busybox/runit/chpst.c

490 lines
14 KiB
C
Raw Normal View History

/*
Copyright (c) 2001-2006, Gerrit Pape
All rights reserved.
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice,
this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
notice, this list of conditions and the following disclaimer in the
documentation and/or other materials provided with the distribution.
3. The name of the author may not be used to endorse or promote products
derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE AUTHOR ''AS IS'' AND ANY EXPRESS OR IMPLIED
WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO
EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/
/* Busyboxed by Denys Vlasenko <vda.linux@googlemail.com> */
//config:config CHPST
//config: bool "chpst (8.7 kb)"
//config: default y
//config: help
//config: chpst changes the process state according to the given options, and
//config: execs specified program.
//config:
//config:config SETUIDGID
//config: bool "setuidgid (4.2 kb)"
//config: default y
//config: help
//config: Sets soft resource limits as specified by options
//config:
//config:config ENVUIDGID
//config: bool "envuidgid (3.6 kb)"
//config: default y
//config: help
//config: Sets $UID to account's uid and $GID to account's gid
//config:
//config:config ENVDIR
//config: bool "envdir (2.5 kb)"
//config: default y
//config: help
//config: Sets various environment variables as specified by files
//config: in the given directory
//config:
//config:config SOFTLIMIT
//config: bool "softlimit (4.3 kb)"
//config: default y
//config: help
//config: Sets soft resource limits as specified by options
//applet:IF_CHPST( APPLET_NOEXEC(chpst, chpst, BB_DIR_USR_BIN, BB_SUID_DROP, chpst))
// APPLET_NOEXEC:name main location suid_type help
//applet:IF_ENVDIR( APPLET_NOEXEC(envdir, chpst, BB_DIR_USR_BIN, BB_SUID_DROP, envdir))
//applet:IF_ENVUIDGID(APPLET_NOEXEC(envuidgid, chpst, BB_DIR_USR_BIN, BB_SUID_DROP, envuidgid))
//applet:IF_SETUIDGID(APPLET_NOEXEC(setuidgid, chpst, BB_DIR_USR_BIN, BB_SUID_DROP, setuidgid))
//applet:IF_SOFTLIMIT(APPLET_NOEXEC(softlimit, chpst, BB_DIR_USR_BIN, BB_SUID_DROP, softlimit))
//kbuild:lib-$(CONFIG_CHPST) += chpst.o
//kbuild:lib-$(CONFIG_ENVDIR) += chpst.o
//kbuild:lib-$(CONFIG_ENVUIDGID) += chpst.o
//kbuild:lib-$(CONFIG_SETUIDGID) += chpst.o
//kbuild:lib-$(CONFIG_SOFTLIMIT) += chpst.o
//usage:#define chpst_trivial_usage
//usage: "[-vP012] [-u USER[:GRP]] [-U USER[:GRP]] [-e DIR]\n"
//usage: " [-/ DIR] [-n NICE] [-m BYTES] [-d BYTES] [-o N]\n"
//usage: " [-p N] [-f BYTES] [-c BYTES] PROG ARGS"
//usage:#define chpst_full_usage "\n\n"
//usage: "Change the process state, run PROG\n"
//usage: "\n -u USER[:GRP] Set uid and gid"
//usage: "\n -U USER[:GRP] Set $UID and $GID in environment"
//usage: "\n -e DIR Set environment variables as specified by files"
//usage: "\n in DIR: file=1st_line_of_file"
//usage: "\n -/ DIR Chroot to DIR"
//usage: "\n -n NICE Add NICE to nice value"
//usage: "\n -m BYTES Same as -d BYTES -s BYTES -l BYTES"
//usage: "\n -d BYTES Limit data segment"
//usage: "\n -o N Limit number of open files per process"
//usage: "\n -p N Limit number of processes per uid"
//usage: "\n -f BYTES Limit output file sizes"
//usage: "\n -c BYTES Limit core file size"
//usage: "\n -v Verbose"
//usage: "\n -P Create new process group"
//usage: "\n -0 Close stdin"
//usage: "\n -1 Close stdout"
//usage: "\n -2 Close stderr"
//usage:
//usage:#define envdir_trivial_usage
//usage: "DIR PROG ARGS"
//usage:#define envdir_full_usage "\n\n"
//usage: "Set various environment variables as specified by files\n"
//usage: "in the directory DIR, run PROG"
//usage:
//usage:#define envuidgid_trivial_usage
//usage: "USER PROG ARGS"
//usage:#define envuidgid_full_usage "\n\n"
//usage: "Set $UID to USER's uid and $GID to USER's gid, run PROG"
//usage:
//usage:#define setuidgid_trivial_usage
//usage: "USER PROG ARGS"
//usage:#define setuidgid_full_usage "\n\n"
//usage: "Set uid and gid to USER's uid and gid, drop supplementary group ids,\n"
//usage: "run PROG"
//usage:
//usage:#define softlimit_trivial_usage
//usage: "[-a BYTES] [-m BYTES] [-d BYTES] [-s BYTES] [-l BYTES]\n"
//usage: " [-f BYTES] [-c BYTES] [-r BYTES] [-o N] [-p N] [-t N]\n"
//usage: " PROG ARGS"
//usage:#define softlimit_full_usage "\n\n"
//usage: "Set soft resource limits, then run PROG\n"
//usage: "\n -a BYTES Limit total size of all segments"
//usage: "\n -m BYTES Same as -d BYTES -s BYTES -l BYTES -a BYTES"
//usage: "\n -d BYTES Limit data segment"
//usage: "\n -s BYTES Limit stack segment"
//usage: "\n -l BYTES Limit locked memory size"
//usage: "\n -o N Limit number of open files per process"
//usage: "\n -p N Limit number of processes per uid"
//usage: "\nOptions controlling file sizes:"
//usage: "\n -f BYTES Limit output file sizes"
//usage: "\n -c BYTES Limit core file size"
//usage: "\nEfficiency opts:"
//usage: "\n -r BYTES Limit resident set size"
//usage: "\n -t N Limit CPU time, process receives"
//usage: "\n a SIGXCPU after N seconds"
#include "libbb.h"
#include <sys/resource.h> /* getrlimit */
/*
Five applets here: chpst, envdir, envuidgid, setuidgid, softlimit.
Only softlimit and chpst are taking options:
# common
-o N Limit number of open files per process
-p N Limit number of processes per uid
-m BYTES Same as -d BYTES -s BYTES -l BYTES [-a BYTES]
-d BYTES Limit data segment
-f BYTES Limit output file sizes
-c BYTES Limit core file size
# softlimit
-a BYTES Limit total size of all segments
-s BYTES Limit stack segment
-l BYTES Limit locked memory size
-r BYTES Limit resident set size
-t N Limit CPU time
# chpst
-u USER[:GRP] Set uid and gid
-U USER[:GRP] Set $UID and $GID in environment
-e DIR Set environment variables as specified by files in DIR
-/ DIR Chroot to DIR
-n NICE Add NICE to nice value
-v Verbose
-P Create new process group
-0 -1 -2 Close fd 0,1,2
Even though we accept all these options for both softlimit and chpst,
they are not to be advertised on their help texts.
We have enough problems with feature creep in other people's
software, don't want to add our own.
envdir, envuidgid, setuidgid take no options, but they reuse code which
handles -e, -U and -u.
*/
enum {
OPT_a = (1 << 0) * ENABLE_SOFTLIMIT,
OPT_c = (1 << 1) * (ENABLE_SOFTLIMIT || ENABLE_CHPST),
OPT_d = (1 << 2) * (ENABLE_SOFTLIMIT || ENABLE_CHPST),
OPT_f = (1 << 3) * (ENABLE_SOFTLIMIT || ENABLE_CHPST),
OPT_l = (1 << 4) * ENABLE_SOFTLIMIT,
OPT_m = (1 << 5) * (ENABLE_SOFTLIMIT || ENABLE_CHPST),
OPT_o = (1 << 6) * (ENABLE_SOFTLIMIT || ENABLE_CHPST),
OPT_p = (1 << 7) * (ENABLE_SOFTLIMIT || ENABLE_CHPST),
OPT_r = (1 << 8) * ENABLE_SOFTLIMIT,
OPT_s = (1 << 9) * ENABLE_SOFTLIMIT,
OPT_t = (1 << 10) * ENABLE_SOFTLIMIT,
OPT_u = (1 << 11) * (ENABLE_CHPST || ENABLE_SETUIDGID),
OPT_U = (1 << 12) * (ENABLE_CHPST || ENABLE_ENVUIDGID),
OPT_e = (1 << 13) * (ENABLE_CHPST || ENABLE_ENVDIR),
OPT_root = (1 << 14) * ENABLE_CHPST,
OPT_n = (1 << 15) * ENABLE_CHPST,
OPT_v = (1 << 16) * ENABLE_CHPST,
OPT_P = (1 << 17) * ENABLE_CHPST,
OPT_0 = (1 << 18) * ENABLE_CHPST,
OPT_1 = (1 << 19) * ENABLE_CHPST,
OPT_2 = (1 << 20) * ENABLE_CHPST,
};
/* TODO: use recursive_action? */
static NOINLINE void edir(const char *directory_name)
{
int wdir;
DIR *dir;
struct dirent *d;
int fd;
wdir = xopen(".", O_RDONLY | O_NDELAY);
xchdir(directory_name);
dir = xopendir(".");
for (;;) {
char buf[256];
char *tail;
int size;
errno = 0;
d = readdir(dir);
if (!d) {
if (errno)
bb_perror_msg_and_die("readdir %s",
directory_name);
break;
}
if (d->d_name[0] == '.')
continue;
fd = open(d->d_name, O_RDONLY | O_NDELAY);
if (fd < 0) {
if ((errno == EISDIR) && directory_name) {
if (option_mask32 & OPT_v)
bb_perror_msg("warning: %s/%s is a directory",
directory_name, d->d_name);
continue;
}
bb_perror_msg_and_die("open %s/%s",
directory_name, d->d_name);
}
size = full_read(fd, buf, sizeof(buf)-1);
close(fd);
if (size < 0)
bb_perror_msg_and_die("read %s/%s",
directory_name, d->d_name);
if (size == 0) {
unsetenv(d->d_name);
continue;
}
buf[size] = '\n';
tail = strchr(buf, '\n');
/* skip trailing whitespace */
while (1) {
*tail = '\0';
tail--;
if (tail < buf || !isspace(*tail))
break;
}
xsetenv(d->d_name, buf);
}
closedir(dir);
xfchdir(wdir);
close(wdir);
}
static void limit(int what, long l)
{
struct rlimit r;
/* Never fails under Linux (except if you pass it bad arguments) */
getrlimit(what, &r);
if ((l < 0) || (l > r.rlim_max))
r.rlim_cur = r.rlim_max;
else
r.rlim_cur = l;
if (setrlimit(what, &r) == -1)
bb_perror_msg_and_die("setrlimit");
}
int chpst_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
int chpst_main(int argc UNUSED_PARAM, char **argv)
{
struct bb_uidgid_t ugid;
2008-08-05 23:13:29 +05:30
char *set_user = set_user; /* for compiler */
char *env_dir = env_dir;
char *root;
char *nicestr;
unsigned limita;
unsigned limitc;
unsigned limitd;
unsigned limitf;
unsigned limitl;
unsigned limitm;
unsigned limito;
unsigned limitp;
unsigned limitr;
unsigned limits;
unsigned limitt;
unsigned opt;
if ((ENABLE_CHPST && applet_name[0] == 'c')
|| (ENABLE_SOFTLIMIT && applet_name[1] == 'o')
) {
// FIXME: can we live with int-sized limits?
// can we live with 40000 days?
// if yes -> getopt converts strings to numbers for us
getopt32: remove opt_complementary function old new delta vgetopt32 1318 1392 +74 runsvdir_main 703 713 +10 bb_make_directory 423 425 +2 collect_cpu 546 545 -1 opt_chars 3 - -3 opt_complementary 4 - -4 tftpd_main 567 562 -5 ntp_init 476 471 -5 zcip_main 1266 1256 -10 xxd_main 428 418 -10 whois_main 140 130 -10 who_main 463 453 -10 which_main 212 202 -10 wget_main 2535 2525 -10 watchdog_main 291 281 -10 watch_main 222 212 -10 vlock_main 399 389 -10 uuencode_main 332 322 -10 uudecode_main 316 306 -10 unlink_main 45 35 -10 udhcpd_main 1482 1472 -10 udhcpc_main 2762 2752 -10 tune2fs_main 290 280 -10 tunctl_main 366 356 -10 truncate_main 218 208 -10 tr_main 518 508 -10 time_main 1134 1124 -10 tftp_main 286 276 -10 telnetd_main 1873 1863 -10 tcpudpsvd_main 1785 1775 -10 taskset_main 521 511 -10 tar_main 1009 999 -10 tail_main 1644 1634 -10 syslogd_main 1967 1957 -10 switch_root_main 368 358 -10 svlogd_main 1454 1444 -10 sv 1296 1286 -10 stat_main 104 94 -10 start_stop_daemon_main 1028 1018 -10 split_main 542 532 -10 sort_main 796 786 -10 slattach_main 624 614 -10 shuf_main 504 494 -10 setsid_main 96 86 -10 setserial_main 1132 1122 -10 setfont_main 388 378 -10 setconsole_main 78 68 -10 sendmail_main 1209 1199 -10 sed_main 677 667 -10 script_main 1077 1067 -10 run_parts_main 325 315 -10 rtcwake_main 454 444 -10 rm_main 175 165 -10 reformime_main 119 109 -10 readlink_main 123 113 -10 rdate_main 246 236 -10 pwdx_main 189 179 -10 pstree_main 317 307 -10 pscan_main 663 653 -10 popmaildir_main 818 808 -10 pmap_main 80 70 -10 nc_main 1042 1032 -10 mv_main 558 548 -10 mountpoint_main 477 467 -10 mount_main 1264 1254 -10 modprobe_main 768 758 -10 modinfo_main 333 323 -10 mktemp_main 200 190 -10 mkswap_main 324 314 -10 mkfs_vfat_main 1489 1479 -10 microcom_main 715 705 -10 md5_sha1_sum_main 521 511 -10 man_main 867 857 -10 makedevs_main 1052 1042 -10 ls_main 563 553 -10 losetup_main 432 422 -10 loadfont_main 89 79 -10 ln_main 524 514 -10 link_main 75 65 -10 ipcalc_main 544 534 -10 iostat_main 2397 2387 -10 install_main 768 758 -10 id_main 480 470 -10 i2cset_main 1239 1229 -10 i2cget_main 380 370 -10 i2cdump_main 1482 1472 -10 i2cdetect_main 682 672 -10 hwclock_main 406 396 -10 httpd_main 741 731 -10 grep_main 837 827 -10 getty_main 1559 1549 -10 fuser_main 297 287 -10 ftpgetput_main 345 335 -10 ftpd_main 2232 2222 -10 fstrim_main 251 241 -10 fsfreeze_main 77 67 -10 fsck_minix_main 2921 2911 -10 flock_main 314 304 -10 flashcp_main 740 730 -10 flash_eraseall_main 833 823 -10 fdformat_main 532 522 -10 expand_main 680 670 -10 eject_main 335 325 -10 dumpleases_main 630 620 -10 du_main 314 304 -10 dos2unix_main 441 431 -10 diff_main 1350 1340 -10 df_main 1064 1054 -10 date_main 1095 1085 -10 cut_main 961 951 -10 cryptpw_main 228 218 -10 crontab_main 575 565 -10 crond_main 1149 1139 -10 cp_main 370 360 -10 common_traceroute_main 3834 3824 -10 common_ping_main 1767 1757 -10 comm_main 239 229 -10 cmp_main 655 645 -10 chrt_main 379 369 -10 chpst_main 704 694 -10 chpasswd_main 308 298 -10 chown_main 171 161 -10 chmod_main 158 148 -10 cat_main 428 418 -10 bzip2_main 120 110 -10 blkdiscard_main 264 254 -10 base64_main 221 211 -10 arping_main 1665 1655 -10 ar_main 556 546 -10 adjtimex_main 406 396 -10 adduser_main 882 872 -10 addgroup_main 411 401 -10 acpid_main 1198 1188 -10 optstring 11 - -11 opt_string 18 - -18 OPT_STR 25 - -25 ubi_tools_main 1288 1258 -30 ls_options 31 - -31 ------------------------------------------------------------------------------ (add/remove: 0/6 grow/shrink: 3/129 up/down: 86/-1383) Total: -1297 bytes text data bss dec hex filename 915428 485 6876 922789 e14a5 busybox_old 914629 485 6872 921986 e1182 busybox_unstripped Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>
2017-08-09 01:25:02 +05:30
opt = getopt32(argv, "^+"
"a:+c:+d:+f:+l:+m:+o:+p:+r:+s:+t:+u:U:e:"
IF_CHPST("/:n:vP012")
"\0" "-1",
&limita, &limitc, &limitd, &limitf, &limitl,
&limitm, &limito, &limitp, &limitr, &limits, &limitt,
&set_user, &set_user, &env_dir
IF_CHPST(, &root, &nicestr));
argv += optind;
if (opt & OPT_m) { // -m means -asld
limita = limits = limitl = limitd = limitm;
opt |= (OPT_s | OPT_l | OPT_a | OPT_d);
}
} else {
option_mask32 = opt = 0;
argv++;
if (!*argv)
bb_show_usage();
}
// envdir?
if (ENABLE_ENVDIR && applet_name[3] == 'd') {
env_dir = *argv++;
opt |= OPT_e;
}
// setuidgid?
if (ENABLE_SETUIDGID && applet_name[1] == 'e') {
set_user = *argv++;
opt |= OPT_u;
}
// envuidgid?
if (ENABLE_ENVUIDGID && applet_name[0] == 'e' && applet_name[3] == 'u') {
set_user = *argv++;
opt |= OPT_U;
}
// we must have PROG [ARGS]
if (!*argv)
bb_show_usage();
// set limits
if (opt & OPT_d) {
#ifdef RLIMIT_DATA
limit(RLIMIT_DATA, limitd);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"DATA");
#endif
}
if (opt & OPT_s) {
#ifdef RLIMIT_STACK
limit(RLIMIT_STACK, limits);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"STACK");
#endif
}
if (opt & OPT_l) {
#ifdef RLIMIT_MEMLOCK
limit(RLIMIT_MEMLOCK, limitl);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"MEMLOCK");
#endif
}
if (opt & OPT_a) {
#ifdef RLIMIT_VMEM
limit(RLIMIT_VMEM, limita);
#else
#ifdef RLIMIT_AS
limit(RLIMIT_AS, limita);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"VMEM");
#endif
#endif
}
if (opt & OPT_o) {
#ifdef RLIMIT_NOFILE
limit(RLIMIT_NOFILE, limito);
#else
#ifdef RLIMIT_OFILE
limit(RLIMIT_OFILE, limito);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"NOFILE");
#endif
#endif
}
if (opt & OPT_p) {
#ifdef RLIMIT_NPROC
limit(RLIMIT_NPROC, limitp);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"NPROC");
#endif
}
if (opt & OPT_f) {
#ifdef RLIMIT_FSIZE
limit(RLIMIT_FSIZE, limitf);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"FSIZE");
#endif
}
if (opt & OPT_c) {
#ifdef RLIMIT_CORE
limit(RLIMIT_CORE, limitc);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"CORE");
#endif
}
if (opt & OPT_r) {
#ifdef RLIMIT_RSS
limit(RLIMIT_RSS, limitr);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"RSS");
#endif
}
if (opt & OPT_t) {
#ifdef RLIMIT_CPU
limit(RLIMIT_CPU, limitt);
#else
if (opt & OPT_v)
bb_error_msg("system does not support RLIMIT_%s",
"CPU");
#endif
}
if (opt & OPT_P)
setsid();
if (opt & OPT_e)
edir(env_dir);
if (opt & (OPT_u|OPT_U))
xget_uidgid(&ugid, set_user);
// chrooted jail must have /etc/passwd if we move this after chroot.
// OTOH chroot fails for non-roots.
// Solution: cache uid/gid before chroot, apply uid/gid after.
if (opt & OPT_U) {
xsetenv("GID", utoa(ugid.gid));
xsetenv("UID", utoa(ugid.uid));
}
if (opt & OPT_root) {
xchroot(root);
}
/* nice should be done before xsetuid */
if (opt & OPT_n) {
errno = 0;
if (nice(xatoi(nicestr)) == -1)
bb_perror_msg_and_die("nice");
}
if (opt & OPT_u) {
if (setgroups(1, &ugid.gid) == -1)
bb_perror_msg_and_die("setgroups");
xsetgid(ugid.gid);
xsetuid(ugid.uid);
}
if (opt & OPT_0)
close(STDIN_FILENO);
if (opt & OPT_1)
close(STDOUT_FILENO);
if (opt & OPT_2)
close(STDERR_FILENO);
BB_EXECVP_or_die(argv);
}