scheduler/process.c

   1 /*
   2  * "$Id$"
   3  *
   4  *   Process management routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 2007-2009 by Apple Inc.
   7  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
   8  *
   9  *   These coded instructions, statements, and computer programs are the
  10  *   property of Apple Inc. and are protected by Federal copyright
  11  *   law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  12  *   which should have been included with this file.  If this file is
  13  *   file is missing or damaged, see the license at "http://www.cups.org/".
  14  *
  15  * Contents:
  16  *
  17  *   cupsdCreateProfile()  - Create an execution profile for a subprocess.
  18  *   cupsdDestroyProfile() - Delete an execution profile.
  19  *   cupsdEndProcess()     - End a process.
  20  *   cupsdFinishProcess()  - Finish a process and get its name.
  21  *   cupsdStartProcess()   - Start a process.
  22  *   compare_procs()       - Compare two processes.
  23  *   cupsd_requote()       - Make a regular-expression version of a string.
  24  */
  25
  26 /*
  27  * Include necessary headers...
  28  */
  29
  30 #include "cupsd.h"
  31 #include <grp.h>
  32 #ifdef __APPLE__
  33 #  include <libgen.h>
  34 #endif /* __APPLE__ */
  35 #ifdef HAVE_SANDBOX_H
  36 #  define __APPLE_API_PRIVATE
  37 #  include <sandbox.h>
  38 #endif /* HAVE_SANDBOX_H */
  39
  40
  41 /*
  42  * Process structure...
  43  */
  44
  45 typedef struct
  46 {
  47   int   pid,                            /* Process ID */
  48         job_id;                         /* Job associated with process */
  49   char  name[1];                        /* Name of process */
  50 } cupsd_proc_t;
  51
  52
  53 /*
  54  * Local globals...
  55  */
  56
  57 static cups_array_t     *process_array = NULL;
  58
  59
  60 /*
  61  * Local functions...
  62  */
  63
  64 static int      compare_procs(cupsd_proc_t *a, cupsd_proc_t *b);
  65 #ifdef HAVE_SANDBOX_H
  66 static char     *cupsd_requote(char *dst, const char *src, size_t dstsize);
  67 #endif /* HAVE_SANDBOX_H */
  68
  69
  70 /*
  71  * 'cupsdCreateProfile()' - Create an execution profile for a subprocess.
  72  */
  73
  74 void *                                  /* O - Profile or NULL on error */
  75 cupsdCreateProfile(int job_id)          /* I - Job ID or 0 for none */
  76 {
  77 #ifdef HAVE_SANDBOX_H
  78   cups_file_t   *fp;                    /* File pointer */
  79   char          profile[1024],          /* File containing the profile */
  80                 cache[1024],            /* Quoted CacheDir */
  81                 request[1024],          /* Quoted RequestRoot */
  82                 root[1024],             /* Quoted ServerRoot */
  83                 temp[1024];             /* Quoted TempDir */
  84
  85
  86   if (!UseProfiles || RunUser)
  87   {
  88    /*
  89     * Only use sandbox profiles as root...
  90     */
  91
  92     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
  93                     job_id);
  94
  95     return (NULL);
  96   }
  97
  98   if ((fp = cupsTempFile2(profile, sizeof(profile))) == NULL)
  99   {
 100     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 101                     job_id);
 102     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to create security profile: %s",
 103                     strerror(errno));
 104     return (NULL);
 105   }
 106
 107   cupsd_requote(cache, CacheDir, sizeof(cache));
 108   cupsd_requote(request, RequestRoot, sizeof(request));
 109   cupsd_requote(root, ServerRoot, sizeof(root));
 110   cupsd_requote(temp, TempDir, sizeof(temp));
 111
 112   cupsFilePuts(fp, "(version 1)\n");
 113   cupsFilePuts(fp, "(debug deny)\n");
 114   cupsFilePuts(fp, "(allow default)\n");
 115   cupsFilePrintf(fp,
 116                  "(deny file-write* file-read-data file-read-metadata\n"
 117                  "  (regex #\"^%s/\"))\n", request);
 118   cupsFilePrintf(fp,
 119                  "(deny file-write*\n"
 120                  "  (regex #\"^%s\" #\"^/private/etc\" #\"^/usr/local/etc\" "
 121                  "#\"^/Library\" #\"^/System\" #\"^/Users\"))\n", root);
 122   cupsFilePrintf(fp,
 123                  "(allow file-write* file-read-data file-read-metadata\n"
 124                  "  (regex #\"^%s$\" #\"^%s/\" #\"^%s$\" #\"^%s/\""
 125                  " #\"^/Library/Application Support/\""
 126                  " #\"^/Library/Caches/\""
 127                  " #\"^/Library/Preferences/\""
 128                  " #\"^/Library/Printers/\""
 129                  "))\n",
 130                  temp, temp, cache, cache);
 131   cupsFilePuts(fp,
 132                "(deny file-write*\n"
 133                "  (regex #\"^/Library/Printers/PPDs/\""
 134                " #\"^/Library/Printers/PPD Plugins/\""
 135                "))\n");
 136   if (job_id)
 137     cupsFilePrintf(fp,
 138                    "(allow file-read-data file-read-metadata\n"
 139                    "  (regex #\"^%s/([ac]%05d|d%05d-[0-9][0-9][0-9])$\"))\n",
 140                    request, job_id, job_id);
 141
 142   cupsFileClose(fp);
 143
 144   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = \"%s\"",
 145                   job_id, profile);
 146   return ((void *)strdup(profile));
 147
 148 #else
 149   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 150                   job_id);
 151
 152   return (NULL);
 153 #endif /* HAVE_SANDBOX_H */
 154 }
 155
 156
 157 /*
 158  * 'cupsdDestroyProfile()' - Delete an execution profile.
 159  */
 160
 161 void
 162 cupsdDestroyProfile(void *profile)      /* I - Profile */
 163 {
 164   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDeleteProfile(profile=\"%s\")",
 165                   profile ? (char *)profile : "(null)");
 166
 167 #ifdef HAVE_SANDBOX_H
 168   if (profile)
 169   {
 170     unlink((char *)profile);
 171     free(profile);
 172   }
 173 #endif /* HAVE_SANDBOX_H */
 174 }
 175
 176
 177 /*
 178  * 'cupsdEndProcess()' - End a process.
 179  */
 180
 181 int                                     /* O - 0 on success, -1 on failure */
 182 cupsdEndProcess(int pid,                /* I - Process ID */
 183                 int force)              /* I - Force child to die */
 184 {
 185   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdEndProcess(pid=%d, force=%d)", pid,
 186                   force);
 187
 188   if (force)
 189     return (kill(pid, SIGKILL));
 190   else
 191     return (kill(pid, SIGTERM));
 192 }
 193
 194
 195 /*
 196  * 'cupsdFinishProcess()' - Finish a process and get its name.
 197  */
 198
 199 const char *                            /* O - Process name */
 200 cupsdFinishProcess(int  pid,            /* I - Process ID */
 201                    char *name,          /* I - Name buffer */
 202                    int  namelen,        /* I - Size of name buffer */
 203                    int  *job_id)        /* O - Job ID pointer or NULL */
 204 {
 205   cupsd_proc_t  key,                    /* Search key */
 206                 *proc;                  /* Matching process */
 207
 208
 209   key.pid = pid;
 210
 211   if ((proc = (cupsd_proc_t *)cupsArrayFind(process_array, &key)) != NULL)
 212   {
 213     if (job_id)
 214       *job_id = proc->job_id;
 215
 216     strlcpy(name, proc->name, namelen);
 217     cupsArrayRemove(process_array, proc);
 218     free(proc);
 219   }
 220   else
 221   {
 222     if (job_id)
 223       *job_id = 0;
 224
 225     strlcpy(name, "unknown", namelen);
 226   }
 227
 228   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 229                   "cupsdFinishProcess(pid=%d, name=%p, namelen=%d, "
 230                   "job_id=%p(%d)) = \"%s\"", pid, name, namelen, job_id,
 231                   job_id ? *job_id : 0, name);
 232
 233   return (name);
 234 }
 235
 236
 237 /*
 238  * 'cupsdStartProcess()' - Start a process.
 239  */
 240
 241 int                                     /* O - Process ID or 0 */
 242 cupsdStartProcess(
 243     const char  *command,               /* I - Full path to command */
 244     char        *argv[],                /* I - Command-line arguments */
 245     char        *envp[],                /* I - Environment */
 246     int         infd,                   /* I - Standard input file descriptor */
 247     int         outfd,                  /* I - Standard output file descriptor */
 248     int         errfd,                  /* I - Standard error file descriptor */
 249     int         backfd,                 /* I - Backchannel file descriptor */
 250     int         sidefd,                 /* I - Sidechannel file descriptor */
 251     int         root,                   /* I - Run as root? */
 252     void        *profile,               /* I - Security profile to use */
 253     cupsd_job_t *job,                   /* I - Job associated with process */
 254     int         *pid)                   /* O - Process ID */
 255 {
 256   int           user;                   /* Command UID */
 257   struct stat   commandinfo;            /* Command file information */
 258   cupsd_proc_t  *proc;                  /* New process record */
 259 #if defined(HAVE_SIGACTION) && !defined(HAVE_SIGSET)
 260   struct sigaction action;              /* POSIX signal handler */
 261 #endif /* HAVE_SIGACTION && !HAVE_SIGSET */
 262 #if defined(__APPLE__)
 263   char          processPath[1024],      /* CFProcessPath environment variable */
 264                 linkpath[1024];         /* Link path for symlinks... */
 265   int           linkbytes;              /* Bytes for link path */
 266 #endif /* __APPLE__ */
 267
 268
 269   if (RunUser)
 270     user = RunUser;
 271   else if (root)
 272     user = 0;
 273   else
 274     user = User;
 275
 276   if (stat(command, &commandinfo))
 277   {
 278     *pid = 0;
 279
 280     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 281                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 282                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 283                     "profile=%p, job=%p(%d), pid=%p) = %d",
 284                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 285                     root, profile, job, job ? job->id : 0, pid, *pid);
 286     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to execute %s: %s", command,
 287                     strerror(errno));
 288
 289     if (job && job->printer)
 290       cupsdSetPrinterReasons(job->printer, "+cups-missing-filter-warning");
 291
 292     return (0);
 293   }
 294   else if ((commandinfo.st_mode & (S_ISUID | S_IWOTH)) ||
 295            (!RunUser && commandinfo.st_uid))
 296   {
 297     *pid = 0;
 298
 299     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 300                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 301                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 302                     "profile=%p, job=%p(%d), pid=%p) = %d",
 303                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 304                     root, profile, job, job ? job->id : 0, pid, *pid);
 305     cupsdLogMessage(CUPSD_LOG_ERROR,
 306                     "Unable to execute %s: insecure file permissions (0%o)",
 307                     command, commandinfo.st_mode);
 308
 309     if (job && job->printer)
 310       cupsdSetPrinterReasons(job->printer, "+cups-insecure-filter-warning");
 311
 312     errno = EPERM;
 313
 314     return (0);
 315   }
 316   else if ((commandinfo.st_uid != user || !(commandinfo.st_mode & S_IXUSR)) &&
 317            (commandinfo.st_gid != Group || !(commandinfo.st_mode & S_IXGRP)) &&
 318            !(commandinfo.st_mode & S_IXOTH))
 319   {
 320     *pid = 0;
 321
 322     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 323                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 324                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 325                     "profile=%p, job=%p(%d), pid=%p) = %d",
 326                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 327                     root, profile, job, job ? job->id : 0, pid, *pid);
 328     cupsdLogMessage(CUPSD_LOG_ERROR,
 329                     "Unable to execute %s: no execute permissions (0%o)",
 330                     command, commandinfo.st_mode);
 331
 332     errno = EPERM;
 333     return (0);
 334   }
 335
 336 #if defined(__APPLE__)
 337   if (envp)
 338   {
 339    /*
 340     * Add special voodoo magic for MacOS X - this allows MacOS X
 341     * programs to access their bundle resources properly...
 342     */
 343
 344     if ((linkbytes = readlink(command, linkpath, sizeof(linkpath) - 1)) > 0)
 345     {
 346      /*
 347       * Yes, this is a symlink to the actual program, nul-terminate and
 348       * use it...
 349       */
 350
 351       linkpath[linkbytes] = '\0';
 352
 353       if (linkpath[0] == '/')
 354         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s",
 355                  linkpath);
 356       else
 357         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s/%s",
 358                  dirname((char *)command), linkpath);
 359     }
 360     else
 361       snprintf(processPath, sizeof(processPath), "CFProcessPath=%s", command);
 362
 363     envp[0] = processPath;              /* Replace <CFProcessPath> string */
 364   }
 365 #endif  /* __APPLE__ */
 366
 367  /*
 368   * Block signals before forking...
 369   */
 370
 371   cupsdHoldSignals();
 372
 373   if ((*pid = fork()) == 0)
 374   {
 375    /*
 376     * Child process goes here...
 377     *
 378     * Update stdin/stdout/stderr as needed...
 379     */
 380
 381     if (infd != 0)
 382     {
 383       close(0);
 384       if (infd > 0)
 385         dup(infd);
 386       else
 387         open("/dev/null", O_RDONLY);
 388     }
 389     if (outfd != 1)
 390     {
 391       close(1);
 392       if (outfd > 0)
 393         dup(outfd);
 394       else
 395         open("/dev/null", O_WRONLY);
 396     }
 397     if (errfd != 2)
 398     {
 399       close(2);
 400       if (errfd > 0)
 401         dup(errfd);
 402       else
 403         open("/dev/null", O_WRONLY);
 404     }
 405     if (backfd != 3)
 406     {
 407       close(3);
 408       if (backfd > 0)
 409         dup(backfd);
 410       else
 411         open("/dev/null", O_RDWR);
 412       fcntl(3, F_SETFL, O_NDELAY);
 413     }
 414     if (sidefd != 4 && sidefd > 0)
 415     {
 416       close(4);
 417       dup(sidefd);
 418       fcntl(4, F_SETFL, O_NDELAY);
 419     }
 420
 421    /*
 422     * Change the priority of the process based on the FilterNice setting.
 423     * (this is not done for root processes...)
 424     */
 425
 426     if (!root)
 427       nice(FilterNice);
 428
 429 #ifdef HAVE_SANDBOX_H
 430    /*
 431     * Run in a separate security profile...
 432     */
 433
 434     if (profile)
 435     {
 436       char *error = NULL;               /* Sandbox error, if any */
 437
 438       if (sandbox_init((char *)profile, SANDBOX_NAMED_EXTERNAL, &error))
 439       {
 440         fprintf(stderr, "ERROR: sandbox_init failed: %s (%s)\n", error,
 441                 strerror(errno));
 442         sandbox_free_error(error);
 443       }
 444     }
 445 #endif /* HAVE_SANDBOX_H */
 446
 447    /*
 448     * Change user to something "safe"...
 449     */
 450
 451     if (!root && !RunUser)
 452     {
 453      /*
 454       * Running as root, so change to non-priviledged user...
 455       */
 456
 457       if (setgid(Group))
 458         exit(errno);
 459
 460       if (setgroups(1, &Group))
 461         exit(errno);
 462
 463       if (setuid(User))
 464         exit(errno);
 465     }
 466     else
 467     {
 468      /*
 469       * Reset group membership to just the main one we belong to.
 470       */
 471
 472       setgid(Group);
 473       setgroups(1, &Group);
 474     }
 475
 476    /*
 477     * Change umask to restrict permissions on created files...
 478     */
 479
 480     umask(077);
 481
 482    /*
 483     * Unblock signals before doing the exec...
 484     */
 485
 486 #ifdef HAVE_SIGSET
 487     sigset(SIGTERM, SIG_DFL);
 488     sigset(SIGCHLD, SIG_DFL);
 489 #elif defined(HAVE_SIGACTION)
 490     memset(&action, 0, sizeof(action));
 491
 492     sigemptyset(&action.sa_mask);
 493     action.sa_handler = SIG_DFL;
 494
 495     sigaction(SIGTERM, &action, NULL);
 496     sigaction(SIGCHLD, &action, NULL);
 497 #else
 498     signal(SIGTERM, SIG_DFL);
 499     signal(SIGCHLD, SIG_DFL);
 500 #endif /* HAVE_SIGSET */
 501
 502     cupsdReleaseSignals();
 503
 504    /*
 505     * Execute the command; if for some reason this doesn't work,
 506     * return the error code...
 507     */
 508
 509     if (envp)
 510       execve(command, argv, envp);
 511     else
 512       execv(command, argv);
 513
 514     perror(command);
 515
 516     exit(errno);
 517   }
 518   else if (*pid < 0)
 519   {
 520    /*
 521     * Error - couldn't fork a new process!
 522     */
 523
 524     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to fork %s - %s.", command,
 525                     strerror(errno));
 526
 527     *pid = 0;
 528   }
 529   else
 530   {
 531     if (!process_array)
 532       process_array = cupsArrayNew((cups_array_func_t)compare_procs, NULL);
 533
 534     if (process_array)
 535     {
 536       if ((proc = calloc(1, sizeof(cupsd_proc_t) + strlen(command))) != NULL)
 537       {
 538         proc->pid    = *pid;
 539         proc->job_id = job ? job->id : 0;
 540         strcpy(proc->name, command);
 541
 542         cupsArrayAdd(process_array, proc);
 543       }
 544     }
 545   }
 546
 547   cupsdReleaseSignals();
 548
 549   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 550                   "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 551                   "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 552                   "profile=%p, job=%p(%d), pid=%p) = %d",
 553                   command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 554                   root, profile, job, job ? job->id : 0, pid, *pid);
 555
 556   return (*pid);
 557 }
 558
 559
 560 /*
 561  * 'compare_procs()' - Compare two processes.
 562  */
 563
 564 static int                              /* O - Result of comparison */
 565 compare_procs(cupsd_proc_t *a,          /* I - First process */
 566               cupsd_proc_t *b)          /* I - Second process */
 567 {
 568   return (a->pid - b->pid);
 569 }
 570
 571
 572 #ifdef HAVE_SANDBOX_H
 573 /*
 574  * 'cupsd_requote()' - Make a regular-expression version of a string.
 575  */
 576
 577 static char *                           /* O - Quoted string */
 578 cupsd_requote(char       *dst,          /* I - Destination buffer */
 579               const char *src,          /* I - Source string */
 580               size_t     dstsize)       /* I - Size of destination buffer */
 581 {
 582   int   ch;                             /* Current character */
 583   char  *dstptr,                        /* Current position in buffer */
 584         *dstend;                        /* End of destination buffer */
 585
 586
 587   dstptr = dst;
 588   dstend = dst + dstsize - 2;
 589
 590   while (*src && dstptr < dstend)
 591   {
 592     ch = *src++;
 593
 594     if (strchr(".?*()[]^$\\", ch))
 595       *dstptr++ = '\\';
 596
 597     *dstptr++ = ch;
 598   }
 599
 600   *dstptr = '\0';
 601
 602   return (dst);
 603 }
 604 #endif /* HAVE_SANDBOX_H */
 605
 606
 607 /*
 608  * End of "$Id$".
 609  */