Changeset 317

Timestamp:

Mar 15, 2011, 8:54:21 PM (14 years ago)

Author:

katerina

Message:

Further refinements for lstat in subprocess (ticket #236).

Location:

trunk

Files:

• include/sh_calls.h (modified) (2 diffs)
• src/samhain.c (modified) (3 diffs)
• src/sh_calls.c (modified) (3 diffs)
• src/sh_suidchk.c (modified) (4 diffs)

trunk/include/sh_calls.h

@@ -40 +40 @@
 #endif
 
-int sh_calls_set_sub (const char * str);
+void sh_calls_enable_sub();
+int  sh_calls_set_sub (const char * str);
 
 long int retry_stat (const char * file, int line, 
@@ -46 +47 @@
 long int retry_fstat(const char * file, int line, 
                      int filed,             struct stat *buf);
+long int retry_lstat_ns(const char * file, int line, 
+                        const char *file_name, struct stat *buf);
 long int retry_lstat(const char * file, int line, 
                      const char *file_name, struct stat *buf);

trunk/src/samhain.c

@@ -983 +983 @@
   pid_t       * pidlist;
   int         i;
-
+#ifdef WCONTINUED
+      int wflags = WNOHANG|WUNTRACED|WCONTINUED;
+#else
+      int wflags = WNOHANG|WUNTRACED;
+#endif
 
   fullpath = strdup (SH_INSTALL_PATH);
@@ -1030 +1034 @@
         times = 0;
         while (times < 300) {
-          respid = waitpid(pid, &status, WNOHANG|WUNTRACED);
+          respid = waitpid(pid, &status, wflags);
           if ((pid_t)-1 == respid)
             {
@@ -1473 +1477 @@
   BREAKEXIT(sh_readconf_read);
   (void) sh_readconf_read ();
+
+  sh_calls_enable_sub();
 
 #if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)

trunk/src/sh_calls.c

@@ -242 +242 @@
 }
 
+static int sh_enable_use_sub = 0;
+
+#if defined (SH_WITH_CLIENT) || defined (SH_STANDALONE)
+static int sh_use_sub = 1;
+#else
 static int sh_use_sub = 0;
+#endif
+
+void sh_calls_enable_sub()
+{
+  sh_enable_use_sub = 1;
+  return;
+}
 
 int sh_calls_set_sub (const char * str)
 {
-  return sh_util_flagval(str, &sh_use_sub);
+  int ret = sh_util_flagval(str, &sh_use_sub);
+
+  if ((ret == 0) && (!sh_use_sub))
+    {
+      sh_kill_sub();
+    }
+  return ret;
+}
+
+long int retry_lstat_ns(const char * file, int line, 
+                        const char *file_name, struct stat *buf)
+{
+  int error;
+  long int val_retry = -1;
+  char errbuf[SH_ERRBUF_SIZE];
+ 
+  SL_ENTER(_("retry_lstat_ns"));
+
+  do {
+    val_retry = /*@-unrecog@*/lstat (file_name, buf)/*@+unrecog@*/;
+  } while (val_retry < 0 && errno == EINTR);
+
+  error = errno;
+  if (val_retry < 0) {
+      (void) sh_error_message(error, aud_err_message, 64);
+      sh_error_handle ((-1), file, line, error, MSG_ERR_LSTAT, 
+                       sh_error_message(error, errbuf, sizeof(errbuf)),
+                       file_name );
+  }
+  errno = error;    
+
+  SL_RETURN(val_retry, _("retry_lstat_ns"));
 }
 
@@ -258 +301 @@
   SL_ENTER(_("retry_lstat"));
 
-  if (sh_use_sub)
+  if (sh_use_sub && sh_enable_use_sub)
     {
       val_retry = sh_sub_lstat (file_name, buf);
@@ -290 +333 @@
   SL_ENTER(_("retry_stat"));
 
-  if (sh_use_sub)
+  if (sh_use_sub && sh_enable_use_sub)
     {
       val_retry = sh_sub_stat (file_name, buf);

trunk/src/sh_suidchk.c

@@ -193 +193 @@
 /* Recursively descend into the directory to make sure that
  * there is no symlink in the path.
+ *
+ * Use retry_lstat_ns() here because we cannot chdir the subprocess
+ * that does the lstat().
  */
 static int do_truncate_int (char * path, int depth)
@@ -226 +229 @@
     {
       *q = '\0';
-      if (0 != retry_lstat(FIL__, __LINE__, path, &one))
+      if (0 != retry_lstat_ns(FIL__, __LINE__, path, &one))
         { 
           SH_MUTEX_LOCK(mutex_thread_nolog);
@@ -260 +263 @@
         }
       *q = '/';
-      if (0 != retry_lstat(FIL__, __LINE__, ".", &two))
+      if (0 != retry_lstat_ns(FIL__, __LINE__, ".", &two))
         { 
           sh_error_handle ((-1), FIL__, __LINE__, errno,
@@ -288 +291 @@
       if (*path == '\0')
         return -1;
-      if (0 != retry_lstat(FIL__, __LINE__, path, &one))
+      if (0 != retry_lstat_ns(FIL__, __LINE__, path, &one))
         {
           SH_MUTEX_LOCK(mutex_thread_nolog);