
3633/* Test whether file exists, is a character device, allows read
3634 * access, and is not world writeable.
3635 */
3636int sh_unix_file_exists(int fd)
3637{
3638 struct stat buf;
3639
3640 SL_ENTER(_("sh_unix_file_exists"));
3641
3642 if (retry_fstat(FIL__, __LINE__, fd, &buf) == -1)
3643 SL_RETURN( (-1), _("sh_unix_file_exists"));
3644 else if ( S_ISCHR(buf.st_mode) && 0 != (S_IROTH & buf.st_mode)
3645 /*
3646 * #if !defined(__CYGWIN32__) && !defined(__CYGWIN__)
3647 * && 0 == (S_IWOTH & buf.st_mode)
3648 * #endif
3649 */
3650 )
3651 SL_RETURN( (0), _("sh_unix_file_exists"));
3652 else
3653 SL_RETURN( (-1), _("sh_unix_file_exists"));
3654}
3655
3656static char preq[16];
3657
3658/* return true if database is remote
3659 */
3660int file_is_remote ()
3661{
3662 static int init = 0;
3663
3664 SL_ENTER(_("file_is_remote"));
3665
3666 if (init == 0)
3667 {
3668 sl_strlcpy(preq, _("REQ_FROM_SERVER"), 16);
3669 ++init;
3670 }
3671 if (0 == sl_strncmp (sh.data.path, preq, 15))
3672 {
3673 SL_RETURN( S_TRUE, _("file_is_remote"));
3674 }
3675 SL_RETURN( S_FALSE, _("file_is_remote"));
3676}
3677
3678/* Return the path to the configuration/database file.
3679 */
3680char * file_path(char what, char flag)
3681{
3682 static int init = 0;
3683
3684 SL_ENTER(_("file_path"));
3685
3686 if (init == 0)
3687 {
3688 sl_strlcpy(preq, _("REQ_FROM_SERVER"), 16);
3689 ++init;
3690 }
3691
3692 switch (what)
3693 {
3694
3695 case 'C':
3696 if (0 == sl_strncmp (sh.conf.path, preq, 15))
3697 {
3698#if defined(SH_WITH_SERVER)
3699 if (sh.flag.isserver == S_TRUE && sl_strlen(sh.conf.path) == 15)
3700 SL_RETURN( NULL, _("file_path"));
3701 if (sh.flag.isserver == S_TRUE)
3702 SL_RETURN( &(sh.conf.path[15]), _("file_path"));
3703#endif
3704 if (flag == 'R')
3705 SL_RETURN( preq, _("file_path"));
3706 if (flag == 'I')
3707 {
3708 if (sl_strlen(sh.conf.path) == 15)
3709 SL_RETURN( NULL, _("file_path"));
3710 else
3711 SL_RETURN( &(sh.conf.path[15]), _("file_path"));
3712 }
3713 SL_RETURN ( preq, _("file_path"));
3714 }
3715 else
3716 SL_RETURN( sh.conf.path, _("file_path"));
3717 /* break; *//* unreachable */
3718
3719 case 'D':
3720 if (0 == sl_strncmp (sh.data.path, preq, 15))
3721 {
3722 if (flag == 'R')
3723 SL_RETURN( preq, _("file_path"));
3724 if (flag == 'W' && sl_strlen(sh.data.path) == 15)
3725 SL_RETURN (NULL, _("file_path"));
3726 if (flag == 'W')
3727 SL_RETURN( &(sh.data.path[15]), _("file_path"));
3728 }
3729 else
3730 SL_RETURN( sh.data.path, _("file_path"));
3731 break;
3732
3733 default:
3734 SL_RETURN( NULL, _("file_path"));
3735 }
3736
3737 return NULL; /* notreached */
3738}
3739/************************************************/
3740/**** Mlock Utilities ****/
3741/************************************************/
3742
3743#include <limits.h>
3744
3745int sh_unix_pagesize()
3746{
3747 int pagesize = 4096;
3748#if defined(_SC_PAGESIZE)
3749 pagesize = sysconf(_SC_PAGESIZE);
3750#elif defined(_SC_PAGE_SIZE)
3751 pagesize = sysconf(_SC_PAGE_SIZE);
3752#elif defined(HAVE_GETPAGESIZE)
3753 pagesize = getpagesize();
3754#elif defined(PAGESIZE)
3755 pagesize = PAGESIZE;
3756#endif
3757
3758 return ((pagesize > 0) ? pagesize : 4096);
3759}
3760
3761typedef struct sh_page_lt {
3762 unsigned long page_start;
3763 int page_refcount;
3764 char file[64];
3765 int line;
3766 struct sh_page_lt * next;
3767} sh_page_l;
3768
3769sh_page_l * sh_page_locked = NULL;
3770volatile int page_locking = 0;
3771
3772unsigned long sh_unix_lookup_page (void * in_addr, size_t len, int * num_pages)
3773{
3774 int pagesize = sh_unix_pagesize();
3775 unsigned long addr = (unsigned long) in_addr;
3776
3777 unsigned long pagebase;
3778 unsigned long pagediff;
3779 unsigned long pagenum = addr / pagesize;
3780
3781 SL_ENTER(_("sh_unix_lookup_page"));
3782#if 0
3783 fprintf(stderr, "mlock: --> base %ld, pagenum: %ld\n",
3784 addr, pagenum);
3785#endif
3786
3787 /* address of first page
3788 */
3789 pagebase = pagenum * pagesize;
3790
3791 /* number of pages
3792 */
3793 pagediff = (addr + len) - pagebase;
3794 pagenum = pagediff / pagesize;
3795 if (pagenum * pagesize < pagediff)
3796 ++pagenum;
3797
3798#if 0
3799 fprintf(stderr, "mlock: --> pagebase %ld, pagediff %ld, (addr + len) %ld\n",
3800 pagebase, pagediff, (addr + len));
3801#endif
3802
3803 *num_pages = pagenum;
3804 SL_RETURN((pagebase), _("sh_unix_lookup_page"));
3805}
3806
3807
3808#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
3809int sh_unix_mlock (char * file, int line, void * in_addr, size_t len)
3810{
3811 int num_pages;
3812 int status = 0;
3813 int pagesize;
3814 sh_page_l * page_list = sh_page_locked;
3815 unsigned long addr;
3816#ifdef TEST_MLOCK
3817 int i = 0;
3818#endif
3819
3820 SL_ENTER(_("sh_unix_mlock"));
3821
3822 if (0 != page_locking)
3823 {
3824 SL_RETURN((-1), _("sh_unix_mlock"));
3825 }
3826 page_locking = 1;
3827
3828 pagesize = sh_unix_pagesize();
3829 addr = sh_unix_lookup_page (in_addr, len, &num_pages);
3830
3831#ifdef TEST_MLOCK
3832 fprintf(stderr, "mlock: addr %ld, base %ld, pages: %d, length %d\n",
3833 (unsigned long) in_addr, addr, num_pages, len);
3834#endif
3835
3836 /* increase refcount of locked pages
3837 * addr is first page; num_pages is #(consecutive pages) to lock
3838 */
3839 while ((page_list != NULL) && (num_pages > 0))
3840 {
3841#ifdef TEST_MLOCK
3842 fprintf(stderr, "mlock: check page %d: %ld [%d]\n",
3843 i, page_list->page_start, page_list->page_refcount);
3844#endif
3845 if (page_list->page_start == addr)
3846 {
3847 page_list->page_refcount += 1;
3848 num_pages -= 1;
3849 addr += pagesize;
3850#ifdef TEST_MLOCK
3851 fprintf(stderr, "mlock: found page %d: %ld [%d], next page %ld\n",
3852 i, page_list->page_start, page_list->page_refcount, addr);
3853#endif
3854 }
3855#ifdef TEST_MLOCK
3856 ++i;
3857#endif
3858 page_list = page_list->next;
3859 }
3860
3861 /* mlock some more pages, if needed
3862 */
3863 while (num_pages > 0)
3864 {
3865#ifdef TEST_MLOCK
3866 fprintf(stderr, "mlock: lock page %d: mlock %ld [num_pages %d]\n",
3867 i, addr, num_pages);
3868 ++i;
3869#endif
3870 page_list = SH_ALLOC(sizeof(sh_page_l));
3871 page_list->page_start = addr;
3872 page_list->page_refcount = 1;
3873 sl_strlcpy(page_list->file, file, 64);
3874 page_list->line = line;
3875 status = mlock( (void *) addr, pagesize);
3876 if (status != 0)
3877 {
3878#ifdef TEST_MLOCK
3879 fprintf(stderr, "mlock: error: %s\n", sh_error_message(errno));
3880#endif
3881 SH_FREE(page_list);
3882 page_locking = 0;
3883 SL_RETURN((status), _("sh_unix_mlock"));
3884 }
3885 page_list->next = sh_page_locked;
3886 sh_page_locked = page_list;
3887 num_pages -= 1;
3888 addr += pagesize;
3889 }
3890
3891 page_locking = 0;
3892 SL_RETURN((status), _("sh_unix_mlock"));
3893}
3894#else
3895int sh_unix_mlock (void * in_addr, size_t len)
3896{
3897 (void) in_addr; (void) len;
3898 return -1;
3899}
3900#endif
3901
3902#if defined(HAVE_MLOCK) && !defined(HAVE_BROKEN_MLOCK)
3903int sh_unix_munlock (void * in_addr, size_t len)
3904{
3905 int num_pages;
3906 int unlocked = 0;
3907 int status = 0;
3908 int pagesize;
3909 sh_page_l * page_list = sh_page_locked;
3910 sh_page_l * page_last;
3911 unsigned long addr;
3912
3913 int test_count;
3914 int test_status;
3915 int test_pages;
3916
3917#ifdef TEST_MLOCK
3918 int i = 0;
3919#endif
3920
3921 SL_ENTER(_("sh_unix_munlock"));
3922
3923 if (0 != page_locking)
3924 {
3925 SL_RETURN((-1), _("sh_unix_munlock"));
3926 }
3927 page_locking = 1;
3928
3929 pagesize = sh_unix_pagesize();
3930 addr = sh_unix_lookup_page (in_addr, len, &num_pages);
3931
3932#ifdef TEST_MLOCK
3933 fprintf(stderr, "munlock: in_addr %ld, addr %ld, pages: %d, length %d\n",
3934 (unsigned long) in_addr, addr, num_pages, len);
3935#endif
3936
3937 test_pages = num_pages;
3938
3939 /* reduce refcount of locked pages
3940 * addr is first page; num_pages is #(consecutive pages) to lock
3941 */
3942 while ((page_list != NULL) && (num_pages > 0))
3943 {
3944#ifdef TEST_MLOCK
3945 fprintf(stderr, "munlock: page %d: %ld [%d]\n",
3946 i, page_list->page_start, page_list->page_refcount);
3947#endif
3948
3949 test_status = 0;
3950 for (test_count = 0; test_count < test_pages; ++test_count)
3951 {
3952 if (page_list->page_start == (addr + (test_count * pagesize)))
3953 {
3954 test_status = 1;
3955 break;
3956 }
3957 }
3958
3959 if (test_status == 1)
3960 {
3961 page_list->page_refcount -= 1;
3962 if (page_list->page_refcount == 0)
3963 {
3964 status = munlock ( (void *) addr, pagesize);
3965 ++unlocked;
3966 }
3967 num_pages -= 1;
3968#ifdef TEST_MLOCK
3969 fprintf(stderr,
3970 "munlock: page %d: %ld [refcount %d], refcount reduced\n",
3971 i, page_list->page_start, page_list->page_refcount);
3972#endif
3973 }
3974#ifdef TEST_MLOCK
3975 ++i;
3976#endif
3977 page_list = page_list->next;
3978 }
3979
3980#ifdef TEST_MLOCK
3981 i = 0;
3982#endif
3983
3984 if (unlocked > 0)
3985 {
3986 page_list = sh_page_locked;
3987 page_last = sh_page_locked;
3988
3989 while ((page_list != NULL) && (unlocked > 0))
3990 {
3991 if (page_list->page_refcount == 0)
3992 {
3993#ifdef TEST_MLOCK
3994 fprintf(stderr, "munlock: remove page %d: %ld [refcount %d]\n",
3995 i, page_list->page_start, page_list->page_refcount);
3996#endif
3997 if (page_last != page_list)
3998 {
3999 page_last->next = page_list->next;
4000 SH_FREE(page_list);
4001 page_list = page_last->next;
4002 }
4003 else
4004 {
4005 page_last = page_list->next;
4006 if (page_list == sh_page_locked)
4007 sh_page_locked = page_list->next;
4008 SH_FREE(page_list);
4009 page_list = page_last;
4010 }
4011 --unlocked;
4012 }
4013 else
4014 {
4015#ifdef TEST_MLOCK
4016 fprintf(stderr, "munlock: skip page %d: %ld [refcount %d]\n",
4017 i, page_list->page_start, page_list->page_refcount);
4018#endif
4019
4020 page_last = page_list;
4021 page_list = page_list->next;
4022 }
4023#ifdef TEST_MLOCK
4024 ++i;
4025#endif
4026 }
4027 }
4028
4029 page_locking = 0;
4030 SL_RETURN((status), _("sh_unix_munlock"));
4031}
4032#else
4033int sh_unix_munlock (void * in_addr, size_t len)
4034{
4035 (void) in_addr; (void) len;
4036 return -1;
4037}
4038#endif
4039
4040int sh_unix_count_mlock()
4041{
4042 int i = 0;
4043 char str[128];
4044 sh_page_l * page_list = sh_page_locked;
4045
4046 SL_ENTER(_("sh_unix_count_mlock"));
4047 while (page_list != NULL)
4048 {
4049#ifdef WITH_TPT
4050 sl_snprintf(str, sizeof(str), _("file: %s line: %d page: %d"),
4051 page_list->file, page_list->line, i+1);
4052 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, i, MSG_E_SUBGEN,
4053 str, _("sh_unix_count_mlock"));
4054#endif
4055 page_list = page_list->next;
4056 ++i;
4057 }
4058 sl_snprintf(str, sizeof(str), _("%d pages locked"), i);
4059 sh_error_handle(SH_ERR_INFO, FIL__, __LINE__, i, MSG_E_SUBGEN,
4060 str, _("sh_unix_count_mlock"));
4061 SL_RETURN((i), _("sh_unix_count_mlock"));
4062}
4063
4064/************************************************/
4065/************************************************/
4066/**** Stealth Utilities ****/
4067/************************************************/
4068/************************************************/
4069#ifdef SH_STEALTH
4070
4071void sh_unix_xor_code (char * str, int len)
4072{
4073 register int i;
4074
4075 for (i = 0; i < len; ++i) str[i] ^= (char) XOR_CODE;
4076 return;
4077}
4078
4079#if !defined(SH_STEALTH_MICRO)
4080
4081
4082int hideout_hex_block(SL_TICKET fd, unsigned char * str, int len);
4083unsigned long first_hex_block(SL_TICKET fd, unsigned long * max);
4084
4085/*
4086 * --- Get hidden data from a block of hex data. ---
4087 */
4088int sh_unix_getline_stealth (SL_TICKET fd, char * str, int len)
4089{
4090 int add_off, llen;
4091 unsigned long off_data = 0;
4092 unsigned long max_data = 0;
4093 static int stealth_init = BAD;
4094
4095 SL_ENTER(_("sh_unix_getline_stealth"));
4096
4097
4098 /* --- Initialize. ---
4099 */
4100 if (stealth_init == BAD)
4101 {
4102 off_data = first_hex_block(fd, &max_data);
4103 if (off_data == 0)
4104 {
4105 dlog(1, FIL__, __LINE__,
4106 _("The stealth config file does not contain any steganographically\nhidden data. This file must be an image file in _uncompressed_\npostscript format.\nTo hide data in it, use:\n samhain_stealth -s postscript_file orig_config_file\n mv postscript_file /path/to/config/file\n"));
4107 sh_error_handle ((-1), FIL__, __LINE__, EIO, MSG_P_NODATA,
4108 _("Stealth config file."));
4109 aud_exit (FIL__, __LINE__, EXIT_FAILURE);
4110 }
4111 stealth_init = GOOD;
4112 }
4113
4114 /* --- Seek to proper position. ---
4115 */
4116 sl_seek(fd, off_data);
4117
4118 /* --- Read one line. ---
4119 */
4120 add_off = hideout_hex_block(fd, (unsigned char *) str, len);
4121 off_data += add_off;
4122
4123
4124 llen = sl_strlen(str);
4125 SL_RETURN(llen, _("sh_unix_getline_stealth"));
4126}
4127
4128int hideout_hex_block(SL_TICKET fd, unsigned char * str, int len)
4129{
4130
4131 register int i, j, k;
4132 unsigned char c, e;
4133 register int num;
4134 unsigned char mask[9] = { 0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01 };
4135 unsigned long here = 0;
4136 unsigned long retval = 0;
4137
4138 SL_ENTER(_("hideout_hex_block"));
4139
4140 ASSERT_RET((len > 1), _("len > 1"), (0));
4141
4142 --len;
4143
4144 i = 0;
4145 while (i < len)
4146 {
4147 for (j = 0; j < 8; ++j)
4148 {
4149
4150 /* --- Get a low byte, modify, read back. ---
4151 */
4152 for (k = 0; k < 2; ++k)
4153 {
4154 /* -- Skip whitespace. ---
4155 */
4156 c = ' ';
4157 do {
4158 do {
4159 num = sl_read (fd, &c, 1);
4160 } while (num == 0 && errno == EINTR);
4161 if (num == 0)
4162 SL_RETURN((0), _("hideout_hex_block"));
4163 ++here;
4164 } while (c == '\n' || c == '\t' || c == '\r' ||
4165 c == ' ');
4166 }
4167
4168
4169 /* --- e is the value of the low byte. ---
4170 */
4171 e = (unsigned char) sh_util_hexchar( c );
4172 if ((e & mask[7]) != 0) /* bit is set */
4173 str[i] |= mask[j];
4174 else /* bit is not set */
4175 str[i] &= ~mask[j];
4176
4177 }
4178 if (str[i] == '\n') break;
4179 ++i;
4180 }
4181
4182 if (i != 0)
4183 str[i] = '\0';
4184 else
4185 str[i+1] = '\0'; /* keep newline and terminate */
4186 retval += here;
4187
4188 SL_RETURN(retval, _("hideout_hex_block"));
4189}
4190
4191/* --- Get offset of first data block. ---
4192 */
4193unsigned long first_hex_block(SL_TICKET fd, unsigned long * max)
4194{
4195 unsigned int i;
4196 long num = 1;
4197 unsigned long lnum;
4198 char c;
4199 int nothex = 0;
4200 unsigned long retval = 0;
4201 unsigned int this_line = 0;
4202 char theline[SH_BUFSIZE];
4203
4204 SL_ENTER(_("first_hex_block"));
4205
4206 *max = 0;
4207
4208 while (1)
4209 {
4210 theline[0] = '\0';
4211 this_line = 0;
4212 c = '\0';
4213 while (c != '\n' && num > 0 && this_line < (sizeof(theline)-1))
4214 {
4215 do {
4216 num = sl_read (fd, &c, 1);
4217 } while (num == 0 && errno == EINTR);
4218 if (num > 0)
4219 theline[this_line] = c;
4220 else
4221 SL_RETURN((0), _("first_hex_block"));
4222 ++this_line;
4223 }
4224 theline[this_line] = '\0';
4225
4226 /* not only 'newline' */
4227 if (this_line > 60)
4228 {
4229 nothex = 0;
4230 i = 0;
4231 while (nothex == 0 && i < (this_line-1))
4232 {
4233 if (! isxdigit((int)theline[i])) nothex = 1;
4234 ++i;
4235 }
4236 if (nothex == 1) retval += this_line;
4237 }
4238 else
4239 {
4240 nothex = 1;
4241 retval += this_line;
4242 }
4243
4244 if (nothex == 0)
4245 {
4246 *max = 0;
4247 do {
4248 do {
4249 num = sl_read (fd, theline, SH_BUFSIZE);
4250 } while (num == 0 && errno == EINTR);
4251 if (num > 0)
4252 {
4253 lnum = (unsigned long) num;
4254 for (i = 0; i < lnum; ++i)
4255 {
4256 c = theline[i];
4257 if (c == '\n' || c == '\t' || c == '\r' || c == ' ')
4258 ;
4259 else if (!isxdigit((int)c))
4260 break;
4261 else
4262 *max += 1;
4263 }
4264 }
4265 } while (num > 0);
4266
4267 *max /= 16;
4268 SL_RETURN((retval), _("first_hex_block"));
4269 }
4270
4271 }
4272 /* SL_RETURN((0), _("first_hex_block")); *//* unreachable */
4273}
4274
4275 /* if !defined(SH_STEALTH_MICRO) */
4276#endif
4277
4278 /* ifdef SH_STEALTH */
4279#endif
4280
4281/*
4282 * anti-debugger code
4283 */
4284#if defined(SCREW_IT_UP)
4285volatile int sh_not_traced = 0;
4286
4287#ifdef HAVE_GETTIMEOFDAY
4288struct timeval save_tv;
4289#endif
4290
4291void sh_sigtrap_handler (int signum)
4292{
4293#ifdef HAVE_GETTIMEOFDAY
4294 struct timeval tv;
4295 long difftv;
4296
4297 gettimeofday(&tv, NULL);
4298 difftv = (tv.tv_sec - save_tv.tv_sec) * 1000000 +
4299 (tv.tv_usec - save_tv.tv_usec);
4300 if (difftv > 500000)
4301 _exit(6);
4302#endif
4303 sh_not_traced += signum;
4304 return;
4305}
4306#endif
Note: See TracBrowser for help on using the repository browser.