mirrors/ngircd
1
0
Fork 0
mirror of https://github.com/osmarks/ngircd.git synced 2025-04-27 13:13:19 +00:00
Code Issues Releases Wiki Activity

startup: fork only once, never run with uid 0.

Browse Source
This commit is contained in:
Florian Westphal 2005-06-17 18:22:45 +00:00
parent 94dd7fa7d6
commit bc2dac3c74
1 changed files with 208 additions and 107 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

315
src/ngircd/ngircd.c
View File

@ -12,7 +12,7 @@
#include "portab.h" #include "portab.h"
static char UNUSED id[] = "$Id: ngircd.c,v 1.96 2005/06/01 21:52:18 alex Exp $"; static char UNUSED id[] = "$Id: ngircd.c,v 1.97 2005/06/17 18:22:45 fw Exp $";
/** /**
* @file * @file
@ -69,6 +69,7 @@ LOCAL void Fill_Version PARAMS(( void ));
LOCAL void Setup_FDStreams PARAMS(( void )); LOCAL void Setup_FDStreams PARAMS(( void ));
LOCAL bool NGIRCd_Init PARAMS(( bool ));
/** /**
* The main() function of ngIRCd. * The main() function of ngIRCd.
@ -81,10 +82,7 @@ LOCAL void Setup_FDStreams PARAMS(( void ));
GLOBAL int GLOBAL int
main( int argc, const char *argv[] ) main( int argc, const char *argv[] )
{ {
struct passwd *pwd;
struct group *grp;
bool ok, configtest = false; bool ok, configtest = false;
long pid;
int i; int i;
size_t n; size_t n;
@ -263,74 +261,9 @@ main( int argc, const char *argv[] )
Log_Init( ); Log_Init( );
Conf_Init( ); Conf_Init( );
if( Conf_Chroot[0] ) if (!NGIRCd_Init( NGIRCd_NoDaemon )) {
{ Log(LOG_WARNING, "Fatal: Initialization failed");
/* Chroot */ exit(1);
if( chdir( Conf_Chroot ) != 0 ) Log( LOG_ERR, "Can't chdir() in ChrootDir (%s): %s", Conf_Chroot, strerror( errno ));
if( chroot( Conf_Chroot ) != 0 ) Log( LOG_ERR, "Can't change root directory to \"%s\": %s", Conf_Chroot, strerror( errno ));
else Log( LOG_INFO, "Changed root and working directory to \"%s\".", Conf_Chroot );
}
if( Conf_GID != 0 )
{
/* Set new group ID */
if( setgid( Conf_GID ) != 0 ) Log( LOG_ERR, "Can't change group ID to %u: %s", Conf_GID, strerror( errno ));
}
if( Conf_UID != 0 )
{
/* Set new user ID */
if( setuid( Conf_UID ) != 0 ) Log( LOG_ERR, "Can't change user ID to %u: %s", Conf_UID, strerror( errno ));
}
/* Normally a child process is forked which isn't any longer
* connected to ther controlling terminal. Use "--nodaemon"
* to disable this "daemon mode" (useful for debugging). */
if( ! NGIRCd_NoDaemon )
{
/* fork child process */
pid = (long)fork( );
if( pid > 0 )
{
/* "Old" process: exit. */
exit( 0 );
}
if( pid < 0 )
{
/* Error!? */
fprintf( stderr, "%s: Can't fork: %s!\nFatal error, exiting now ...\n", PACKAGE_NAME, strerror( errno ));
exit( 1 );
}
/* New child process */
(void)setsid( );
chdir( "/" );
/* Detach stdin, stdout and stderr */
Setup_FDStreams( );
}
/* Create PID file */
pid = (long) getpid( );
Pidfile_Create( pid );
/* Show user, group, and PID of the running daemon */
pwd = getpwuid( getuid( )); grp = getgrgid( getgid( ));
Log( LOG_INFO, "Running as user %s(%ld), group %s(%ld), with PID %ld.", pwd ? pwd->pw_name : "unknown", (long)getuid( ), grp ? grp->gr_name : "unknown", (long)getgid( ), pid);
/* Change working directory to home directory of the user
* we are running as (when not running chroot()'ed!) */
if( Conf_UID != 0 && ! Conf_Chroot[0] )
{
struct passwd *pwd;
pwd = getpwuid( Conf_UID );
if( pwd != NULL )
{
if( chdir( pwd->pw_dir ) == 0 ) Log( LOG_DEBUG, "Changed working directory to \"%s\" ...", pwd->pw_dir );
else Log( LOG_ERR, "Can't change working directory to \"%s\": %s", pwd->pw_dir, strerror( errno ));
}
else Log( LOG_ERR, "Can't get user informaton for UID %d!?", Conf_UID );
} }
/* Initialize modules, part II: these functions are eventually /* Initialize modules, part II: these functions are eventually
@ -357,17 +290,17 @@ main( int argc, const char *argv[] )
* beim PASS-Befehl verwendete Syntax sowie die erweiterten Flags * beim PASS-Befehl verwendete Syntax sowie die erweiterten Flags
* sind in doc/Protocol.txt beschrieben. */ * sind in doc/Protocol.txt beschrieben. */
#ifdef IRCPLUS #ifdef IRCPLUS
sprintf( NGIRCd_ProtoID, "%s%s %s|%s:%s", PROTOVER, PROTOIRCPLUS, PACKAGE_NAME, PACKAGE_VERSION, IRCPLUSFLAGS ); snprintf( NGIRCd_ProtoID, sizeof NGIRCd_ProtoID, "%s%s %s|%s:%s", PROTOVER, PROTOIRCPLUS, PACKAGE_NAME, PACKAGE_VERSION, IRCPLUSFLAGS );
#ifdef ZLIB #ifdef ZLIB
strcat( NGIRCd_ProtoID, "Z" ); strcat( NGIRCd_ProtoID, "Z" );
#endif #endif
if( Conf_OperCanMode ) strcat( NGIRCd_ProtoID, "o" ); if( Conf_OperCanMode ) strcat( NGIRCd_ProtoID, "o" );
#else #else
sprintf( NGIRCd_ProtoID, "%s%s %s|%s", PROTOVER, PROTOIRC, PACKAGE_NAME, PACKAGE_VERSION ); snprintf( NGIRCd_ProtoID, sizeof NGIRCd_ProtoID, "%s%s %s|%s", PROTOVER, PROTOIRC, PACKAGE_NAME, PACKAGE_VERSION );
#endif #endif
strcat( NGIRCd_ProtoID, " P" ); strlcat( NGIRCd_ProtoID, " P", sizeof NGIRCd_ProtoID );
#ifdef ZLIB #ifdef ZLIB
strcat( NGIRCd_ProtoID, "Z" ); strlcat( NGIRCd_ProtoID, "Z", sizeof NGIRCd_ProtoID );
#endif #endif
Log( LOG_DEBUG, "Protocol and server ID is \"%s\".", NGIRCd_ProtoID ); Log( LOG_DEBUG, "Protocol and server ID is \"%s\".", NGIRCd_ProtoID );
@ -395,9 +328,8 @@ main( int argc, const char *argv[] )
Channel_Exit( ); Channel_Exit( );
Lists_Exit( ); Lists_Exit( );
Log_Exit( ); Log_Exit( );
Pidfile_Delete( );
} }
Pidfile_Delete( );
return 0; return 0;
} /* main */ } /* main */
@ -415,42 +347,60 @@ Fill_Version( void )
NGIRCd_VersionAddition[0] = '\0'; NGIRCd_VersionAddition[0] = '\0';
#ifdef SYSLOG #ifdef SYSLOG
strcpy( NGIRCd_VersionAddition, "SYSLOG" ); strlcpy( NGIRCd_VersionAddition, "SYSLOG", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef ZLIB #ifdef ZLIB
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "ZLIB" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "ZLIB", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef TCPWRAP #ifdef TCPWRAP
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "TCPWRAP" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "TCPWRAP", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef RENDEZVOUS #ifdef RENDEZVOUS
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "RENDEZVOUS" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "RENDEZVOUS", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef IDENTAUTH #ifdef IDENTAUTH
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "IDENT" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "IDENT", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef DEBUG #ifdef DEBUG
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "DEBUG" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "DEBUG", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef SNIFFER #ifdef SNIFFER
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "SNIFFER" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "SNIFFER", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef STRICT_RFC #ifdef STRICT_RFC
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "RFC" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "RFC", sizeof NGIRCd_VersionAddition );
#endif #endif
#ifdef IRCPLUS #ifdef IRCPLUS
if( NGIRCd_VersionAddition[0] ) strcat( NGIRCd_VersionAddition, "+" ); if( NGIRCd_VersionAddition[0] )
strcat( NGIRCd_VersionAddition, "IRCPLUS" ); strlcat( NGIRCd_VersionAddition, "+", sizeof NGIRCd_VersionAddition );
strlcat( NGIRCd_VersionAddition, "IRCPLUS", sizeof NGIRCd_VersionAddition );
#endif #endif
if( NGIRCd_VersionAddition[0] ) strlcat( NGIRCd_VersionAddition, "-", sizeof( NGIRCd_VersionAddition )); if( NGIRCd_VersionAddition[0] )
strlcat( NGIRCd_VersionAddition, "-", sizeof( NGIRCd_VersionAddition ));
strlcat( NGIRCd_VersionAddition, TARGET_CPU, sizeof( NGIRCd_VersionAddition )); strlcat( NGIRCd_VersionAddition, TARGET_CPU, sizeof( NGIRCd_VersionAddition ));
strlcat( NGIRCd_VersionAddition, "/", sizeof( NGIRCd_VersionAddition )); strlcat( NGIRCd_VersionAddition, "/", sizeof( NGIRCd_VersionAddition ));
strlcat( NGIRCd_VersionAddition, TARGET_VENDOR, sizeof( NGIRCd_VersionAddition )); strlcat( NGIRCd_VersionAddition, TARGET_VENDOR, sizeof( NGIRCd_VersionAddition ));
@ -480,7 +430,7 @@ NGIRCd_Rehash( void )
Conn_ExitListeners( ); Conn_ExitListeners( );
/* Remember old server name */ /* Remember old server name */
strcpy( old_name, Conf_ServerName ); strlcpy( old_name, Conf_ServerName, sizeof old_name );
/* Re-read configuration ... */ /* Re-read configuration ... */
Conf_Rehash( ); Conf_Rehash( );
@ -651,7 +601,9 @@ Pidfile_Delete( void )
LOCAL void LOCAL void
Pidfile_Create( long pid ) Pidfile_Create( long pid )
{ {
FILE *pidf; int pidfd;
char pidbuf[64];
int len;
/* Pidfile configured? */ /* Pidfile configured? */
if( ! Conf_PidFile[0] ) return; if( ! Conf_PidFile[0] ) return;
@ -660,18 +612,22 @@ Pidfile_Create( long pid )
Log( LOG_DEBUG, "Creating PID file (%s) ...", Conf_PidFile ); Log( LOG_DEBUG, "Creating PID file (%s) ...", Conf_PidFile );
#endif #endif
pidf = fopen( Conf_PidFile, "w" ); pidfd = open( Conf_PidFile, O_RDWR|O_CREAT|O_EXCL, S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
if ( pidfd < 0 ) {
if( ! pidf )
{
Log( LOG_ERR, "Error writing PID file (%s): %s", Conf_PidFile, strerror( errno )); Log( LOG_ERR, "Error writing PID file (%s): %s", Conf_PidFile, strerror( errno ));
return; return;
} }
if( fprintf( pidf, "%ld\n", pid ) < 0 ) len = snprintf( pidbuf, sizeof pidbuf, "%ld\n", pid );
if (len < 0|| len < (int)sizeof pid) {
Log( LOG_ERR, "Error converting pid");
return;
}
if( write( pidfd, pidbuf, len) != len)
Log( LOG_ERR, "Can't write PID file (%s): %s", Conf_PidFile, strerror( errno )); Log( LOG_ERR, "Can't write PID file (%s): %s", Conf_PidFile, strerror( errno ));
if( fclose(pidf) != 0 ) if( close(pidfd) != 0 )
Log( LOG_ERR, "Error closing PID file (%s): %s", Conf_PidFile, strerror( errno )); Log( LOG_ERR, "Error closing PID file (%s): %s", Conf_PidFile, strerror( errno ));
} /* Pidfile_Create */ } /* Pidfile_Create */
@ -688,10 +644,13 @@ Setup_FDStreams( void )
* we are most probably chrooted already and the server has been * we are most probably chrooted already and the server has been
* restarted. So we simply don't try to redirect stdXXX ... */ * restarted. So we simply don't try to redirect stdXXX ... */
fd = open( "/dev/null", O_RDWR ); fd = open( "/dev/null", O_RDWR );
if ( fd < 0 ) return; if ( fd < 0 ) {
Log(LOG_WARNING, "Could not open /dev/null: %s", strerror(errno));
return;
}
/* Close "old" stdin/out/err descriptors */ fflush(stdout);
close( 0 ); close( 1 ); close( 2 ); fflush(stderr);
/* Create new stdin(0), stdout(1) and stderr(2) descriptors */ /* Create new stdin(0), stdout(1) and stderr(2) descriptors */
dup2( fd, 0 ); dup2( fd, 1 ); dup2( fd, 2 ); dup2( fd, 0 ); dup2( fd, 1 ); dup2( fd, 2 );
@ -701,4 +660,146 @@ Setup_FDStreams( void )
} /* Setup_FDStreams */ } /* Setup_FDStreams */
LOCAL bool
NGIRCd_getNobodyID(unsigned int *uid, unsigned int *gid )
{
struct passwd *pwd;
pwd = getpwnam("nobody");
if (!pwd) return false;
if ( !pwd->pw_uid || !pwd->pw_gid)
return false;
*uid = pwd->pw_uid;
*gid = pwd->pw_gid;
endpwent();
return true;
}
LOCAL bool
NGIRCd_Init( bool NGIRCd_NoDaemon )
{
static bool initialized;
bool chrooted = false;
struct passwd *pwd;
struct group *grp;
int real_errno;
long pid;
if (initialized)
return true;
if( Conf_Chroot[0] ) {
if( chdir( Conf_Chroot ) != 0 ) {
Log( LOG_ERR, "Can't chdir() in ChrootDir (%s): %s", Conf_Chroot, strerror( errno ));
return false;
}
if( chroot( Conf_Chroot ) != 0 ) {
if (errno != EPERM) {
Log( LOG_ERR, "Can't change root directory to \"%s\": %s",
Conf_Chroot, strerror( errno ));
return false;
}
} else {
chrooted = true;
Log( LOG_INFO, "Changed root and working directory to \"%s\".", Conf_Chroot );
}
}
if ( Conf_UID == 0 ) {
Log( LOG_INFO, "Conf_UID must not be 0, switching to user nobody", Conf_UID );
if (!NGIRCd_getNobodyID(&Conf_UID, &Conf_GID )) {
Log( LOG_WARNING, "Could not get uid/gid of user nobody: %s",
errno ? strerror(errno) : "not found" );
return false;
}
}
if( setgid( Conf_GID ) != 0 ) {
real_errno = errno;
Log( LOG_ERR, "Can't change group ID to %u: %s", Conf_GID, strerror( errno ));
if (real_errno != EPERM)
return false;
}
if( setuid( Conf_UID ) != 0 ) {
real_errno = errno;
Log( LOG_ERR, "Can't change user ID to %u: %s", Conf_UID, strerror( errno ));
if (real_errno != EPERM)
return false;
}
initialized = true;
/* Normally a child process is forked which isn't any longer
* connected to ther controlling terminal. Use "--nodaemon"
* to disable this "daemon mode" (useful for debugging). */
if ( ! NGIRCd_NoDaemon ) {
initialized = true;
pid = (long)fork( );
if( pid > 0 ) {
/* "Old" process: exit. */
exit( 0 );
}
if( pid < 0 ) {
/* Error!? */
fprintf( stderr, "%s: Can't fork: %s!\nFatal error, exiting now ...\n",
PACKAGE_NAME, strerror( errno ));
exit( 1 );
}
/* New child process */
(void)setsid( );
chdir( "/" );
/* Detach stdin, stdout and stderr */
Setup_FDStreams( );
}
pid = getpid();
Pidfile_Create( pid );
/* check uid we are running as, can be different from values configured (e.g. if we were already
started with a uid > 0 */
Conf_UID = getuid();
Conf_GID = getgid();
assert( Conf_GID > 0);
assert( Conf_UID > 0);
pwd = getpwuid( Conf_UID );
grp = getgrgid( Conf_GID );
Log( LOG_INFO, "Running as user %s(%ld), group %s(%ld), with PID %ld.",
pwd ? pwd->pw_name : "unknown", Conf_UID,
grp ? grp->gr_name : "unknown", Conf_GID, pid);
if ( chrooted ) {
Log( LOG_INFO, "Running chrooted, chrootdir \"%s\".", Conf_Chroot );
return true;
} else {
Log( LOG_INFO, "Not running chrooted." );
}
/* Change working directory to home directory of the user
* we are running as (when not running chroot()'ed!) */
if ( pwd ) {
if( chdir( pwd->pw_dir ) == 0 )
Log( LOG_DEBUG, "Changed working directory to \"%s\" ...", pwd->pw_dir );
else
Log( LOG_ERR, "Can't change working directory to \"%s\": %s",
pwd->pw_dir, strerror( errno ));
} else {
Log( LOG_ERR, "Can't get user informaton for UID %d!?", Conf_UID );
}
return true;
}
/* -eof- */ /* -eof- */