rootwrap.c 6.7 KB
Newer Older
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20
/*****************************************************************************
 * rootwrap.c
 *****************************************************************************
 * Copyright © 2005-2008 Rémi Denis-Courmont
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation; either version 2 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301, USA.
 *****************************************************************************/

21
#ifdef HAVE_CONFIG_H
22 23
# include <config.h>
#endif
24
#define _XPG4_2 /* ancilliary data on Solaris */
25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48

#include <stdlib.h> /* exit() */
#include <stdio.h>
#include <string.h>

#include <sys/types.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <sys/socket.h>
#include <sys/uio.h>
#include <sys/resource.h> /* getrlimit() */
#include <sched.h>
#include <errno.h>
#include <netinet/in.h>

#if defined (AF_INET6) && !defined (IPV6_V6ONLY)
# warning Uho, your IPv6 support is broken and has been disabled. Fix your C library.
# undef AF_INET6
#endif

#ifndef AF_LOCAL
# define AF_LOCAL AF_UNIX
#endif
49 50 51 52 53 54 55 56 57 58
/* Required yet non-standard cmsg functions */
#ifndef CMSG_ALIGN
# define CMSG_ALIGN(len) (((len) + sizeof(intptr_t)-1) & ~(sizeof(intptr_t)-1))
#endif
#ifndef CMSG_SPACE
# define CMSG_SPACE(len) (CMSG_ALIGN(sizeof(struct cmsghdr)) + CMSG_ALIGN(len))
#endif
#ifndef CMSG_LEN
# define CMSG_LEN(len) (CMSG_ALIGN(sizeof(struct cmsghdr)) + (len))
#endif
59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108

static inline int is_allowed_port (uint16_t port)
{
    port = ntohs (port);
    return (port == 80) || (port == 443) || (port == 554);
}


static inline int send_err (int fd, int err)
{
    return send (fd, &err, sizeof (err), 0) == sizeof (err) ? 0 : -1;
}

/**
 * Send a file descriptor to another process
 */
static int send_fd (int p, int fd)
{
    struct msghdr hdr;
    struct iovec iov;
    struct cmsghdr *cmsg;
    char buf[CMSG_SPACE (sizeof (fd))];
    int val = 0;

    hdr.msg_name = NULL;
    hdr.msg_namelen = 0;
    hdr.msg_iov = &iov;
    hdr.msg_iovlen = 1;
    hdr.msg_control = buf;
    hdr.msg_controllen = sizeof (buf);

    iov.iov_base = &val;
    iov.iov_len = sizeof (val);

    cmsg = CMSG_FIRSTHDR (&hdr);
    cmsg->cmsg_level = SOL_SOCKET;
    cmsg->cmsg_type = SCM_RIGHTS;
    cmsg->cmsg_len = CMSG_LEN (sizeof (fd));
    memcpy (CMSG_DATA (cmsg), &fd, sizeof (fd));
    hdr.msg_controllen = cmsg->cmsg_len;

    return sendmsg (p, &hdr, 0) == sizeof (val) ? 0 : -1;
}


/**
 * Background process run as root to open privileged TCP ports.
 */
static void rootprocess (int fd)
{
109 110 111 112 113 114 115 116 117
    union
    {
        struct sockaddr         sa;
        struct sockaddr_storage ss;
        struct sockaddr_in      sin;
#ifdef AF_INET6
        struct sockaddr_in6     sin6;
#endif
    } addr;
118

119
    while (recv (fd, &addr.ss, sizeof (addr.ss), 0) == sizeof (addr.ss))
120 121 122
    {
        unsigned len;
        int sock;
123
        int family;
124

125
        switch (addr.sa.sa_family)
126 127
        {
            case AF_INET:
128
                if (!is_allowed_port (addr.sin.sin_port))
129 130 131 132 133 134
                {
                    if (send_err (fd, EACCES))
                        return;
                    continue;
                }
                len = sizeof (struct sockaddr_in);
135
                family = PF_INET;
136 137 138 139
                break;

#ifdef AF_INET6
            case AF_INET6:
140
                if (!is_allowed_port (addr.sin6.sin6_port))
141 142 143 144 145 146
                {
                    if (send_err (fd, EACCES))
                        return;
                    continue;
                }
                len = sizeof (struct sockaddr_in6);
147
                family = PF_INET6;
148 149 150 151 152 153 154 155 156
                break;
#endif

            default:
                if (send_err (fd, EAFNOSUPPORT))
                    return;
                continue;
        }

157
        sock = socket (family, SOCK_STREAM, IPPROTO_TCP);
158 159 160 161 162 163
        if (sock != -1)
        {
            const int val = 1;

            setsockopt (sock, SOL_SOCKET, SO_REUSEADDR, &val, sizeof (val));
#ifdef AF_INET6
164
            if (addr.sa.sa_family == AF_INET6)
165 166
                setsockopt (sock, IPPROTO_IPV6, IPV6_V6ONLY, &val, sizeof (val));
#endif
167
            if (bind (sock, &addr.sa, len) == 0)
168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262
            {
                send_fd (fd, sock);
                close (sock);
                continue;
            }
        }
        send_err (fd, errno);
    }
}

/* TODO?
 *  - use libcap if available,
 *  - call chroot
 */

int main (int argc, char *argv[])
{
    /* Support for dynamically opening RTSP, HTTP and HTTP/SSL ports */
    int pair[2];

    if (socketpair (AF_LOCAL, SOCK_STREAM, 0, pair))
        return 1;
    if (pair[0] < 3)
        goto error; /* we want 0, 1 and 2 open */

    pid_t pid = fork ();
    switch (pid)
    {
        case -1:
            goto error;

        case 0:
        {
            int null = open ("/dev/null", O_RDWR);
            if (null != -1)
            {
                dup2 (null, 0);
                dup2 (null, 1);
                dup2 (null, 2);
                close (null);
            }
            close (pair[0]);
            setsid ();
            rootprocess (pair[1]);
            exit (0);
        }
    }

    close (pair[1]);
    pair[1] = -1;

    char buf[21];
    snprintf (buf, sizeof (buf), "%d", pair[0]);
    setenv ("VLC_ROOTWRAP_SOCK", buf, 1);

    /* Support for real-time priorities */
#ifdef RLIMIT_RTPRIO
    struct rlimit rlim;
    rlim.rlim_max = rlim.rlim_cur = sched_get_priority_min (SCHED_RR) + 24;
    setrlimit (RLIMIT_RTPRIO, &rlim);
#endif

    uid_t uid = getuid ();
    if (uid == 0)
    {
        const char *sudo = getenv ("SUDO_UID");
        if (sudo)
            uid = atoi (sudo);
    }
    if (uid == 0)
    {
        fprintf (stderr, "Cannot determine unprivileged user for VLC!\n");
        exit (1);
    }
    setuid (uid);

    if (!setuid (0)) /* sanity check: we cannot get root back */
        exit (1);

    /* Yeah, the user can execute just about anything from here.
     * But we've dropped privileges, so it does not matter. */
    if (strlen (argv[0]) < sizeof ("-wrapper"))
        goto error;
    argv[0][strlen (argv[0]) - strlen ("-wrapper")] = '\0';

    (void)argc;
    if (execvp (argv[0], argv))
        perror (argv[0]);

error:
    close (pair[0]);
    if (pair[1] != -1)
        close (pair[1]);
    return 1;
}