cgul/fileutil/fileutil.c

/**
 * Copyright (c) Members of the EGEE Collaboration. 2010. 
 * See http://www.eu-egee.org/partners/ for details on the copyright
 * holders.  
 * 
 * Licensed under the Apache License, Version 2.0 (the "License"); 
 * you may not use this file except in compliance with the License. 
 * You may obtain a copy of the License at 
 * 
 *     http://www.apache.org/licenses/LICENSE-2.0 
 * 
 * Unless required by applicable law or agreed to in writing, software 
 * distributed under the License is distributed on an "AS IS" BASIS, 
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 
 * See the License for the specific language governing permissions and 
 * limitations under the License.
 *
 * Authors: Oscar Koeroo, Mischa Sall\'e, Aram Verstegen
 *      NIKHEF Amsterdam, the Netherlands
 *      <grid-mw-security@nikhef.nl>  
 */

#include <sys/file.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#include "fileutil.h"
#include "../safefile-1.0/safe_id_range_list.h"
#include "../safefile-1.0/safe_is_path_trusted.h"

static int priv_drop(int unpriv_uid,int unpriv_gid);
static int raise_priv(uid_t euid, gid_t egid);

/**
 * Private method.
 * Drops privilege to an unprivileged account. When unpriv_uid and/or unpriv_gid
 * are negative, they will be ignored and the information is taken from the real
 * uid/gid (primary) combination.
 * Returns 0 when successful, or the return code of set[ug]id() on error.
 * */
int priv_drop(int unpriv_uid,int unpriv_gid)  {
    /* drop priv when needed: euid==0, uid!=0 */
    uid_t euid=geteuid(),target_uid;
    gid_t egid=getegid(),target_gid;
    int rc;

    /* Get correct target_gid */
    target_gid=( unpriv_gid<0 ? getgid() : (gid_t)unpriv_gid );
    /* Anything to be done? Note: target_gid MAY be 0 (root group) */ 
    rc=( target_gid==egid ? 0 : setegid(target_gid) );
    /* If error: don't continue */
    if (rc!=0) return rc;

    /* Get correct target_uid */
    target_uid=( unpriv_uid<0 ? getuid() : (uid_t)unpriv_uid );
    /* Anything to be done? target_uid SHOULD NOT be 0 */ 
    rc=( target_uid==0 || target_uid==euid ? 0 : seteuid(target_uid) );
    /* Error: try to restore */
    if (rc!=0) setegid(egid); /* ignore rc of THIS process: damage control */

    return 0;
}

/**
 * Private method.
 * Tries to raise privilege level back to euid/egid.
 * Return -1 when fails or impossible (neither euid or real uid is root), 0
 * upon success.
 * */
int raise_priv(uid_t euid, gid_t egid)  {
    uid_t uid=getuid();

    /* reset euid/egid if: it was (effective) root or real user is root */
    if (euid==0 || uid==0)    {
        if (setegid(egid) || seteuid(euid))
            return -1;
        else
            return 0;
    }
    return -1;
}
/**
 * Does given lock action on file given by filedescriptor fd using mechanism
 * defined by lock_type. lock_type can be a multiple types in which case they
 * will be all used. LCK_NOLOCK is a special lock type which just does nothing
 * and will not be combined with others. Valid lock types:
 *  LCK_NOLOCK  - no locking
 *  LCK_FCNTL   - fcntl() locking
 *  LCK_FLOCK   - flock() locking
 * Valid actions are:
 *  LCK_READ    - set shared read lock
 *  LCK_WRITE   - set exclusive write lock
 *  LCK_UNLOCK  - unset lock
 * Locks are exclusive for writing and shared for reading: multiple processes
 * can read simultaneously, but writing is exclusive, both for reading and
 * writing.
 * Returns -1 on error, 0 on success.
 */
int cgul_filelock(int fd, int lock_type, int action) {
    struct flock lck_struct;
    int rc1,rc2,lck;

    /* Can have multiple lock_types */

    if (lock_type & LCK_NOLOCK)
        return 0;

    /* FLOCK */
    if (lock_type & LCK_FLOCK)  {
#ifdef sun  /* Should NOT use flock on Solaris */
        return -1;
#else
        switch (action) { /* Only one action at the time */
            case LCK_READ:      lck=LOCK_SH; break;
            case LCK_WRITE:     lck=LOCK_EX; break;
            case LCK_UNLOCK:    lck=LOCK_UN; break;
            default:            return -1;
        }
        rc1=flock(fd, lck);
#endif
    } else
        rc1=0;
    /* FCNTL */
    if (lock_type & LCK_FCNTL)  {
        switch (action) { /* Only one action at the time */
            case LCK_READ:      lck_struct.l_type=F_RDLCK; break;
            case LCK_WRITE:     lck_struct.l_type=F_WRLCK; break;
            case LCK_UNLOCK:    lck_struct.l_type=F_UNLCK; break;
            default:            return -1;
        }
        lck_struct.l_whence=SEEK_SET;
        lck_struct.l_start=0;
        lck_struct.l_len=0;
        rc2=fcntl(fd,F_SETLKW,&lck_struct); /* -1 error */
    } else
        rc2=0;
    return (rc1 || rc2 ? -1 : 0);
}


/**
 * Reads proxy from *path using given lock_type (see cgul_filelock). It tries to
 * drop privilege to real-uid/real-gid when euid==0 and uid!=0.
 * Space needed will be malloc-ed.
 * Upon successful completion config contains the contents of path.
 * Return values:
 * 0: success
 * -1: I/O error
 * -2: privilege-drop error
 * -3: permissions error
 * -4: memory error
 * -5: too many retries needed during reading
 * -6: locking failed
 */
int cgul_read_proxy(const char *path, int lock_type, char **proxy)  {
    const int tries=10; /* max number of retries for reading a changing file */
    int i,fd,rc=0;
    struct stat st1,st2,*sptr1,*sptr2,*sptr3;
    uid_t uid=getuid(),euid=geteuid();
    gid_t gid=getgid(),egid=getegid();
    char *buf,*buf_new; /* *proxy will be updated when everything is ok */
    ssize_t size;

    /* Drop privilege to real uid and real gid, only when we can and are
     * not-root */
    if ( euid==0 && uid!=0 && priv_drop(uid,gid) )
        return -2;
    /* Open file */
    if ((fd=open(path,O_RDONLY))==-1)   {
        raise_priv(euid,egid); return -1;
    }
    /* Lock file */
    if (cgul_filelock(fd,lock_type,LCK_READ))    {
        close(fd); raise_priv(euid,egid); return -6;
    }
    /* Stat the file before reading:
     * Need ownership and mode for allowed values, size for malloc */
    if (fstat(fd,&st1)) {
        close(fd); raise_priv(euid,egid); return -1;
    }
    /* Check we own it (only uid) and it is unreadable/unwriteable for anyone
     * else */ 
    if ( st1.st_uid!=uid || 
         st1.st_mode & S_IRGRP || st1.st_mode & S_IWGRP ||
         st1.st_mode & S_IROTH || st1.st_mode & S_IWOTH )   {
        close(fd); raise_priv(euid,egid); return -3;
    }
    /* Get expected space: need 1 extra for trailing '\0' */
    if ( (buf=(char *)malloc((size_t)(st1.st_size+sizeof(char))))==NULL)   {
        close(fd); raise_priv(euid,egid); return -4;
    }
    /* use pointers to the two so that we can swap them easily */
    sptr1=&st1; sptr2=&st2;
    /* reading retry loop */
    for (i=0; i<tries; i++)   {
        /* Read file: if statted size changes, we will try again */
        size=read(fd,buf,(size_t)sptr1->st_size);
        buf[size]='\0'; /* Important: read doesn't add the '\0' */
        /* Stat the file */
        if (fstat(fd,sptr2)==-1)    { /* cannot even stat: I/O error */
            rc=-1; break;
        }
        /* Size, mtime and ctime should have stayed the same, especially ctime
         * is good as we can't change it with touch ! */
        if ( sptr2->st_size == sptr1->st_size &&        /* size equal */
             sptr2->st_mtime== sptr1->st_mtime &&       /* mtime equal */
             sptr2->st_ctime== sptr1->st_ctime)   {     /* ctime equal */
            /* Just check the return of the read, we might have an I/O error */
            rc= (size==(ssize_t)sptr1->st_size ? 0 : -1);
            break;
        }

        /* File has changed during reading: retry */
        if (i<tries-1)  { /* will be doing a retry */
            buf_new=(char *)realloc(buf,(size_t)(sptr2->st_size+sizeof(char)));
            if ( buf_new==NULL )    {
                rc=-4; break;
            }
            buf=buf_new;
            /* swap struct pointers */
            sptr3=sptr2; sptr2=sptr1; sptr1=sptr3;
            /* wait */
            usleep(500);
            /* About to read again, make sure we're (again) at the start */
            if (lseek(fd,0,SEEK_SET)!=0)        { /* I/O error */
                rc=-1; break;
            }
        } else /* failed too many times */
            rc=-5;
    }
    
    /* unlock and close the file, ignore exitval: we have read already */
    cgul_filelock(fd,lock_type,LCK_UNLOCK);
    close(fd);
    /* reset euid/egid if it was (effective) root. Ignore exit value. */
    raise_priv(euid,egid);
    /* finalize */
    if (rc!=0)  {
        free(buf); return rc;
    }
    /* Only now put buf in *proxy */
    *proxy=buf;
    return 0;
}

/**
 * Used to read in a config file, the path is checked to be trusted (and
 * possible confidential) using safe_is_path_trusted_r() from the safefile
 * library of J. Kupsch.
 * Upon successful completion config contains the contents of the file at path.
 *
 * The config file (is trusted) when each of its pathcomponents is writeable
 * only by user root or user trusted_uid (which may also be 0).
 * In case userswitching is possible and the macro DEMAND_CONFIG_IS_CONFIDENTIAL
 * is defined, then an additional check for 'confidentiality' is done. The file
 * is confidential when it is only readable by the trusted users (root and
 * trust_uid) and/or the groupids trust_gid (only when !=-1, hence the type int
 * instead gid_t) or effective gid (when different from real gid, i.e. in setgid
 * mode).
 * 
 * In case userswitching is possible privilege is dropped to account
 * trust_uid/trust_gid. If trust_uid==0 then real uid is used, if trust_gid==-1
 * then effective gid is used.
 *
 * Return values:
 *  0: succes
 *  -1: I/O error, including when file changed during reading in any way other
 *      than access time.
 *  -2: privilege-drop error
 *  -3: permission error (untrusted path)
 *  -4: memory error
 *  -5: unknown or safefile error
 *  -10: confidentiality error
 */
int cgul_read_config(const char *path, char **config,
                     uid_t trust_uid, int trust_gid)    {
    int fd,rc,trust,switching;
    uid_t euid=geteuid(),uid=getuid(),target_uid;
    gid_t egid=getegid(),target_gid;
    struct safe_id_range_list ulist,glist;
    struct stat st_before,st_after;
    char *buf;
#ifdef DEMAND_CONFIG_IS_CONFIDENTIAL
    gid_t gid=getgid();
    int dotest;
#endif


    /* Expected level of trust depends on mode: user switching or not */
    if (euid==0 || uid==0)    {
        switching=1;
        /* Switch uid to trust_uid unless it's root, in that case switch to real uid */
        target_uid=trust_uid!=0 ? trust_uid : uid;
        /* Switch gid to trust_gid unless -1, in that case switch to effective
         * gid (which might be real gid). */
        target_gid=trust_gid!=-1 ? (gid_t)trust_gid : egid;
        /* when target_uid!=0 (i.e. when real uid is 0) then set privileges */
        if (target_uid!=0 && priv_drop(target_uid,target_gid))
            return -2; /* privdrop error */
    } else  {
        /* Nothing to switch, trust_uid/trust_gid will be used to check the file
         * permissions only. */
        switching=0;
    }

    /* initialize the lists of trusted uid/gid, can basically only fail when
     * out of memory. These are the UIDs GIDs trusted for WRITING!: only
     * trust_uid, when specified, and root (automatic) */
    if ( safe_init_id_range_list(&ulist) ||
         safe_init_id_range_list(&glist) ||
         safe_add_id_to_list(&ulist,trust_uid) ) {
        raise_priv(euid,egid); return -4; /* out-of-memory */
    }
    /* Do an stat so that we can compare modes etc. before/after, note we use
     * stat and not lstat, because we want to know information about the target,
     * not the symlink. In particular we need the size of the target! */
    if (stat(path,&st_before))  {
        raise_priv(euid,egid); return -1; /* I/O error */
    }

    /* Check whether file is trusted */
    trust=safe_is_path_trusted_r(path,&ulist,&glist);
    /* Check the level of trust */
    switch (trust)  {
        case SAFE_PATH_TRUSTED_CONFIDENTIAL:
            rc=0; break; /* GOOD */
        case SAFE_PATH_UNTRUSTED:
            /* Perms are wrong */
            rc=-3; break; /* perm error */
        case SAFE_PATH_TRUSTED:
        case SAFE_PATH_TRUSTED_STICKY_DIR:
#ifdef DEMAND_CONFIG_IS_CONFIDENTIAL
            /* Need to further test in switching mode */
            if (switching)  {
                dotest=0;
                if (egid!=gid)  { /* Add egid (when !=gid) */
                    if (safe_add_id_to_list(&glist,egid))   {
                        rc=-4; break; /* out-of-memory */
                    }
                    dotest=1;
                }
                if (trust_gid!=-1)  { /* Add trust_gid (when !=-1) */
                    if (safe_add_id_to_list(&glist,(gid_t)trust_gid))   {
                        rc=-4; break; /* out-of-memory */
                    }
                    dotest=1;
                }
                if (dotest) { /* Has something changed? */
                    /* Test whether it's confidential for this new list */
                    trust=safe_is_path_trusted_r(path,&ulist,&glist);
                    switch (trust)  {
                        case SAFE_PATH_TRUSTED_CONFIDENTIAL: /* GOOD */
                            rc=0; break;
                        case SAFE_PATH_TRUSTED: /* confid error */
                        case SAFE_PATH_TRUSTED_STICKY_DIR: /* confid error */
                            rc=-10; break;
                        case SAFE_PATH_ERROR: /* checking failed */
                        default:
                            rc=-5; break; /* unknown error */
                    }
                } else /* Nothing changed, so it's not confidential */
                    rc=-10;
            } else /* not-switching, perms are ok */
                rc=0;
            break;
#else
            /* TRUSTED-only is fine */
            rc=0;
            break;
#endif
        case SAFE_PATH_ERROR: /* checking failed */
        default: /* Unknown state, should not be reached */
            rc=-5; break;
    }

    /* free the range lists */
    safe_destroy_id_range_list(&ulist);
    safe_destroy_id_range_list(&glist);

    /* Check what we returned */
    if (rc!=0)  {
        raise_priv(euid,egid); return rc;
    }

    /* Open file and stat the file (latter for size) */
    if ((fd=open(path,O_RDONLY))==-1)   {
        raise_priv(euid,egid); return -1; /* I/O error */
    }
    /* Get expected space, don't forget trailing '\0' */
    if ( (buf=(char *)malloc((size_t)(st_before.st_size+sizeof(char))))==NULL)
    {
        close(fd); raise_priv(euid,egid); return -4; /* out-of-memory */
    }
    /* Read the file, check we get right size */
    if ( read(fd,buf,st_before.st_size)!=(ssize_t)st_before.st_size ||
         fstat(fd,&st_after) ||                     /* Do stat fd           */
         st_before.st_dev   !=st_after.st_dev ||    /* device               */
         st_before.st_ino   !=st_after.st_ino ||    /* inode                */
         st_before.st_size  !=st_after.st_size ||   /* size                 */
         st_before.st_mode  !=st_after.st_mode ||   /* mode                 */
         st_before.st_uid   !=st_after.st_uid ||    /* uid                  */  
         st_before.st_gid   !=st_after.st_gid ||    /* gid                  */
         st_before.st_mtime !=st_after.st_mtime ||  /* modification time    */
         st_before.st_ctime !=st_after.st_ctime )   /* creation time        */
        /* something changed or went wrong: classify all as I/O error, because
         * we were reading a trusted or confidential file.
         * Don't return yet, we want to free the memory centrally */
        rc=-1; /* I/O error */
    else    {
        /* add trailing '\0' */
        buf[st_after.st_size]='\0';
        rc=0;
    }
    /* Close file */
    close(fd);
    /* reset euid/egid if it was (effective) root. Ignore exit value. */
    raise_priv(euid,egid);
    /* finalize */
    if (rc!=0)
        free(buf);
    else /* Only now put buf in *proxy */
        *config=buf;
    return rc;
}

/**
 * Writes proxy from *proxy to *path using given lock_type (see cgul_filelock).
 * When (e)uid==0 it tries to drop privilege to given write_uid, write_gid. When
 * either of these is -1, the real uid/gid is used instead, if one of those is
 * root, the corresponding effective uid/gid is used instead.
 * Return values:
 * 0: success
 * -1: I/O error
 * -2: privilege-drop error
 * -3: permissions error, including file directly in / or not absolute
 * -4: memory error
 * -6: locking failed
 */
int cgul_write_proxy(const char *path, int lock_type, const char *proxy,
                     int write_uid, int write_gid) {
    const mode_t filemode=S_IRUSR | S_IWUSR;
    const mode_t dirmode=S_IRUSR | S_IWUSR | S_IXUSR;
    int fd,rc;
    uid_t euid=geteuid(), uid=getuid(), target_uid;
    gid_t egid=getegid(), gid=getgid(), target_gid;
    size_t expsize=strlen(proxy)/sizeof(char);
    char *pos,*pathcopy;

    /* Set write uid */
    if (write_uid>=0)
        target_uid=write_uid;
    else
        target_uid=(uid==0 ? euid : uid); /* when real==root: stay effective */
    /* Set write gid */
    if (write_gid>=0)
        target_gid=write_gid;
    else
        target_gid=(gid==0 ? egid : gid); /* when real==root: stay effective */

    /* Drop privilege when (e)uid == 0 */
    if ( (euid==0 || uid==0) && priv_drop(target_uid,target_gid))
        return -2;
    /* make copy of the path */
    if ( (pathcopy=strdup(path))==NULL ) {
        /* out of mem */
        raise_priv(euid,egid); return -4;
    }
    /* Check filename */
    if ( (pos=strrchr(pathcopy,'/'))==NULL) {
        free(pathcopy); raise_priv(euid,egid); return -3;
    }
    /* Create parent directories where needed */
    pos[0]='\0';
    if ((rc=cgul_mkdir_with_parents(pathcopy,dirmode))!=0) {
        free(pathcopy); raise_priv(euid,egid); return rc;
    }
    free(pathcopy);
    /* Open the file */
    if ( (fd=open(path,O_WRONLY | O_CREAT,filemode))==-1 )      {
        raise_priv(euid,egid); return -1;
    }
    /* Lock the file */
    if ( cgul_filelock(fd,lock_type,LCK_WRITE) ) {
        close(fd); raise_priv(euid,egid); return -6;
    }
    /* Do a chmod and chown, in case it already existed. If this fails, the file
     * has the wrong permissions.
     * Chowning is in principal only for the group. */
    if ( fchmod(fd,filemode) || fchown(fd,target_uid,target_gid) )      {
        close(fd); raise_priv(euid,egid); return -3; 
    }
    /* Truncate and write file */
    if ( ftruncate(fd,0)!=0 ||
         write(fd,proxy,expsize)!=(ssize_t)expsize )    { 
        close(fd); raise_priv(euid,egid); return -1; /* write error */
    }
    /* unlock: ignore the exit code */
    cgul_filelock(fd,lock_type,LCK_UNLOCK);
    /* close the file, don't ignore exit values: might have write error */
    if (close(fd))
        rc=-1;
    else
        rc=0;

    /* reset euid/egid if it was (effective) root. Ignore exit value. */
    raise_priv(euid,egid);
    return 0;
}

/**
 * Writes proxy to unique filename created from path_template using mkstemp().
 * path_template will be overridden with the actual filename.
 * When (e)uid==0 it tries to drop privilege to given write_uid, write_gid. When
 * either of these is -1, the real uid/gid is used instead, if one of those is
 * root, the corresponding effective uid/gid is used instead.
 * Any directory in path_template will be attempted to be created if it doesn't
 * exist, with mode 0600.
 * Return values:
 *  0: success
 *  -1: I/O error, this includes a failure of mkstemp which can be due to a
 *      wrong template. It MUST contain 6 consecutive X's.
 *  -2: privilege-drop error
 *  -3: illegal path_template: in / or not absolute.
 *  -4: memory error
 *  -5: invalid template: it MUST end with 6 X's 
 */
int cgul_write_uniq_proxy(char *path_template, const char *proxy,
                          int write_uid, int write_gid) {
    const mode_t filemode=S_IRUSR | S_IWUSR;
    const mode_t dirmode=S_IRUSR | S_IWUSR | S_IXUSR;
    int fd,rc;
    char *pos;
    uid_t uid=getuid(), euid=geteuid(), target_uid;
    gid_t gid=getgid(), egid=getegid(), target_gid;
    size_t expsize=strlen(proxy)/sizeof(char);

    /* Check template format, see mkstemp() */
    pos=(char *)&(path_template[strlen(path_template)-6]);
    if (strncmp(pos,"XXXXXX",6)!=0)
        return -5;

    /* Set write uid */
    if (write_uid>=0)
        target_uid=write_uid;
    else
        target_uid=(uid==0 ? euid : uid); /* when real==root: stay effective */
    /* Set write gid */
    if (write_gid>=0)
        target_gid=write_gid;
    else
        target_gid=(gid==0 ? egid : gid); /* when real==root: stay effective */

    /* Drop privilege when (e)uid == 0 */
    if ( (euid==0 || uid==0) && priv_drop(target_uid,target_gid))
        return -2;
    
    /* Check filename */
    if ( (pos=strrchr(path_template,'/'))==NULL) { /* illegal pathname */
        raise_priv(euid,egid); return -3;
    }
    /* Create parent directories where needed */
    pos[0]='\0';
    if ((rc=cgul_mkdir_with_parents(path_template,dirmode))!=0) {
        raise_priv(euid,egid); return rc;
    }
    pos[0]='/';
    /* Open unique filename */
    if ( (fd=mkstemp(path_template))==-1)    {
        raise_priv(euid,egid); return -1;
    }
    /* chmod and write the file */
    if (fchmod(fd,filemode) ||
        write(fd,proxy,expsize)!=(ssize_t)expsize )   {
        close(fd); raise_priv(euid,egid); return -1;
    }
    /* close the file, don't ignore exit values: might have write error */
    if (close(fd))  {
        raise_priv(euid,egid); return -1;
    }

    /* reset euid/egid if it was (effective) root. Ignore exit value. */
    raise_priv(euid,egid);
    return 0;
}

/**
 * Behaviour as mkdir -p: create parents where needed.
 * Return values:
 *  0: success
 *  -1: I/O error, e.g. a component is not a dir, not accessible, etc.
 *  -3: absolutedir is not absolute (does not start with '/')
 *  -4: out of memory
 */
int cgul_mkdir_with_parents(const char *absolutedir, mode_t mode)  {
    int rc;
    mode_t oldumask;
    char *dir,*pos;
    struct stat dir_stat;

    if (absolutedir[0]!='/') /* need absolute path */
        return -3;
    /* make copy for local usage */
    if ( (dir=strdup(absolutedir))==NULL )
        return -4; /* out of memory */

    /* pos will 'loop' over all the '/' except the leading one */
    pos=dir;
    /* Enforce mode as the creation mode, even when umask is more permissive */
    oldumask=umask(~mode);
    do {
        /* Setup the next path component */
        pos=strchr(&(pos[1]),'/');
        if (pos!=NULL) pos[0]='\0';
        /* First check if dir exists: needed for automount */
        if ((rc=stat(dir,&dir_stat)))    { /* stat failed: rc now -1 */
            /* Check if it is due to non-existing component */
            if (errno==ENOENT)  { /* means doesn't exist (since dir!="") */
                if ((rc=mkdir(dir,mode)))
                    break;  /* rc==-1 from mkdir */
            } else /* stat failed for other reason: error */
                break;
        } else { /* Check if existing component is a directory */
            if (!S_ISDIR(dir_stat.st_mode)) {
                rc=-1;
                break;
            }
        }
        if (pos==NULL) /* This was the last path component */
            break;
        /* Put the / back */
        pos[0]='/';
    } while ( 1 );
    /* reset umask */
    umask(oldumask);
    /* Free memory and return */
    free(dir);
    return rc;
}

/**
 * Safely opens a root-owned logfile with given set of file- and directory
 * permissions, using J. Kupsch safe_path_is_trusted_r() routine. The file will
 * be opened with O_WRONLY | O_APPEND | O_CREAT and will have set in addition
 * the flag FD_CLOEXEC (automatically close upon exec() calls, see fcntl() ).
 *  log_file  absolute filename of the logfile
 *  filemask  mode_t of the file, if file doesn't exists, it gets this set,
 *            otherwise, it may not be 'more open' than this.
 *  dirmask   mode_t of directories that will be created.
 *  file      FILE handle of opened file, or NULL on error
 * Return values:
 *  0 - success
 *  -1 - mkdir error
 *  -2 - I/O error
 *  -3 - permission failed (path or file)
 *  -4 - out-of-memory
 *  -5 - filename not absolute
 *  -6 - stat before/after differs
 *  -8 - unknown error
 */
int cgul_open_logfile(const char *log_file,
                      const mode_t filemask, const mode_t dirmask,
                      FILE **file)  {
    mode_t mode,oldumask;
    struct stat st_before, st_after;
    char *pos, *dir;
    int rc, fd, flags, trust;
    struct safe_id_range_list ulist,glist;

    /* Make sure file has a well-defined value */
    *file=NULL;

    /* First create the directory if it doesn't yet exist, rate a absolute path
     * as a permission failure */
    if ((dir=strdup(log_file))==NULL)
        return -4; /* out-of-memory */
    if ((pos=strrchr(dir,'/'))==NULL)   {
        free(dir);
        return -5;
    }
    *pos='\0';
    rc=cgul_mkdir_with_parents(dir, dirmask);
    free(dir);
    if (rc!=0)  {
        if (rc==-1) return -1; /* mkdir I/O error */
        if (rc==-4) return -4; /* out-of-memory */
        return -8;
    }
    
    /* Now open the file, in append mode, we will check everything afterwards:
     * 1) stat to see if the thing when it exists is a file, needed to prevent
     *    blocking on a fifo.
     * 2) open the file
     * 3) check if the path is trusted
     * 4) do a stat on the by now trusted path
     * 5) check that the trusted path is the same as the opened one.*/

    /* If not regular file: permission error. Note: output of this stat us
     * further ignored. */
    if (stat(log_file,&st_before)==0 && !S_ISREG(st_before.st_mode))
        return -3;
   
    /* Set umask to enforce not overprotecting the filemask */
    oldumask=umask(~filemask);
    /* Open log file, and add the FD_CLOEXEC flag, which means
     * automatically close the file upon execve */
    if ( (fd=open(log_file, O_WRONLY | O_APPEND | O_CREAT, filemask))==-1 ||
         (flags=fcntl(fd,F_GETFD))==-1 ||
         fcntl(fd,F_SETFD,flags | FD_CLOEXEC)==-1)  {
        umask(oldumask); /* still reset umask */
        return -2;
    }
    /* reset umask */
    umask(oldumask);

    /* initialize the lists of trusted uid/gid, can basically only fail when
     * out of memory. These are the UIDs GIDs trusted for WRITING!: only
     * trust_uid, when specified, and root (automatic) */
    if ( safe_init_id_range_list(&ulist) || safe_init_id_range_list(&glist) )  {
        close(fd);
        return -4;
    }
    /* Check whether file is trusted */
    trust=safe_is_path_trusted_r(log_file,&ulist,&glist);

    /* free the range lists */
    safe_destroy_id_range_list(&ulist);
    safe_destroy_id_range_list(&glist);

    /* Do stats so that we can compare modes etc. before/after. */
    if (stat(log_file,&st_after) || fstat(fd,&st_before))   { /* I/O error */
        close(fd);
        return -2;
    }

    /* Check if we actually opened the checked file and that it didn't change
     * mode/ownership */
    if ( st_before.st_dev   !=st_after.st_dev ||    /* device               */
         st_before.st_ino   !=st_after.st_ino ||    /* inode                */
         st_before.st_mode  !=st_after.st_mode ||   /* mode                 */
         st_before.st_uid   !=st_after.st_uid ||    /* uid                  */  
         st_before.st_gid   !=st_after.st_gid )     /* gid                  */  {
        close(fd);
        return -6;
    }
    
    /* Check the level of trust */
    switch (trust)  {
        case SAFE_PATH_TRUSTED_CONFIDENTIAL:
        case SAFE_PATH_TRUSTED:
        case SAFE_PATH_TRUSTED_STICKY_DIR:
            break; /* GOOD */
        case SAFE_PATH_UNTRUSTED: /* perm error */
            close(fd);
            return -3; break;
        case SAFE_PATH_ERROR: /* checking failed */
        default: /* Unknown state, should not be reached */
            close(fd);
            return -8; break;
    }

    /* Check the mode of the file doesn't exceed the permissible: even though
     * it's trusted, it is NOT allowed to be readable beyond filemask. */
    mode = st_after.st_mode & ~S_IFMT;
    if ((mode & filemask) != mode) {
        close(fd);
        return -3;
    }


    /* Now attach the filedescriptor to a stream */
    if ( (*file = fdopen(fd,"a")) == NULL )     {
        close(fd);
        return -1;
    }

    /* All is fine now */
    return 0;
}
grid.support@nikhef.nl	ViewVC Help
Powered by ViewVC 1.1.28