ctdb-common: Only respect CTDB_SOCKET in CTDB_TEST_MODE

At the moment CTDB_SOCKET can be used outside of test mode even though
nobody should do this.  So, no longer allow this.

This means ensuring CTDB_TEST_MODE is set in the in the
"clusteredmember" selftest environment, so that CTDB_SOCKET is
respected there..

Details...

The associated use of chown(2) and chmod(2), used to secure the socket
in ctdb_daemon.c:ux_socket_bind(), potentially enables a symlink race
attack.  However, the chown(2) is currently not done in test mode, so
restricting the use of CTDB_SOCKET to test mode solves the potential
security issue.

Also, sprinkle warnings about use of CTDB_TEST_MODE in appropriate
places, just to attempt to limit unwanted behaviour.

An alternative could be to use the socket file descriptor with
fchown(2) and fchmod(2).  However, these system calls are not well
defined on sockets.  Still, this was previously done in CTDB's early
days (using the poorly documented method where they are allowed in
Linux (only?) before calling bind(2)).  It was removed (due to
portability issues, via commits
cf1056df94943ddcc3d547d4533b4bc04f57f265 and
2da3fe1b175a468fdff4aa4f65627facd2c28394) and replaced with the
current post-bind chown(2) and chmod(2).

I would like to remove the CTDB_SOCKET environment variable entirely,
since setting CTDB_TEST_MODE and CTDB_BASE covers all reasonable test
environments.  However, I have a feeling that people use it for
interactive testing, and that can still be done in CTDB_TEST_MODE.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15921

Signed-off-by: Martin Schwenke <mschwenke@ddn.com>
Reported-by: *GUIAR OQBA * <techokba@gmail.com>
Reviewed-by: Volker Lendecke <vl@samba.org>
Autobuild-User(master): Volker Lendecke <vl@samba.org>
Autobuild-Date(master): Thu Sep 25 09:02:06 UTC 2025 on atb-devel-224

(cherry picked from commit 7e2358fcf7be177d6e5de6e26f9d7c5af4acbb0c)

Autobuild-User(v4-22-test): Jule Anger <janger@samba.org>
Autobuild-Date(v4-22-test): Fri Sep 26 15:10:56 UTC 2025 on atb-devel-224

diff --git a/ctdb/common/path.c b/ctdb/common/path.c
index 0673bace53107808311a79fd425efa64c424609b..0d9354294600639945ddae4a63becfc770feea55 100644 (file)
--- a/ctdb/common/path.c
+++ b/ctdb/common/path.c
@@ -49,6 +49,12 @@ static void path_set_test_mode(void)
 {
        const char *t = NULL;
 
+       /*
+        * Do not use CTDB_TEST_MODE outside a test environment to
+        * attempt to (for example) improve installation flexibility.
+        * This is unsupported, may cause unwanted security issues and
+        * may break in future releases.
+        */
        t = getenv("CTDB_TEST_MODE");
        if (t == NULL) {
                return;
@@ -196,11 +202,14 @@ char *path_config(TALLOC_CTX *mem_ctx)
 
 char *path_socket(TALLOC_CTX *mem_ctx, const char *daemon)
 {
-       if (strcmp(daemon, "ctdbd") == 0) {
-               const char *t = getenv("CTDB_SOCKET");
+       path_set_test_mode();
+       if (ctdb_paths.test_mode) {
+               if (strcmp(daemon, "ctdbd") == 0) {
+                       const char *t = getenv("CTDB_SOCKET");
 
-               if (t != NULL) {
-                       return talloc_strdup(mem_ctx, t);
+                       if (t != NULL) {
+                               return talloc_strdup(mem_ctx, t);
+                       }
                }
        }
 

diff --git a/ctdb/server/ctdbd.c b/ctdb/server/ctdbd.c
index 0c55ef50b0eb4f006e149307eb45a90408d341ee..d4cfe341275bf9b2a89671a1270279da4906bdf6 100644 (file)
--- a/ctdb/server/ctdbd.c
+++ b/ctdb/server/ctdbd.c
@@ -241,6 +241,13 @@ int main(int argc, const char *argv[])
         * Logging setup/options
         */
 
+
+       /*
+        * Do not use CTDB_TEST_MODE outside a test environment to
+        * attempt to (for example) improve installation flexibility.
+        * This is unsupported, may cause unwanted security issues and
+        * may break in future releases.
+        */
        test_mode = getenv("CTDB_TEST_MODE");
 
        /* Log to stderr (ignoring configuration) when running as interactive */

diff --git a/ctdb/tests/README b/ctdb/tests/README
index 80f3311b684561ed5a4060be45ee0ea5993b041c..8a243c21703680b0ceb41a7c8e944b7a2efbdff8 100644 (file)
--- a/ctdb/tests/README
+++ b/ctdb/tests/README
@@ -98,7 +98,7 @@ Test and debugging variable options
           PID file relative to CTDB_BASE.
 
           When testing with multiple local daemons on a single
-          machine this does 3 extra things:
+          machine this does some extra things:
 
           * Disables checks related to public IP addresses
 
@@ -107,6 +107,14 @@ Test and debugging variable options
 
           * Disables real-time scheduling
 
+          * Allows the CTDB_SOCKET environment variable to be used to
+            specify ctdbd's Unix domain socket location.
+
+          Do not use this variable outside a test environment to
+          attempt to (for example) improve installation flexibility.
+          This is unsupported, may cause unwanted security issues and
+          may break in future releases.
+
        CTDB_DEBUG_HUNG_SCRIPT_LOGFILE=FILENAME
           FILENAME specifies where log messages should go when
           debugging hung eventscripts. This is a testing option. See

diff --git a/selftest/target/Samba.pm b/selftest/target/Samba.pm
index 15d7692b5d64772affab789aee5ab15ad0f9c130..b5eee9a18ddd8da766b87c3e4bfe70b8b2d95a54 100644 (file)
--- a/selftest/target/Samba.pm
+++ b/selftest/target/Samba.pm
@@ -1017,6 +1017,7 @@ my @exported_envvars = (
        "RESOLV_WRAPPER_HOSTS",
 
        # ctdb stuff
+       "CTDB_TEST_MODE",
        "CTDB_PREFIX",
        "NUM_NODES",
        "CTDB_BASE",

diff --git a/selftest/target/Samba3.pm b/selftest/target/Samba3.pm
index 8906608bc1f5a1cba3057142f3714747aabb24cc..60f7a9a546a00a3aab21a5993ec63747f80bbbc7 100755 (executable)
--- a/selftest/target/Samba3.pm
+++ b/selftest/target/Samba3.pm
@@ -4328,6 +4328,7 @@ sub provision_ctdb($$$$)
                $ret{"CTDB_IFACE_IP_NODE${i}"} = $ip;
        }
 
+       $ret{CTDB_TEST_MODE} = "yes";
        $ret{CTDB_BASE} = $ret{CTDB_BASE_NODE0};
        $ret{CTDB_SOCKET} = $ret{CTDB_SOCKET_NODE0};
        $ret{CTDB_SERVER_NAME} = $ret{CTDB_SERVER_NAME_NODE0};