X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=service%2Finstance.c;h=658c086121850ad4a7faa9c58dc64571369cd71e;hb=b44417c20c7fca5a7f7c581c04ac67bf5316e56e;hp=ac96f7df9b3bf7078d77a0e208f99ae1343ba73a;hpb=a30a8fdced45b79bae12662caf68ffb8597858b3;p=oweals%2Fprocd.git diff --git a/service/instance.c b/service/instance.c index ac96f7d..658c086 100644 --- a/service/instance.c +++ b/service/instance.c @@ -26,6 +26,8 @@ #include #include #include +#define SYSLOG_NAMES +#include #include @@ -34,6 +36,7 @@ #include "service.h" #include "instance.h" +#define UJAIL_BIN_PATH "/sbin/ujail" enum { INSTANCE_ATTR_COMMAND, @@ -48,6 +51,7 @@ enum { INSTANCE_ATTR_WATCH, INSTANCE_ATTR_ERROR, INSTANCE_ATTR_USER, + INSTANCE_ATTR_GROUP, INSTANCE_ATTR_STDOUT, INSTANCE_ATTR_STDERR, INSTANCE_ATTR_NO_NEW_PRIVS, @@ -57,6 +61,7 @@ enum { INSTANCE_ATTR_PIDFILE, INSTANCE_ATTR_RELOADSIG, INSTANCE_ATTR_TERMTIMEOUT, + INSTANCE_ATTR_FACILITY, __INSTANCE_ATTR_MAX }; @@ -73,6 +78,7 @@ static const struct blobmsg_policy instance_attr[__INSTANCE_ATTR_MAX] = { [INSTANCE_ATTR_WATCH] = { "watch", BLOBMSG_TYPE_ARRAY }, [INSTANCE_ATTR_ERROR] = { "error", BLOBMSG_TYPE_ARRAY }, [INSTANCE_ATTR_USER] = { "user", BLOBMSG_TYPE_STRING }, + [INSTANCE_ATTR_GROUP] = { "group", BLOBMSG_TYPE_STRING }, [INSTANCE_ATTR_STDOUT] = { "stdout", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_STDERR] = { "stderr", BLOBMSG_TYPE_BOOL }, [INSTANCE_ATTR_NO_NEW_PRIVS] = { "no_new_privs", BLOBMSG_TYPE_BOOL }, @@ -82,6 +88,7 @@ static const struct blobmsg_policy instance_attr[__INSTANCE_ATTR_MAX] = { [INSTANCE_ATTR_PIDFILE] = { "pidfile", BLOBMSG_TYPE_STRING }, [INSTANCE_ATTR_RELOADSIG] = { "reload_signal", BLOBMSG_TYPE_INT32 }, [INSTANCE_ATTR_TERMTIMEOUT] = { "term_timeout", BLOBMSG_TYPE_INT32 }, + [INSTANCE_ATTR_FACILITY] = { "facility", BLOBMSG_TYPE_STRING }, }; enum { @@ -93,6 +100,7 @@ enum { JAIL_ATTR_LOG, JAIL_ATTR_RONLY, JAIL_ATTR_MOUNT, + JAIL_ATTR_NETNS, __JAIL_ATTR_MAX, }; @@ -105,6 +113,7 @@ static const struct blobmsg_policy jail_attr[__JAIL_ATTR_MAX] = { [JAIL_ATTR_LOG] = { "log", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_RONLY] = { "ronly", BLOBMSG_TYPE_BOOL }, [JAIL_ATTR_MOUNT] = { "mount", BLOBMSG_TYPE_TABLE }, + [JAIL_ATTR_NETNS] = { "netns", BLOBMSG_TYPE_BOOL }, }; struct instance_netdev { @@ -148,6 +157,18 @@ static void closefd(int fd) close(fd); } +/* convert a string into numeric syslog facility or return -1 if no match found */ +static int +syslog_facility_str_to_int(const char *facility) +{ + CODE *p = facilitynames; + + while (p->c_name && strcasecmp(p->c_name, facility)) + p++; + + return p->c_val; +} + static void instance_limits(const char *limit, const char *value) { @@ -187,7 +208,7 @@ jail_run(struct service_instance *in, char **argv) struct jail *jail = &in->jail; int argc = 0; - argv[argc++] = "/sbin/ujail"; + argv[argc++] = UJAIL_BIN_PATH; if (jail->name) { argv[argc++] = "-n"; @@ -204,6 +225,16 @@ jail_run(struct service_instance *in, char **argv) argv[argc++] = in->seccomp; } + if (in->user) { + argv[argc++] = "-U"; + argv[argc++] = in->user; + } + + if (in->group) { + argv[argc++] = "-G"; + argv[argc++] = in->group; + } + if (in->no_new_privs) argv[argc++] = "-c"; @@ -222,6 +253,9 @@ jail_run(struct service_instance *in, char **argv) if (jail->ronly) argv[argc++] = "-o"; + if (jail->netns) + argv[argc++] = "-N"; + blobmsg_list_for_each(&jail->mount, var) { const char *type = blobmsg_data(var->data); @@ -242,7 +276,7 @@ instance_removepid(struct service_instance *in) { if (!in->pidfile) return 0; if (unlink(in->pidfile)) { - ERROR("Failed to removed pidfile: %s: %m\n", in->pidfile); + ERROR("Failed to remove pidfile: %s: %m\n", in->pidfile); return 1; } return 0; @@ -319,8 +353,12 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) ULOG_WARN("Seccomp support for %s::%s not available\n", in->srv->name, in->name); #endif - if (in->has_jail) + if (in->has_jail) { argc = jail_run(in, argv); + if (argc != in->jail.argc) + ULOG_WARN("expected %i jail params, used %i for %s::%s\n", + in->jail.argc, argc, in->srv->name, in->name); + } blobmsg_for_each_attr(cur, in->command, rem) argv[argc++] = blobmsg_data(cur); @@ -348,15 +386,15 @@ instance_run(struct service_instance *in, int _stdout, int _stderr) closefd(_stderr); } - if (in->user && in->gid && initgroups(in->user, in->gid)) { + if (!in->has_jail && in->user && in->pw_gid && initgroups(in->user, in->pw_gid)) { ERROR("failed to initgroups() for user %s: %m\n", in->user); exit(127); } - if (in->gid && setgid(in->gid)) { - ERROR("failed to set group id %d: %m\n", in->gid); + if (!in->has_jail && in->gr_gid && setgid(in->gr_gid)) { + ERROR("failed to set group id %d: %m\n", in->gr_gid); exit(127); } - if (in->uid && setuid(in->uid)) { + if (!in->has_jail && in->uid && setuid(in->uid)) { ERROR("failed to set user id %d: %m\n", in->uid); exit(127); } @@ -466,7 +504,7 @@ instance_stdio(struct ustream *s, int prio, struct service_instance *in) arg0 = basename(blobmsg_data(blobmsg_data(in->command))); snprintf(ident, sizeof(ident), "%s[%d]", arg0, in->proc.pid); - ulog_open(ULOG_SYSLOG, LOG_DAEMON, ident); + ulog_open(ULOG_SYSLOG, in->syslog_facility, ident); do { str = ustream_get_read_buf(s, &len); @@ -628,13 +666,19 @@ instance_config_changed(struct service_instance *in, struct service_instance *in if (in->nice != in_new->nice) return true; + if (in->syslog_facility != in_new->syslog_facility) + return true; + if (string_changed(in->user, in_new->user)) return true; + if (string_changed(in->group, in_new->group)) + return true; + if (in->uid != in_new->uid) return true; - if (in->gid != in_new->gid) + if (in->pw_gid != in_new->pw_gid) return true; if (string_changed(in->pidfile, in_new->pidfile)) @@ -757,9 +801,13 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) struct blob_attr *tb[__JAIL_ATTR_MAX]; struct jail *jail = &in->jail; struct stat s; + int r; - if (stat("/sbin/ujail", &s)) + r = stat(UJAIL_BIN_PATH, &s); + if (r < 0) { + ERROR("unable to find %s: %m (%d)\n", UJAIL_BIN_PATH, r); return 0; + } blobmsg_parse(jail_attr, __JAIL_ATTR_MAX, tb, blobmsg_data(attr), blobmsg_data_len(attr)); @@ -767,11 +815,11 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) jail->argc = 2; if (tb[JAIL_ATTR_NAME]) { - jail->name = blobmsg_get_string(tb[JAIL_ATTR_NAME]); + jail->name = strdup(blobmsg_get_string(tb[JAIL_ATTR_NAME])); jail->argc += 2; } if (tb[JAIL_ATTR_HOSTNAME]) { - jail->hostname = blobmsg_get_string(tb[JAIL_ATTR_HOSTNAME]); + jail->hostname = strdup(blobmsg_get_string(tb[JAIL_ATTR_HOSTNAME])); jail->argc += 2; } if (tb[JAIL_ATTR_PROCFS]) { @@ -794,6 +842,10 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) jail->ronly = blobmsg_get_bool(tb[JAIL_ATTR_RONLY]); jail->argc++; } + if (tb[JAIL_ATTR_NETNS]) { + jail->netns = blobmsg_get_bool(tb[JAIL_ATTR_NETNS]); + jail->argc++; + } if (tb[JAIL_ATTR_MOUNT]) { struct blob_attr *cur; int rem; @@ -805,6 +857,15 @@ instance_jail_parse(struct service_instance *in, struct blob_attr *attr) if (in->seccomp) jail->argc += 2; + if (in->user) + jail->argc += 2; + + if (in->group) + jail->argc += 2; + + if (in->no_new_privs) + jail->argc++; + return 1; } @@ -890,7 +951,16 @@ instance_config_parse(struct service_instance *in) if (p) { in->user = strdup(user); in->uid = p->pw_uid; - in->gid = p->pw_gid; + in->gr_gid = in->pw_gid = p->pw_gid; + } + } + + if (tb[INSTANCE_ATTR_GROUP]) { + const char *group = blobmsg_get_string(tb[INSTANCE_ATTR_GROUP]); + struct group *p = getgrnam(group); + if (p) { + in->group = strdup(group); + in->gr_gid = p->gr_gid; } } @@ -901,12 +971,12 @@ instance_config_parse(struct service_instance *in) in->no_new_privs = blobmsg_get_bool(tb[INSTANCE_ATTR_NO_NEW_PRIVS]); if (!in->trace && tb[INSTANCE_ATTR_SECCOMP]) - in->seccomp = blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP]); + in->seccomp = strdup(blobmsg_get_string(tb[INSTANCE_ATTR_SECCOMP])); if (tb[INSTANCE_ATTR_PIDFILE]) { char *pidfile = blobmsg_get_string(tb[INSTANCE_ATTR_PIDFILE]); if (pidfile) - in->pidfile = pidfile; + in->pidfile = strdup(pidfile); } if (tb[INSTANCE_ATTR_RELOADSIG]) @@ -938,6 +1008,15 @@ instance_config_parse(struct service_instance *in) if (!instance_fill_array(&in->errors, tb[INSTANCE_ATTR_ERROR], NULL, true)) return false; + if (tb[INSTANCE_ATTR_FACILITY]) { + int facility = syslog_facility_str_to_int(blobmsg_get_string(tb[INSTANCE_ATTR_FACILITY])); + if (facility != -1) { + in->syslog_facility = facility; + DEBUG(3, "setting facility '%s'\n", blobmsg_get_string(tb[INSTANCE_ATTR_FACILITY])); + } else + DEBUG(3, "unknown syslog facility '%s' given, using default (LOG_DAEMON)\n", blobmsg_get_string(tb[INSTANCE_ATTR_FACILITY])); + } + return true; } @@ -953,6 +1032,20 @@ instance_config_cleanup(struct service_instance *in) blobmsg_list_free(&in->jail.mount); } +static void +instance_config_move_strdup(char **dst, char *src) +{ + if (*dst) { + free(*dst); + *dst = NULL; + } + + if (!src) + return; + + *dst = strdup(src); +} + static void instance_config_move(struct service_instance *in, struct service_instance *in_src) { @@ -966,15 +1059,19 @@ instance_config_move(struct service_instance *in, struct service_instance *in_sr blobmsg_list_move(&in->jail.mount, &in_src->jail.mount); in->trigger = in_src->trigger; in->command = in_src->command; - in->pidfile = in_src->pidfile; in->respawn = in_src->respawn; in->respawn_retry = in_src->respawn_retry; in->respawn_threshold = in_src->respawn_threshold; in->respawn_timeout = in_src->respawn_timeout; in->name = in_src->name; in->trace = in_src->trace; - in->seccomp = in_src->seccomp; in->node.avl.key = in_src->node.avl.key; + in->syslog_facility = in_src->syslog_facility; + + instance_config_move_strdup(&in->pidfile, in_src->pidfile); + instance_config_move_strdup(&in->seccomp, in_src->seccomp); + instance_config_move_strdup(&in->jail.name, in_src->jail.name); + instance_config_move_strdup(&in->jail.hostname, in_src->jail.hostname); free(in->config); in->config = in_src->config; @@ -1010,6 +1107,11 @@ instance_free(struct service_instance *in) instance_config_cleanup(in); free(in->config); free(in->user); + free(in->group); + free(in->jail.name); + free(in->jail.hostname); + free(in->seccomp); + free(in->pidfile); free(in); } @@ -1023,6 +1125,7 @@ instance_init(struct service_instance *in, struct service *s, struct blob_attr * in->timeout.cb = instance_timeout; in->proc.cb = instance_exit; in->term_timeout = 5; + in->syslog_facility = LOG_DAEMON; in->_stdout.fd.fd = -2; in->_stdout.stream.string_data = true; @@ -1112,6 +1215,12 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) if (in->pidfile) blobmsg_add_string(b, "pidfile", in->pidfile); + if (in->user) + blobmsg_add_string(b, "user", in->user); + + if (in->group) + blobmsg_add_string(b, "group", in->group); + if (in->has_jail) { void *r = blobmsg_open_table(b, "jail"); if (in->jail.name) @@ -1123,6 +1232,7 @@ void instance_dump(struct blob_buf *b, struct service_instance *in, int verbose) blobmsg_add_u8(b, "ubus", in->jail.ubus); blobmsg_add_u8(b, "log", in->jail.log); blobmsg_add_u8(b, "ronly", in->jail.ronly); + blobmsg_add_u8(b, "netns", in->jail.netns); blobmsg_close_table(b, r); if (!avl_is_empty(&in->jail.mount.avl)) { struct blobmsg_list_node *var;