qrexec-agent.c 14 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607
  1. /*
  2. * The Qubes OS Project, http://www.qubes-os.org
  3. *
  4. * Copyright (C) 2010 Rafal Wojtczuk <rafal@invisiblethingslab.com>
  5. *
  6. * This program is free software; you can redistribute it and/or
  7. * modify it under the terms of the GNU General Public License
  8. * as published by the Free Software Foundation; either version 2
  9. * of the License, or (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with this program; if not, write to the Free Software
  18. * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  19. *
  20. */
  21. #include <sys/select.h>
  22. #include <stdio.h>
  23. #include <stdlib.h>
  24. #include <signal.h>
  25. #include <unistd.h>
  26. #include <errno.h>
  27. #include <sys/wait.h>
  28. #include <fcntl.h>
  29. #include <string.h>
  30. #include <pwd.h>
  31. #include <grp.h>
  32. #include <sys/stat.h>
  33. #include "qrexec.h"
  34. #include "libqrexec-utils.h"
  35. enum fdtype {
  36. FDTYPE_INVALID,
  37. FDTYPE_STDOUT,
  38. FDTYPE_STDERR
  39. };
  40. struct _process_fd {
  41. int client_id;
  42. int type;
  43. int is_blocked;
  44. };
  45. struct _client_info {
  46. int stdin_fd;
  47. int stdout_fd;
  48. int stderr_fd;
  49. int exit_status;
  50. int is_exited;
  51. int pid;
  52. int is_blocked;
  53. int is_close_after_flush_needed;
  54. struct buffer buffer;
  55. };
  56. int max_process_fd = -1;
  57. /* indexed by file descriptor */
  58. struct _process_fd process_fd[MAX_FDS];
  59. /* indexed by client id, which is descriptor number of a client in daemon */
  60. struct _client_info client_info[MAX_FDS];
  61. int trigger_fd;
  62. int passfd_socket;
  63. int meminfo_write_started = 0;
  64. void do_exec(const char *cmd);
  65. void init()
  66. {
  67. peer_server_init(REXEC_PORT);
  68. umask(0);
  69. mkfifo(QREXEC_AGENT_TRIGGER_PATH, 0666);
  70. passfd_socket = get_server_socket(QREXEC_AGENT_FDPASS_PATH);
  71. umask(077);
  72. trigger_fd =
  73. open(QREXEC_AGENT_TRIGGER_PATH, O_RDONLY | O_NONBLOCK);
  74. register_exec_func(do_exec);
  75. }
  76. void wake_meminfo_writer() {
  77. FILE *f;
  78. int pid;
  79. if (meminfo_write_started)
  80. /* wake meminfo-writer only once */
  81. return;
  82. f = fopen(MEMINFO_WRITER_PIDFILE, "r");
  83. if (f == NULL) {
  84. /* no meminfo-writer found, ignoring */
  85. return;
  86. }
  87. if (fscanf(f, "%d", &pid) < 1) {
  88. fclose(f);
  89. /* no meminfo-writer found, ignoring */
  90. return;
  91. }
  92. fclose(f);
  93. if (pid <= 1 || pid > 0xffff) {
  94. /* check within acceptable range */
  95. return;
  96. }
  97. if (kill(pid, SIGUSR1) < 0) {
  98. /* Can't send signal */
  99. return;
  100. }
  101. meminfo_write_started = 1;
  102. }
  103. void no_colon_in_cmd()
  104. {
  105. fprintf(stderr,
  106. "cmdline is supposed to be in user:command form\n");
  107. exit(1);
  108. }
  109. void do_exec(const char *cmd)
  110. {
  111. char buf[strlen(QUBES_RPC_MULTIPLEXER_PATH) + strlen(cmd) - strlen(QUBES_RPC_MAGIC_CMD) + 1];
  112. char *realcmd = index(cmd, ':'), *user;
  113. if (!realcmd)
  114. no_colon_in_cmd();
  115. /* mark end of username and move to command */
  116. user=strndup(cmd,realcmd-cmd);
  117. realcmd++;
  118. /* ignore "nogui:" prefix in linux agent */
  119. if (strncmp(realcmd, "nogui:", 6) == 0)
  120. realcmd+=6;
  121. /* replace magic RPC cmd with RPC multiplexer path */
  122. if (strncmp(realcmd, QUBES_RPC_MAGIC_CMD " ", strlen(QUBES_RPC_MAGIC_CMD)+1)==0) {
  123. strcpy(buf, QUBES_RPC_MULTIPLEXER_PATH);
  124. strcpy(buf + strlen(QUBES_RPC_MULTIPLEXER_PATH), realcmd + strlen(QUBES_RPC_MAGIC_CMD));
  125. realcmd = buf;
  126. }
  127. signal(SIGCHLD, SIG_DFL);
  128. signal(SIGPIPE, SIG_DFL);
  129. execl("/bin/su", "su", "-", user, "-c", realcmd, NULL);
  130. perror("execl");
  131. exit(1);
  132. }
  133. void handle_just_exec(int len)
  134. {
  135. char buf[len];
  136. int fdn, pid;
  137. read_all_vchan_ext(buf, len);
  138. switch (pid = fork()) {
  139. case -1:
  140. perror("fork");
  141. exit(1);
  142. case 0:
  143. fdn = open("/dev/null", O_RDWR);
  144. fix_fds(fdn, fdn, fdn);
  145. do_exec(buf);
  146. perror("execl");
  147. exit(1);
  148. default:;
  149. }
  150. fprintf(stderr, "executed (nowait) %s pid %d\n", buf, pid);
  151. }
  152. void create_info_about_client(int client_id, int pid, int stdin_fd,
  153. int stdout_fd, int stderr_fd)
  154. {
  155. process_fd[stdout_fd].client_id = client_id;
  156. process_fd[stdout_fd].type = FDTYPE_STDOUT;
  157. process_fd[stdout_fd].is_blocked = 0;
  158. process_fd[stderr_fd].client_id = client_id;
  159. process_fd[stderr_fd].type = FDTYPE_STDERR;
  160. process_fd[stderr_fd].is_blocked = 0;
  161. if (stderr_fd > max_process_fd)
  162. max_process_fd = stderr_fd;
  163. if (stdout_fd > max_process_fd)
  164. max_process_fd = stdout_fd;
  165. set_nonblock(stdin_fd);
  166. client_info[client_id].stdin_fd = stdin_fd;
  167. client_info[client_id].stdout_fd = stdout_fd;
  168. client_info[client_id].stderr_fd = stderr_fd;
  169. client_info[client_id].exit_status = 0;
  170. client_info[client_id].is_exited = 0;
  171. client_info[client_id].pid = pid;
  172. client_info[client_id].is_blocked = 0;
  173. client_info[client_id].is_close_after_flush_needed = 0;
  174. buffer_init(&client_info[client_id].buffer);
  175. }
  176. void handle_exec(int client_id, int len)
  177. {
  178. char buf[len];
  179. int pid, stdin_fd, stdout_fd, stderr_fd;
  180. read_all_vchan_ext(buf, len);
  181. do_fork_exec(buf, &pid, &stdin_fd, &stdout_fd, &stderr_fd);
  182. create_info_about_client(client_id, pid, stdin_fd, stdout_fd,
  183. stderr_fd);
  184. fprintf(stderr, "executed %s pid %d\n", buf, pid);
  185. }
  186. void handle_connect_existing(int client_id, int len)
  187. {
  188. int stdin_fd, stdout_fd, stderr_fd;
  189. char buf[len];
  190. read_all_vchan_ext(buf, len);
  191. sscanf(buf, "%d %d %d", &stdin_fd, &stdout_fd, &stderr_fd);
  192. create_info_about_client(client_id, -1, stdin_fd, stdout_fd,
  193. stderr_fd);
  194. client_info[client_id].is_exited = 1; //do not wait for SIGCHLD
  195. }
  196. void update_max_process_fd()
  197. {
  198. int i;
  199. for (i = max_process_fd;
  200. i >= 0 && process_fd[i].type == FDTYPE_INVALID; i--);
  201. max_process_fd = i;
  202. }
  203. void send_exit_code(int client_id, int status)
  204. {
  205. struct server_header s_hdr;
  206. s_hdr.type = MSG_AGENT_TO_SERVER_EXIT_CODE;
  207. s_hdr.client_id = client_id;
  208. s_hdr.len = sizeof status;
  209. write_all_vchan_ext(&s_hdr, sizeof s_hdr);
  210. write_all_vchan_ext(&status, sizeof(status));
  211. fprintf(stderr, "send exit code %d for client_id %d pid %d\n",
  212. status, client_id, client_info[client_id].pid);
  213. }
  214. // erase process data structures, possibly forced by remote
  215. void remove_process(int client_id, int status)
  216. {
  217. int i;
  218. if (!client_info[client_id].pid)
  219. return;
  220. if (client_info[client_id].stdin_fd >= 0)
  221. fork_and_flush_stdin(client_info[client_id].stdin_fd,
  222. &client_info[client_id].buffer);
  223. #if 0
  224. // let's let it die by itself, possibly after it has received buffered stdin
  225. kill(client_info[client_id].pid, SIGKILL);
  226. #endif
  227. if (status != -1)
  228. send_exit_code(client_id, status);
  229. close(client_info[client_id].stdin_fd);
  230. client_info[client_id].pid = 0;
  231. client_info[client_id].stdin_fd = -1;
  232. client_info[client_id].is_blocked = 0;
  233. buffer_free(&client_info[client_id].buffer);
  234. for (i = 0; i <= max_process_fd; i++)
  235. if (process_fd[i].type != FDTYPE_INVALID
  236. && process_fd[i].client_id == client_id) {
  237. process_fd[i].type = FDTYPE_INVALID;
  238. process_fd[i].client_id = -1;
  239. process_fd[i].is_blocked = 0;
  240. close(i);
  241. }
  242. update_max_process_fd();
  243. }
  244. // remove process not immediately after it has exited, but after its stdout and stderr has been drained
  245. // previous method implemented in flush_out_err was broken - it cannot work when peer signalled it is blocked
  246. void possibly_remove_process(int client_id)
  247. {
  248. if (client_info[client_id].stdout_fd == -1 &&
  249. client_info[client_id].stderr_fd == -1 &&
  250. client_info[client_id].is_exited)
  251. remove_process(client_id,
  252. client_info[client_id].exit_status);
  253. }
  254. void handle_input(int client_id, int len)
  255. {
  256. char buf[len];
  257. read_all_vchan_ext(buf, len);
  258. if (!client_info[client_id].pid || client_info[client_id].stdin_fd == -1)
  259. return;
  260. if (len == 0) {
  261. if (client_info[client_id].is_blocked)
  262. client_info[client_id].is_close_after_flush_needed
  263. = 1;
  264. else {
  265. close(client_info[client_id].stdin_fd);
  266. client_info[client_id].stdin_fd = -1;
  267. }
  268. return;
  269. }
  270. switch (write_stdin
  271. (client_info[client_id].stdin_fd, client_id, buf, len,
  272. &client_info[client_id].buffer)) {
  273. case WRITE_STDIN_OK:
  274. break;
  275. case WRITE_STDIN_BUFFERED:
  276. client_info[client_id].is_blocked = 1;
  277. break;
  278. case WRITE_STDIN_ERROR:
  279. // do not remove process, as it still can write data to stdout
  280. close(client_info[client_id].stdin_fd);
  281. client_info[client_id].stdin_fd = -1;
  282. client_info[client_id].is_blocked = 0;
  283. break;
  284. default:
  285. fprintf(stderr, "unknown write_stdin?\n");
  286. exit(1);
  287. }
  288. }
  289. void set_blocked_outerr(int client_id, int val)
  290. {
  291. process_fd[client_info[client_id].stdout_fd].is_blocked = val;
  292. process_fd[client_info[client_id].stderr_fd].is_blocked = val;
  293. }
  294. void handle_server_data()
  295. {
  296. struct server_header s_hdr;
  297. read_all_vchan_ext(&s_hdr, sizeof s_hdr);
  298. // fprintf(stderr, "got %x %x %x\n", s_hdr.type, s_hdr.client_id,
  299. // s_hdr.len);
  300. switch (s_hdr.type) {
  301. case MSG_XON:
  302. set_blocked_outerr(s_hdr.client_id, 0);
  303. break;
  304. case MSG_XOFF:
  305. set_blocked_outerr(s_hdr.client_id, 1);
  306. break;
  307. case MSG_SERVER_TO_AGENT_CONNECT_EXISTING:
  308. handle_connect_existing(s_hdr.client_id, s_hdr.len);
  309. break;
  310. case MSG_SERVER_TO_AGENT_EXEC_CMDLINE:
  311. wake_meminfo_writer();
  312. handle_exec(s_hdr.client_id, s_hdr.len);
  313. break;
  314. case MSG_SERVER_TO_AGENT_JUST_EXEC:
  315. wake_meminfo_writer();
  316. handle_just_exec(s_hdr.len);
  317. break;
  318. case MSG_SERVER_TO_AGENT_INPUT:
  319. handle_input(s_hdr.client_id, s_hdr.len);
  320. break;
  321. case MSG_SERVER_TO_AGENT_CLIENT_END:
  322. remove_process(s_hdr.client_id, -1);
  323. break;
  324. default:
  325. fprintf(stderr, "msg type from daemon is %d ?\n",
  326. s_hdr.type);
  327. exit(1);
  328. }
  329. }
  330. void handle_process_data(int fd)
  331. {
  332. struct server_header s_hdr;
  333. char buf[MAX_DATA_CHUNK];
  334. int ret;
  335. unsigned int len;
  336. len = buffer_space_vchan_ext();
  337. if (len <= sizeof s_hdr)
  338. return;
  339. ret = read(fd, buf, len - sizeof s_hdr);
  340. s_hdr.client_id = process_fd[fd].client_id;
  341. if (process_fd[fd].type == FDTYPE_STDOUT)
  342. s_hdr.type = MSG_AGENT_TO_SERVER_STDOUT;
  343. else if (process_fd[fd].type == FDTYPE_STDERR)
  344. s_hdr.type = MSG_AGENT_TO_SERVER_STDERR;
  345. else {
  346. fprintf(stderr, "fd=%d, client_id=%d, type=%d ?\n", fd,
  347. process_fd[fd].client_id, process_fd[fd].type);
  348. exit(1);
  349. }
  350. s_hdr.len = ret;
  351. if (ret >= 0) {
  352. write_all_vchan_ext(&s_hdr, sizeof s_hdr);
  353. write_all_vchan_ext(buf, ret);
  354. }
  355. if (ret == 0) {
  356. int client_id = process_fd[fd].client_id;
  357. if (process_fd[fd].type == FDTYPE_STDOUT)
  358. client_info[client_id].stdout_fd = -1;
  359. else
  360. client_info[client_id].stderr_fd = -1;
  361. process_fd[fd].type = FDTYPE_INVALID;
  362. process_fd[fd].client_id = -1;
  363. process_fd[fd].is_blocked = 0;
  364. close(fd);
  365. update_max_process_fd();
  366. possibly_remove_process(client_id);
  367. }
  368. if (ret < 0)
  369. remove_process(process_fd[fd].client_id, 127);
  370. }
  371. volatile int child_exited;
  372. void sigchld_handler(int x __attribute__((__unused__)))
  373. {
  374. child_exited = 1;
  375. signal(SIGCHLD, sigchld_handler);
  376. }
  377. int find_info(int pid)
  378. {
  379. int i;
  380. for (i = 0; i < MAX_FDS; i++)
  381. if (client_info[i].pid == pid)
  382. return i;
  383. return -1;
  384. }
  385. void handle_process_data_all(fd_set * select_fds)
  386. {
  387. int i;
  388. for (i = 0; i <= max_process_fd; i++)
  389. if (process_fd[i].type != FDTYPE_INVALID
  390. && FD_ISSET(i, select_fds))
  391. handle_process_data(i);
  392. }
  393. void reap_children()
  394. {
  395. int status;
  396. int pid;
  397. int client_id;
  398. while ((pid = waitpid(-1, &status, WNOHANG)) > 0) {
  399. client_id = find_info(pid);
  400. if (client_id < 0)
  401. continue;
  402. client_info[client_id].is_exited = 1;
  403. client_info[client_id].exit_status = status;
  404. possibly_remove_process(client_id);
  405. }
  406. child_exited = 0;
  407. }
  408. int fill_fds_for_select(fd_set * rdset, fd_set * wrset)
  409. {
  410. int max = -1;
  411. int fd, i;
  412. FD_ZERO(rdset);
  413. FD_ZERO(wrset);
  414. for (i = 0; i <= max_process_fd; i++)
  415. if (process_fd[i].type != FDTYPE_INVALID
  416. && !process_fd[i].is_blocked) {
  417. FD_SET(i, rdset);
  418. max = i;
  419. }
  420. FD_SET(trigger_fd, rdset);
  421. if (trigger_fd > max)
  422. max = trigger_fd;
  423. FD_SET(passfd_socket, rdset);
  424. if (passfd_socket > max)
  425. max = passfd_socket;
  426. for (i = 0; i < MAX_FDS; i++)
  427. if (client_info[i].pid && client_info[i].is_blocked) {
  428. fd = client_info[i].stdin_fd;
  429. FD_SET(fd, wrset);
  430. if (fd > max)
  431. max = fd;
  432. }
  433. return max;
  434. }
  435. void flush_client_data_agent(int client_id)
  436. {
  437. struct _client_info *info = &client_info[client_id];
  438. switch (flush_client_data
  439. (info->stdin_fd, client_id, &info->buffer)) {
  440. case WRITE_STDIN_OK:
  441. info->is_blocked = 0;
  442. if (info->is_close_after_flush_needed) {
  443. close(info->stdin_fd);
  444. info->stdin_fd = -1;
  445. info->is_close_after_flush_needed = 0;
  446. }
  447. break;
  448. case WRITE_STDIN_ERROR:
  449. // do not remove process, as it still can write data to stdout
  450. info->is_blocked = 0;
  451. close(info->stdin_fd);
  452. info->stdin_fd = -1;
  453. info->is_close_after_flush_needed = 0;
  454. break;
  455. case WRITE_STDIN_BUFFERED:
  456. break;
  457. default:
  458. fprintf(stderr, "unknown flush_client_data?\n");
  459. exit(1);
  460. }
  461. }
  462. void handle_new_passfd()
  463. {
  464. int fd = do_accept(passfd_socket);
  465. if (fd >= MAX_FDS) {
  466. fprintf(stderr, "too many clients ?\n");
  467. exit(1);
  468. }
  469. // let client know what fd has been allocated
  470. if (write(fd, &fd, sizeof(fd)) != sizeof(fd)) {
  471. perror("write to client");
  472. }
  473. }
  474. void handle_trigger_io()
  475. {
  476. struct server_header s_hdr;
  477. struct trigger_connect_params params;
  478. int ret;
  479. s_hdr.client_id = 0;
  480. s_hdr.len = 0;
  481. ret = read(trigger_fd, &params, sizeof(params));
  482. if (ret == sizeof(params)) {
  483. s_hdr.type = MSG_AGENT_TO_SERVER_TRIGGER_CONNECT_EXISTING;
  484. write_all_vchan_ext(&s_hdr, sizeof s_hdr);
  485. write_all_vchan_ext(&params, sizeof params);
  486. }
  487. // trigger_fd is nonblock - so no need to reopen
  488. // not really, need to reopen at EOF
  489. if (ret <= 0) {
  490. close(trigger_fd);
  491. trigger_fd =
  492. open(QREXEC_AGENT_TRIGGER_PATH, O_RDONLY | O_NONBLOCK);
  493. }
  494. }
  495. int main()
  496. {
  497. fd_set rdset, wrset;
  498. int max;
  499. int i;
  500. sigset_t chld_set;
  501. init();
  502. signal(SIGCHLD, sigchld_handler);
  503. signal(SIGPIPE, SIG_IGN);
  504. sigemptyset(&chld_set);
  505. sigaddset(&chld_set, SIGCHLD);
  506. for (;;) {
  507. sigprocmask(SIG_BLOCK, &chld_set, NULL);
  508. if (child_exited)
  509. reap_children();
  510. max = fill_fds_for_select(&rdset, &wrset);
  511. if (buffer_space_vchan_ext() <=
  512. sizeof(struct server_header))
  513. FD_ZERO(&rdset);
  514. wait_for_vchan_or_argfd(max, &rdset, &wrset);
  515. sigprocmask(SIG_UNBLOCK, &chld_set, NULL);
  516. if (FD_ISSET(passfd_socket, &rdset))
  517. handle_new_passfd();
  518. while (read_ready_vchan_ext())
  519. handle_server_data();
  520. if (FD_ISSET(trigger_fd, &rdset))
  521. handle_trigger_io();
  522. handle_process_data_all(&rdset);
  523. for (i = 0; i <= MAX_FDS; i++)
  524. if (client_info[i].pid
  525. && client_info[i].is_blocked
  526. && FD_ISSET(client_info[i].stdin_fd, &wrset))
  527. flush_client_data_agent(i);
  528. }
  529. }