730e5ef310
setpgid() can return EPERM if we are already a process group leader.
2014-04-15 15:02:20 -04:00
e5834da6d3
Permit sendmsg in the seccomp syscall whitelist for all daemons.
2014-04-15 14:57:07 -04:00
b5f0ccd88d
In cfg.rl, when performing clear action, don't clear the cs member in ccfg.
2014-04-15 14:56:35 -04:00
a777766cc6
Fix stupid typo in ndhc.c that would cause the clientid option to
...
corrupt the start of the hostname option if both were specified.
2014-04-15 14:55:50 -04:00
8a9fbb6f09
Documentation updates.
2014-04-14 18:32:08 -04:00
74ad01a086
Update the manual page.
2014-04-14 15:52:39 -04:00
a501789e04
Parse config options with ragel and support a configuration file.
2014-04-14 15:06:31 -04:00
51033d3664
Detect the glibc version in CMake and link librt if it is required.
...
For the Makefile, unconditionally link librt with no detection.
2014-04-07 19:14:31 -04:00
d267c2c44b
Use the raw capability interface via updated ncmlib rather than linking
...
to libcap.
2014-04-07 15:05:34 -04:00
bb1ff7a506
arp.c: Make logging messages print the associated interface name.
2014-04-07 04:43:21 -04:00
74678ef510
Use safe_recvmsg().
2014-04-07 04:22:32 -04:00
6804be2277
Use safe_sendto where necessary, and check for short writes.
...
Also, change many log_lines to log_errors, mostly in ifset.c.
2014-04-07 04:15:02 -04:00
650da6a7fd
Add recvfrom to the seccomp syscall whitelist.
2014-04-07 03:54:30 -04:00
cab9162d8d
Remove socketpair from the seccomp syscall filter whitelist.
...
socketpair() is called only before privileges are dropped, so it does
not need to be in the whitelist.
2014-04-07 03:44:53 -04:00
5fa2030bab
Use a socketpair rather than a pair of pipes for communication between
...
ndhc and ifch, similar to sockd. A single pipe is also maintained so
that SIGPIPE can bound the lifetime of an orphaned ifch process.
2014-04-07 03:44:02 -04:00
e2ee728982
Consolidate all of the global static variables in arp.c into a single
...
struct, and use booleans where appropriate.
2014-04-06 22:12:31 -04:00
a86363f248
Create a new process ID group for ndhc.
2014-04-06 22:07:12 -04:00
b761889025
Move source from ndhc/ to src/ since ifchd is no longer a separate program.
2014-04-06 16:57:06 -04:00
b511d45c2f
Change most error comparisons from == -1 to < 0. Some were not changed,
...
as the different negative values equate to different errors.
Tests against syscall returns and fds are very common and mostly fit
the pattern of this change.
The gain is increased range-exclusion.
2014-04-06 06:33:14 -04:00
c03be059f5
writeordie() was buggy; delete the == 1 which makes no sense.
2014-04-06 06:31:40 -04:00
3d76fbeedc
Make sure that all safe_* return values use ssize_t.
2014-04-06 06:24:13 -04:00
745e9e8923
If we encounter read errors reading the duid or iaid after successfully
...
opening the file, print an error and exit.
2014-04-06 06:06:53 -04:00
7b0db5b8d3
arp.c: If the safe_read that fetches arp responses encounters a
...
return of -1 with errno == EAGAIN or EWOULDBLOCK, then report the
error, as it should never happen given that the function is called
only once after polling for ready-reads.
Further, the old code was buggy; it would subtract from the arpreply_offset
the return value of -1 in that case, which is just wrong.
2014-04-06 06:02:03 -04:00
8b4c7f05b2
arp.c: Check for < 0 for invalid fds and function errors instead of == -1.
2014-04-06 05:54:21 -04:00
8af6bee46d
arp_switch_state() was far too confusing and buggy. Pass the target state as
...
an argument, and only switch the global state after a change is successfully
made.
2014-04-06 05:51:52 -04:00
1e52914f2e
Remove a lot of permitted syscalls from the seccomp filter list.
...
Probably the most notable is that setsockopt is only allowed from sockd.
This change prevents ndhc and ifch from removing BPF filters that have been
installed onto a socket.
2014-04-06 05:21:56 -04:00
812912126e
ifch doesn't need to save a pidfile because its lifetime is strictly bounded
...
by that of ndhc by the shared pipe, so remove that option.
2014-04-06 02:27:52 -04:00
6b1d422d6f
arp_min_close_fd() and arp_close_fd() can return void.
2014-04-05 23:40:18 -04:00
1c30247c36
arp_reopen_fd() can be return void.
2014-04-05 23:37:44 -04:00
6750209e12
Have sockd apply BPF filters to ARP sockets.
2014-04-05 21:39:27 -04:00
5212e0dfc5
Switch to using a socket for ndhc/sockd IPC so that fd passing works.
2014-04-05 05:25:56 -04:00
9622640698
Add command line help for the sockd-user option.
2014-04-05 05:23:37 -04:00
ef51971a6d
Update to latest ncmlib privilege.[ch].
2014-04-05 05:23:18 -04:00
09d6f7dfb8
Introduce a ndhc-sockd daemon that separates out the remaining elevated
...
capabilities from the ndhc master process.
Privsep is now complete. The only notable improvement from before is that
exploitation of ndhc would only allow an attacker to open raw sockets,
bind sockets to ports < port 1024, and create broadcast sockets on the
interface that ndhc is performing dhcp on rather than on all interfaces.
However, this seems like a worthwhile change; note that it was already
impossible for an attacker to sniff packets on any interfaces (as that
requires CAP_NET_ADMIN, which was always separated to ifch).
2014-04-04 04:12:25 -04:00
65c3cd4fd9
Make many more logging prints specify the interface and function, and make
...
the return checks for safe_(read|write) stricter.
2014-04-04 04:01:49 -04:00
2200b68aff
Print a warning if the BPF is not installed for an ARP socket.
2014-04-04 03:55:32 -04:00
dc2ac46fd4
Update to latest ncmlib and remove some dead preprocessor defines.
2014-03-31 16:06:41 -04:00
2f54ff75f3
Use nk_uidgidbyname().
2014-03-30 22:18:04 -04:00
2d8654ae59
Update copyright dates.
2014-03-30 17:23:35 -04:00
1abf8462d3
Convert logging messages to suicide() where appropriate and clean up the
...
logging messages a bit.
2014-03-30 17:21:27 -04:00
82d9682ed8
Update to latest ncmlib changes.
2014-03-30 17:02:48 -04:00
abda60e0e9
Remove unused defines.
2014-03-28 11:17:52 -04:00
1b6b52d2eb
Don't background the daemon by default. Process supervision is finally
...
catching on and becoming the norm.
2014-03-28 00:12:33 -04:00
704e414171
Add nl_sendgetaddr and nl_sendgetaddrs variants for v4/v6.
2014-03-28 00:09:53 -04:00
77ce7b9a6c
printf 'hh' length modifier is a gnu extension. Don't use it.
2014-03-25 05:27:47 -04:00
00e7e2a61b
Remove an implicit narrowing cast from void* in nl.h.
...
This cast is fine in C, but if the header is included from C++, even from
an extern "C" block, it will cause an error.
2014-03-24 09:55:55 -04:00
4b92b10f32
ifch doesn't need chmod or unlink whitelisted for seccomp-filter.
2014-03-22 23:39:50 -04:00
71db577ed5
Replace the remaining calls to rand() with nk_random_u32().
2014-03-22 02:08:23 -04:00
009f80b428
x86 has a slightly different syscall interface, so some changes are
...
necessary for the seccomp filters to work.
Specifically, x86 has the old catch-all socketcall and the non-legacy
fnctl64 system calls.
2014-03-22 01:32:55 -04:00
22dcfc00ee
Enable seccomp-filter if CMake detects that host is x86_64 or x86.
2014-03-21 23:52:15 -04:00
