summaryrefslogtreecommitdiffstats
path: root/src/privsep.c
Commit message (Collapse)AuthorAge
* Rename Privileged Actioneer to Privileged ProxyRoy Marples2021-02-02
| | | | Sadly actioneer is not a real word.
* Rename Master to ManagerRoy Marples2021-02-02
|
* eloop: Make the API more like native poll/kqueue/epollRoy Marples2021-02-02
| | | | | | | | | Just have the one callback, but return an abstracted event mask to work out if we can read/write have something else. Log diagnostics if the event mask is unexpected. While here add more logging if we fail to register an event to monitor.
* A belated welcome to 2021Roy Marples2021-01-31
|
* Linux: Implement epoll(7) for eloop (again)Roy Marples2021-01-28
| | | | | eloop allows for O(1) processing of active fd's. The problems with the prior implementation have now been fixed.
* privsep: Restore the poll maxfd + 1 for state engineRoy Marples2021-01-28
| | | | It wasn't fixed, it was using kqueue so avoided!
* privsep: Don't add 1 to max fd open when limiting resourcesRoy Marples2021-01-28
| | | | It shoud no longer be needed for OpenBSD, Linux and Solaris.
* BSD: Implement kqueue(2) for eloop (again)Roy Marples2021-01-28
| | | | | | | | kqueue allows for O(1) processing of active fd's an a more robust signal handling method without the need to use global variables to avoid calling functions during signal delivery. The problems with the prior implemenation have now been fixed.
* privsep: move setting signals to after clearing eloopRoy Marples2021-01-27
|
* privsep: log sandbox when not daemonisingRoy Marples2020-12-26
|
* dhcpcd: Don't create launcher process if keeping in foregroundRoy Marples2020-11-11
| | | | There is little point.
* Add --noconfigure optionRoy Marples2020-11-04
| | | | | With this set dhcpcd will not configure anything on the host. The expectation is that a 3rd party script will instead.
* privsep: Send all log messages to the privileged actioneerRoy Marples2020-10-30
| | | | | | | | | | | | | | | | | | | | | | | If dhcpcd starts and no syslogd implementation is running then various syscall filters could be triggered when dhcpcd wants to syslog and it's already in a chroot. Not all libc openlog implementations support LOG_NDELAY and openlog does not return an error code and can also mask errno back to 0. So we have no way of knowing if we have a syslog connection or not. This means we cannot cache the connection at startup because syslog itself will try and open if no connection. As such, all logging is now directed to the dhcpcd privileged actioneer process which will handle all the syslog and log file writing actions. The only downside of this approach (other than an extra fd per process) is that we no longer know which PID raised the message. While we could put the correct PID in the logfile as we control the API, we cannot put it into syslog as we cannot control that API. As all privsep errors should log which function they came from this will hopefully not be an issue as on the happy path only the master process will log stuff.
* privsep: Minor correction to prior logicRoy Marples2020-10-11
|
* privsep: We need to ensure stderr is valid before testing if ttyRoy Marples2020-10-10
|
* privsep: Fix stderr redirection againRoy Marples2020-10-10
|
* privsep: Only start network proxy if we need toRoy Marples2020-10-07
| | | | Do this before starting it rather than it shutting down.
* privsep: Only log chrooting from the launcher processRoy Marples2020-10-07
| | | | | | And the sandbox tech as well. Rework stop_interface so we can reuse an option for marking a process as the launcher.
* Don't log backticks.Roy Marples2020-10-03
|
* privsep: We need getsockopt as well as setsockopt on the link socketRoy Marples2020-10-03
| | | | | So we can report receive buffer size. Important for route(4) overflow so we can try and set a bigger buffer.
* privsep: allow CAP_SETSOCKOPT for route(4) fd.Roy Marples2020-10-02
| | | | | If FreeBSD ever implements RO_MISSFILTER it will need special rights to work over Capsium.
* privsep: Don't log sandbox type twiceRoy Marples2020-09-21
|
* privsep: sandbox the launcher processRoy Marples2020-09-20
|
* privsep: Don't be noisy about the sandboxRoy Marples2020-09-20
|
* privsep: Log if the platform sandbox is unavailable or availableRoy Marples2020-09-20
| | | | This is kinda important.
* privsep: Add the SECCOMP BPF sandbox for LinuxRoy Marples2020-09-19
| | | | | Now we have capsicum, pledge and the POSIX resource limited sandboxes this was quite easy really.
* privsep: Fold capsicum and pledge entry points into ps_entersandboxRoy Marples2020-09-19
|
* dhcpcd: Only manipulate stdin, stdout and stderr when validRoy Marples2020-09-12
| | | | | | | | | UNIX application expect these to exist even if pointed at /dev/null. We cannot change which fd they use, it's always 0, 1 and 2. But if these fd's are not open when dhcpcd is called, they could be assigned to dhcpcd internals. In this instance we should not use the streams in anyway or form.
* privsep: dump leases in a sandboxRoy Marples2020-09-06
|
* privsep: Dump leases from stdin in a limited sandboxRoy Marples2020-09-06
|
* privsep: dropprivs can be staticRoy Marples2020-09-06
|
* privsep: limit rights for stdout/stderr/stdin using capsicumRoy Marples2020-09-06
|
* dhcpcd: Redirect stdout/stderr to the launcher stderr descriptorRoy Marples2020-09-06
| | | | | | | | | | | | | | | This actually make life really simple! We no longer need to redirect stdout/stderr to /dev/null for privsep and any script output is now captured again - and it all goes to stderr as it should even if a script wants it to go to stdout. On the happy path, only the master process will actually log anything to stderr so we turn that off after we "fork". On the unhappy path, logging to stderr/stdout *may* fail because the launcher process *may* have exited. We *could* have the master process as an intermediary but that's just excess code to avoid errors which *should* not happen. Regardless, any errror should still hit syslog.
* privsep: Fix prior for FreeBSD.Roy Marples2020-09-05
|
* privsep: Use xsocketpairRoy Marples2020-09-05
|
* privsep: Only the master process accepts signalsRoy Marples2020-08-20
| | | | | The master process dictates when processes should stop, which allows for a clean shutdown when the admin issues `pkill dhcpcd`.
* privsep: Improve some errorsRoy Marples2020-08-08
|
* privsep: Don't limit file writes if logging to a fileRoy Marples2020-07-01
| | | | | | | stderr could be redirected. While here, there is no longer a need to redirect stderr or stdout as they already have been in dhcpcd.
* privsep: check return of freopen(3)Roy Marples2020-06-29
| | | | So shutup some compilers who complain we don't do anything with it.
* privsep: don't abort if setrlimit failsRoy Marples2020-06-15
| | | | | | Just log the error. This allows valgrind to be used still as it uses big fd numbers in the client.
* privsep: Fix a shutdown raceRoy Marples2020-06-10
| | | | | | | Only test a successful stop IPC command. By the time we shutdown the socket to be extra nice, the process we sent stop to could have already exited, therefore we can discard any error.
* privsep: RLIMIT_FSIZE works fine on pledge and capsicumRoy Marples2020-06-10
| | | | | If you don't use the dhcpcd logfile option. Duh.
* privsep: Disable RLIMIT_FSIZE when using the logfile optionRoy Marples2020-06-10
| | | | | | We cannot offload it to the root process either because not all sandboxes have access to that..... Really need to fix syslog so that it starts before dhcpcd.
* privsep: Apply resource limits to OpenBSD as well where we canRoy Marples2020-06-10
| | | | After all, pledge or capsicum could have bugs.
* privsep: Apply what resource limits we can to capsicumRoy Marples2020-06-10
|
* privsep: control proxy is no longer optionalRoy Marples2020-06-10
| | | | | | It's required for pledge. It *could* be optional for capsicum but I'd like to try and keep the sandboxing the same for now.
* privsep: For Linux and Solaris, set RLIMIT_NOFILES to neventsRoy Marples2020-06-09
| | | | | | | Because poll(2) returns EINVAL if nfds is higher. This really blows chunks, but it is what it is. An attacker could close a fd and open something else, but it's the best we can do.
* privsep: Implement a resource limited sandboxRoy Marples2020-06-09
| | | | | | | | | | | | | For systems without Capsicum or Pledge we can create a resource limited sandbox provided that either ppoll(2) or works with RLIMIT_NOFILES set to zero. As far as dhcpcd is concerned, that means Linux and Solaris won't work with this, but NetBSD and DragonFlyBSD will. To achieve this, a special control proxy process will be spawned just to accept new connections over the control socket because this *cannot* be limited by RLIMIT_NOFILES.
* privsep: Limit rights generically rather than Capsicum specifcRoy Marples2020-06-05
| | | | | | | | | You never know when another sandbox tech comes around. While here, add limits for every socket in the unpriviledged processes. Some were absent before. Also, note that RLIMIT_NOFILE breaks our control socket so temporary disable that.
* Linux: make resource limits work by using getifaddrs over privsepRoy Marples2020-06-05
|
generated by cgit v1.2.3 (git 2.25.1) at 2021-03-13 23:11:07 +0000