* drop priviliges

[catta] / avahi-daemon / main.c

diff --git a/avahi-daemon/main.c b/avahi-daemon/main.c
index 0d862eab8ef9233d6d74117b2a1ec1e9646a79d3..7fce3a546d8b0b7086d93e9341e01a664cbf0919 100644 (file)
--- a/avahi-daemon/main.c
+++ b/avahi-daemon/main.c
@@ -28,6 +28,9 @@
 #include <signal.h>
 #include <errno.h>
 #include <string.h>
+#include <unistd.h>
+#include <grp.h>
+#include <pwd.h>
 
 #include <libdaemon/dfork.h>
 #include <libdaemon/dsignal.h>
@@ -48,7 +51,8 @@ typedef enum {
     DAEMON_RUN,
     DAEMON_KILL,
     DAEMON_VERSION,
-    DAEMON_HELP
+    DAEMON_HELP,
+    DAEMON_RELOAD
 } DaemonCommand;
 
 typedef struct {
@@ -57,6 +61,7 @@ typedef struct {
     gboolean daemonize;
     gchar *config_file;
     gboolean enable_dbus;
+    gboolean drop_root;
 } DaemonConfig;
 
 static void server_callback(AvahiServer *s, AvahiServerState state, gpointer userdata) {
@@ -83,8 +88,10 @@ static void help(FILE *f, const gchar *argv0) {
             "    -h --help        Show this help\n"
             "    -D --daemonize   Daemonize after startup\n"
             "    -k --kill        Kill a running daemon\n"
+            "    -r --reload      Request a running daemon to reload static services\n"
             "    -V --version     Show version\n"
-            "    -f --file=FILE   Load the specified configuration file instead of the default\n",
+            "    -f --file=FILE   Load the specified configuration file instead of\n"
+            "                     "AVAHI_CONFIG_FILE"\n",
             argv0);
 }
 
@@ -97,12 +104,13 @@ static gint parse_command_line(DaemonConfig *config, int argc, char *argv[]) {
         { "kill",      no_argument,       NULL, 'k' },
         { "version",   no_argument,       NULL, 'V' },
         { "file",      required_argument, NULL, 'f' },
+        { "reload",    no_argument,       NULL, 'r' },
     };
 
     g_assert(config);
 
     opterr = 0;
-    while ((c = getopt_long(argc, argv, "hDkVf:", long_options, NULL)) >= 0) {
+    while ((c = getopt_long(argc, argv, "hDkVf:r", long_options, NULL)) >= 0) {
 
         switch(c) {
             case 'h':
@@ -121,6 +129,9 @@ static gint parse_command_line(DaemonConfig *config, int argc, char *argv[]) {
                 g_free(config->config_file);
                 config->config_file = g_strdup(optarg);
                 break;
+            case 'r':
+                config->command = DAEMON_RELOAD;
+                break;
             default:
                 fprintf(stderr, "Invalid command line argument: %c\n", c);
                 return -1;
@@ -186,6 +197,8 @@ static gint load_config_file(DaemonConfig *config) {
                     config->server_config.use_iff_running = is_yes(v);
                 else if (g_strcasecmp(*k, "enable-dbus") == 0)
                     config->enable_dbus = is_yes(v);
+                else if (g_strcasecmp(*k, "drop-root") == 0)
+                    config->drop_root = is_yes(v);
                 else {
                     fprintf(stderr, "Invalid configuration key \"%s\" in group \"%s\"\n", *k, *g);
                     goto finish;
@@ -314,6 +327,7 @@ static gboolean signal_callback(GIOChannel *source, GIOCondition condition, gpoi
         case SIGHUP:
             avahi_log_info("Got SIGHUP, reloading.");
             static_service_load();
+            static_service_add_to_server();
             break;
 
         default:
@@ -401,6 +415,65 @@ finish:
     return r;
 }
 
+static gint drop_root(void) {
+    struct passwd *pw;
+    struct group * gr;
+    gint r;
+    
+    if (!(pw = getpwnam(AVAHI_USER))) {
+        avahi_log_error( "Failed to find user '"AVAHI_USER"'.");
+        return -1;
+    }
+
+    if (!(gr = getgrnam(AVAHI_GROUP))) {
+        avahi_log_error( "Failed to find group '"AVAHI_GROUP"'.");
+        return -1;
+    }
+
+    avahi_log_info("Found user '"AVAHI_USER"' (UID %lu) and group '"AVAHI_GROUP"' (GID %lu).", (unsigned long) pw->pw_uid, (unsigned long) gr->gr_gid);
+
+    if (initgroups(AVAHI_USER, gr->gr_gid) != 0) {
+        avahi_log_error("Failed to change group list: %s", strerror(errno));
+        return -1;
+    }
+
+#if defined(HAVE_SETRESGID)
+    r = setresgid(gr->gr_gid, gr->gr_gid, gr->gr_gid);
+#elif defined(HAVE_SETREGID)
+    r = setregid(gr->gr_gid, gr->gr_gid);
+#else
+    if ((r = setgid(gr->gr_gid)) >= 0)
+        r = setegid(gr->gr_gid);
+#endif
+
+    if (r < 0) {
+        avahi_log_error("Failed to change GID: %s", strerror(errno));
+        return -1;
+    }
+
+#if defined(HAVE_SETRESUID)
+    r = setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid);
+#elif defined(HAVE_SETREUID)
+    r = setreuid(pw->pw_uid, pw->pw_uid);
+#else
+    if ((r = setuid(pw->pw_uid)) >= 0)
+        r = seteuid(pw->pw_uid);
+#endif
+
+    if (r < 0) {
+        avahi_log_error("Failed to change UID: %s", strerror(errno));
+        return -1;
+    }
+
+    g_setenv("USER", pw->pw_name, 1);
+    g_setenv("LOGNAME", pw->pw_name, 1);
+    g_setenv("HOME", pw->pw_dir, 1);
+    
+    avahi_log_info("Successfully dropped root privileges.");
+
+    return 0;
+}
+
 int main(int argc, char *argv[]) {
     gint r = 255;
     DaemonConfig config;
@@ -414,6 +487,7 @@ int main(int argc, char *argv[]) {
     config.daemonize = FALSE;
     config.config_file = NULL;
     config.enable_dbus = TRUE;
+    config.drop_root = TRUE;
 
     if ((argv0 = strrchr(argv[0], '/')))
         argv0++;
@@ -425,9 +499,6 @@ int main(int argc, char *argv[]) {
     if (parse_command_line(&config, argc, argv) < 0)
         goto finish;
 
-    if (load_config_file(&config) < 0)
-        goto finish;
-
     if (config.command == DAEMON_HELP) {
         help(stdout, argv0);
         r = 0;
@@ -442,14 +513,30 @@ int main(int argc, char *argv[]) {
 
         r = 0;
         
+    } else if (config.command == DAEMON_RELOAD) {
+        if (daemon_pid_file_kill(SIGHUP) < 0) {
+            avahi_log_warn("Failed to kill daemon: %s", strerror(errno));
+            goto finish;
+        }
+
+        r = 0;
+        
     } else if (config.command == DAEMON_RUN) {
         pid_t pid;
+
+        if (getuid() != 0) {
+            avahi_log_error("This program is intended to be run as root.");
+            goto finish;
+        }
         
         if ((pid = daemon_pid_file_is_running()) >= 0) {
             avahi_log_error("Daemon already running on PID %u", pid);
             goto finish;
         }
 
+        if (load_config_file(&config) < 0)
+            goto finish;
+        
         if (config.daemonize) {
 
             daemon_retval_init();
@@ -472,6 +559,8 @@ int main(int argc, char *argv[]) {
             /* Child */
         }
 
+        chdir("/");
+
         if (daemon_pid_file_create() < 0) {
             avahi_log_error("Failed to create PID file: %s", strerror(errno));
 
@@ -481,6 +570,11 @@ int main(int argc, char *argv[]) {
         } else
             wrote_pid_file = TRUE;
 
+        if (config.drop_root) {
+            if (drop_root() < 0)
+                goto finish;
+        }
+
         if (run_server(&config) == 0)
             r = 0;
     }