summaryrefslogtreecommitdiffstats
path: root/src/privsep-root.c
Commit message (Collapse)AuthorAge
* Rename Privileged Actioneer to Privileged ProxyRoy Marples2021-02-02
| | | | Sadly actioneer is not a real word.
* Rename Master to ManagerRoy Marples2021-02-02
|
* Fix prior for epoll.Roy Marples2021-02-02
|
* eloop: Make the API more like native poll/kqueue/epollRoy Marples2021-02-02
| | | | | | | | | Just have the one callback, but return an abstracted event mask to work out if we can read/write have something else. Log diagnostics if the event mask is unexpected. While here add more logging if we fail to register an event to monitor.
* A belated welcome to 2021Roy Marples2021-01-31
|
* OpenBSD: Fix kqueue detection and one error.Roy Marples2021-01-28
|
* BSD: Implement kqueue(2) for eloop (again)Roy Marples2021-01-28
| | | | | | | | kqueue allows for O(1) processing of active fd's an a more robust signal handling method without the need to use global variables to avoid calling functions during signal delivery. The problems with the prior implemenation have now been fixed.
* log: Allow logopen to be called without logcloseRoy Marples2020-10-30
| | | | | | | | | logclose is meant to free resources. On Linux this means that _log_prog is also free'd and once in the chroot we cannot work it out again. As such allow logopen to close what it needs to so that reopening works.
* privsep: Allow logfile reopening in a chrootRoy Marples2020-10-30
| | | | | | Now that only the privileged actioneer does the actual logging we can safely reopen the file we are logging to. This also closes and re-opens the syslog connection.
* privsep: Send all log messages to the privileged actioneerRoy Marples2020-10-30
| | | | | | | | | | | | | | | | | | | | | | | If dhcpcd starts and no syslogd implementation is running then various syscall filters could be triggered when dhcpcd wants to syslog and it's already in a chroot. Not all libc openlog implementations support LOG_NDELAY and openlog does not return an error code and can also mask errno back to 0. So we have no way of knowing if we have a syslog connection or not. This means we cannot cache the connection at startup because syslog itself will try and open if no connection. As such, all logging is now directed to the dhcpcd privileged actioneer process which will handle all the syslog and log file writing actions. The only downside of this approach (other than an extra fd per process) is that we no longer know which PID raised the message. While we could put the correct PID in the logfile as we control the API, we cannot put it into syslog as we cannot control that API. As all privsep errors should log which function they came from this will hopefully not be an issue as on the happy path only the master process will log stuff.
* privsep: We now need to carry ifa_data for BSDRoy Marples2020-09-30
|
* Linux: detect network namespace and deny udev in oneRoy Marples2020-09-19
| | | | | | | | | | udev says whether an interface name is stable or not. In a network namespace, udev claims the interface does not exist. This makes sense because udev only operates in the root namespace. As such disable udev in a network namespace. While here correctly spell initialise.
* privsep: Only the master process accepts signalsRoy Marples2020-08-20
| | | | | The master process dictates when processes should stop, which allows for a clean shutdown when the admin issues `pkill dhcpcd`.
* Use a minimum bufsize of 1 as 0 doesn't work on some OS.Roy Marples2020-08-16
|
* privsep: Set a zero length receive buffer for write only socketsRoy Marples2020-08-16
| | | | | | | | | | We cannot use shutdown(2) because they are not connected. Constantly draining would be a waste of CPU time, so just let the buffer overflow. To ease the kernel as much as we can, set a zero length buffer. The kernel may still allocate a small buffer, but this is kernel dependant and we're just trying to be helpful.
* Revert "privsep: shutdown read end of the write only sockets"Roy Marples2020-08-03
| | | | | | Fails noisly on Linux. This reverts commit 5fc20ae1aa368e36f9cabcbc047cd7d8e468c5b7.
* privsep: shutdown read end of the write only socketsRoy Marples2020-07-18
| | | | | Clearly shows our intent and hopefully is an optimisation within the kernel.
* privsep: Simplyfy signal handlingRoy Marples2020-06-16
| | | | | All privsep processes only need to act on SIGTERM. The privileged actioneer also needs to act on SIGCHLD.
* privsep: Use root signal_cb for all signals here.Roy Marples2020-06-16
|
* privsep: Don't handle any signals meant for the main processRoy Marples2020-06-16
| | | | Just incase someone issues a killall -HUP dhcpcd
* privsep: Fix a shutdown raceRoy Marples2020-06-10
| | | | | | | Only test a successful stop IPC command. By the time we shutdown the socket to be extra nice, the process we sent stop to could have already exited, therefore we can discard any error.
* privsep: fix size of rdmRoy Marples2020-06-10
|
* Try and guard against impossibly large data.Roy Marples2020-06-10
|
* privsep: Fix bogus warnings without inet.Roy Marples2020-06-09
|
* privsep: limit psr_datalen to SSIZE_MAXRoy Marples2020-06-09
|
* privsep: Limit rights generically rather than Capsicum specifcRoy Marples2020-06-05
| | | | | | | | | You never know when another sandbox tech comes around. While here, add limits for every socket in the unpriviledged processes. Some were absent before. Also, note that RLIMIT_NOFILE breaks our control socket so temporary disable that.
* Linux: make resource limits work by using getifaddrs over privsepRoy Marples2020-06-05
|
* Fix installing the embedded config as a file.Roy Marples2020-06-04
|
* privsep: Log ECONNRESET errors againRoy Marples2020-06-04
| | | | Now that we've improved the robustness of the IPC this is important.
* privsep: Don't wait for the process to finish when stopping itRoy Marples2020-06-04
| | | | Instead, wait on receipt of SIGCHLD so we're not blocked.
* privsep: Fix returning indirect ioctl dataRoy Marples2020-06-04
|
* eloop: Just use ppoll(2)Roy Marples2020-06-03
| | | | | | | | | | | | | | epoll and kqueue are really too heavy weight. With privsep, we now favour more processes for BPF and per address sockets. As such, the number of fds to monitor will always be quite small. All modern OS now have ppoll(2) (NetBSD has pollts, which is the same) which works perfectly for us. If neither are present, the a wrapper around pselect(2) is provided, which can be found on all POSIX systems. This makes the code a lot smaller and easier to follow. The reduced binary size and memory usage is a nice win here.
* privsep: Access the RDM monotic file via IPCRoy Marples2020-06-02
| | | | | As we can't get at it in the chroot. While here, harden the file.
* privsep: harden process handlingRoy Marples2020-06-02
| | | | | | | If eloop is exited, only allow explicit re-entry. Only exit on read/write error if a forked process and not root. If the root process fails to read/write to a sub-process, stop the sub-process.
* privsep: Only open raw sockets for the needed protocols.Roy Marples2020-06-01
| | | | | Just warn about any errors rather than forcing an early exit as well. While here, fix startup if DHCPv6 disabled globally but enabled per if.
* privsep: Don't carry ifa_nextRoy Marples2020-06-01
| | | | While harmless, it's also meaningless.
* Fix compile with inet or inet6 disabledRoy Marples2020-05-30
|
* privsep: Avoid the /proc/../ escapeRoy Marples2020-05-24
|
* Fix prior for BSDRoy Marples2020-05-24
|
* privsep: Fix compile for prior without dev pluginsRoy Marples2020-05-24
|
* privsep: Allow dev plugins to workRoy Marples2020-05-24
| | | | | For udev at least, it requires a /var/run to be available in the chroot which is poor. As such, give it a full IPC.
* privsep: Allow Linux to work without needing any mountsRoy Marples2020-05-24
|
* dhcpcd: Move the script file from per interface to global contextRoy Marples2020-05-21
| | | | | | | | | This *should* affect no-one, but you never know. The primary motivation for this is to ensure that nothing arbitary can be executed by the root process if anyone breaks into the chrooted unprivileged master process. It also makes for smaller code.
* privsep: Validate UDP portsRoy Marples2020-05-21
| | | | Just like we filter the ioctls.
* privsep: Only allow file IO to specific pathsRoy Marples2020-05-21
| | | | In the same vein as filtering ioctls.
* privsep: Filter ioctls to a known list.Roy Marples2020-05-20
| | | | In-case the master process is broken into.
* privsep: Ensure we don't scribble garbage to BPFRoy Marples2020-05-20
| | | | | | Well, it's not garbage, it's a privsep IPC message telling us to start BPF which the BPF process should not have recieved! Add code to ensure this cannot happen.
* privsep: Enable Capsicum for all processes.Roy Marples2020-05-19
| | | | | | | | | | | | | | | | | Except for the priviledged process. This is quite an in-depth change: * ARP is now one process per address * BPF flags are now returned via privsep * BPF write filters are locked when supported * The root process sends to the network The last step is done by opening RAW sockets and then sending a UDP header (where applicable) to avoid binding to an address which is already in use by the reader sockets. This is slightly wasteful for OS's without sandboxing but does have the very nice side effect of not needing a source address to unicast DHCPs replies from which makes the code smaller.
* privsep: sockaddr len should be socklen_tRoy Marples2020-05-14
| | | | | | | | | | While ps_root_getifaddrs is only for capsicum, it's highly portable and thus in the privsep-root rather than privsep-bsd. As such, store the sockaddr len as socklen_t because that's what POSIX demands. It's only a few more bytes and I'd rather make this change now than it potentially bite me later.
* Remove debug.Roy Marples2020-05-13
|
generated by cgit v1.2.3 (git 2.25.1) at 2021-03-13 23:33:00 +0000