scheduler/process.c

   1 /*
   2  * "$Id: process.c 7256 2008-01-25 00:48:54Z mike $"
   3  *
   4  *   Process management routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 2007-2009 by Apple Inc.
   7  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
   8  *
   9  *   These coded instructions, statements, and computer programs are the
  10  *   property of Apple Inc. and are protected by Federal copyright
  11  *   law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  12  *   which should have been included with this file.  If this file is
  13  *   file is missing or damaged, see the license at "http://www.cups.org/".
  14  *
  15  * Contents:
  16  *
  17  *   cupsdCreateProfile()  - Create an execution profile for a subprocess.
  18  *   cupsdDestroyProfile() - Delete an execution profile.
  19  *   cupsdEndProcess()     - End a process.
  20  *   cupsdFinishProcess()  - Finish a process and get its name.
  21  *   cupsdStartProcess()   - Start a process.
  22  *   compare_procs()       - Compare two processes.
  23  *   cupsd_requote()       - Make a regular-expression version of a string.
  24  */
  25
  26 /*
  27  * Include necessary headers...
  28  */
  29
  30 #include "cupsd.h"
  31 #include <grp.h>
  32 #ifdef __APPLE__
  33 #  include <libgen.h>
  34 #endif /* __APPLE__ */
  35 #ifdef HAVE_SANDBOX_H
  36 #  define __APPLE_API_PRIVATE
  37 #  include <sandbox.h>
  38 #endif /* HAVE_SANDBOX_H */
  39
  40
  41 /*
  42  * Process structure...
  43  */
  44
  45 typedef struct
  46 {
  47   int   pid,                            /* Process ID */
  48         job_id;                         /* Job associated with process */
  49   char  name[1];                        /* Name of process */
  50 } cupsd_proc_t;
  51
  52
  53 /*
  54  * Local globals...
  55  */
  56
  57 static cups_array_t     *process_array = NULL;
  58
  59
  60 /*
  61  * Local functions...
  62  */
  63
  64 static int      compare_procs(cupsd_proc_t *a, cupsd_proc_t *b);
  65 #ifdef HAVE_SANDBOX_H
  66 static char     *cupsd_requote(char *dst, const char *src, size_t dstsize);
  67 #endif /* HAVE_SANDBOX_H */
  68
  69
  70 /*
  71  * 'cupsdCreateProfile()' - Create an execution profile for a subprocess.
  72  */
  73
  74 void *                                  /* O - Profile or NULL on error */
  75 cupsdCreateProfile(int job_id)          /* I - Job ID or 0 for none */
  76 {
  77 #ifdef HAVE_SANDBOX_H
  78   cups_file_t   *fp;                    /* File pointer */
  79   char          profile[1024],          /* File containing the profile */
  80                 cache[1024],            /* Quoted CacheDir */
  81                 request[1024],          /* Quoted RequestRoot */
  82                 root[1024],             /* Quoted ServerRoot */
  83                 temp[1024];             /* Quoted TempDir */
  84
  85
  86   if (!UseProfiles || RunUser)
  87   {
  88    /*
  89     * Only use sandbox profiles as root...
  90     */
  91
  92     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
  93                     job_id);
  94
  95     return (NULL);
  96   }
  97
  98   if ((fp = cupsTempFile2(profile, sizeof(profile))) == NULL)
  99   {
 100     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 101                     job_id);
 102     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to create security profile: %s",
 103                     strerror(errno));
 104     return (NULL);
 105   }
 106
 107   cupsd_requote(cache, CacheDir, sizeof(cache));
 108   cupsd_requote(request, RequestRoot, sizeof(request));
 109   cupsd_requote(root, ServerRoot, sizeof(root));
 110   cupsd_requote(temp, TempDir, sizeof(temp));
 111
 112   cupsFilePuts(fp, "(version 1)\n");
 113   cupsFilePuts(fp, "(debug deny)\n");
 114   cupsFilePuts(fp, "(allow default)\n");
 115   cupsFilePrintf(fp,
 116                  "(deny file-write* file-read-data file-read-metadata\n"
 117                  "  (regex #\"^%s/\"))\n", request);
 118   cupsFilePrintf(fp,
 119                  "(deny file-write*\n"
 120                  "  (regex #\"^%s\" #\"^/private/etc\" #\"^/usr/local/etc\" "
 121                  "#\"^/Library\" #\"^/System\" #\"^/Users\"))\n", root);
 122   cupsFilePrintf(fp,
 123                  "(allow file-write* file-read-data file-read-metadata\n"
 124                  "  (regex #\"^%s$\" #\"^%s/\" #\"^%s$\" #\"^%s/\""
 125                  " #\"^/Library/Application Support/\""
 126                  " #\"^/Library/Caches/\""
 127                  " #\"^/Library/Preferences/\""
 128                  " #\"^/Library/Printers/\""
 129                  "))\n",
 130                  temp, temp, cache, cache);
 131   cupsFilePuts(fp,
 132                "(deny file-write*\n"
 133                "  (regex #\"^/Library/Printers/PPDs/\""
 134                " #\"^/Library/Printers/PPD Plugins/\""
 135                "))\n");
 136   if (job_id)
 137     cupsFilePrintf(fp,
 138                    "(allow file-read-data file-read-metadata\n"
 139                    "  (regex #\"^%s/([ac]%05d|d%05d-[0-9][0-9][0-9])$\"))\n",
 140                    request, job_id, job_id);
 141
 142   cupsFileClose(fp);
 143
 144   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = \"%s\"",
 145                   job_id, profile);
 146   return ((void *)strdup(profile));
 147
 148 #else
 149   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 150                   job_id);
 151
 152   return (NULL);
 153 #endif /* HAVE_SANDBOX_H */
 154 }
 155
 156
 157 /*
 158  * 'cupsdDestroyProfile()' - Delete an execution profile.
 159  */
 160
 161 void
 162 cupsdDestroyProfile(void *profile)      /* I - Profile */
 163 {
 164   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDeleteProfile(profile=\"%s\")",
 165                   profile ? (char *)profile : "(null)");
 166
 167 #ifdef HAVE_SANDBOX_H
 168   if (profile)
 169   {
 170     unlink((char *)profile);
 171     free(profile);
 172   }
 173 #endif /* HAVE_SANDBOX_H */
 174 }
 175
 176
 177 /*
 178  * 'cupsdEndProcess()' - End a process.
 179  */
 180
 181 int                                     /* O - 0 on success, -1 on failure */
 182 cupsdEndProcess(int pid,                /* I - Process ID */
 183                 int force)              /* I - Force child to die */
 184 {
 185   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdEndProcess(pid=%d, force=%d)", pid,
 186                   force);
 187
 188   if (!pid)
 189     return (0);
 190   else if (force)
 191     return (kill(pid, SIGKILL));
 192   else
 193     return (kill(pid, SIGTERM));
 194 }
 195
 196
 197 /*
 198  * 'cupsdFinishProcess()' - Finish a process and get its name.
 199  */
 200
 201 const char *                            /* O - Process name */
 202 cupsdFinishProcess(int  pid,            /* I - Process ID */
 203                    char *name,          /* I - Name buffer */
 204                    int  namelen,        /* I - Size of name buffer */
 205                    int  *job_id)        /* O - Job ID pointer or NULL */
 206 {
 207   cupsd_proc_t  key,                    /* Search key */
 208                 *proc;                  /* Matching process */
 209
 210
 211   key.pid = pid;
 212
 213   if ((proc = (cupsd_proc_t *)cupsArrayFind(process_array, &key)) != NULL)
 214   {
 215     if (job_id)
 216       *job_id = proc->job_id;
 217
 218     strlcpy(name, proc->name, namelen);
 219     cupsArrayRemove(process_array, proc);
 220     free(proc);
 221   }
 222   else
 223   {
 224     if (job_id)
 225       *job_id = 0;
 226
 227     strlcpy(name, "unknown", namelen);
 228   }
 229
 230   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 231                   "cupsdFinishProcess(pid=%d, name=%p, namelen=%d, "
 232                   "job_id=%p(%d)) = \"%s\"", pid, name, namelen, job_id,
 233                   job_id ? *job_id : 0, name);
 234
 235   return (name);
 236 }
 237
 238
 239 /*
 240  * 'cupsdStartProcess()' - Start a process.
 241  */
 242
 243 int                                     /* O - Process ID or 0 */
 244 cupsdStartProcess(
 245     const char  *command,               /* I - Full path to command */
 246     char        *argv[],                /* I - Command-line arguments */
 247     char        *envp[],                /* I - Environment */
 248     int         infd,                   /* I - Standard input file descriptor */
 249     int         outfd,                  /* I - Standard output file descriptor */
 250     int         errfd,                  /* I - Standard error file descriptor */
 251     int         backfd,                 /* I - Backchannel file descriptor */
 252     int         sidefd,                 /* I - Sidechannel file descriptor */
 253     int         root,                   /* I - Run as root? */
 254     void        *profile,               /* I - Security profile to use */
 255     cupsd_job_t *job,                   /* I - Job associated with process */
 256     int         *pid)                   /* O - Process ID */
 257 {
 258   int           user;                   /* Command UID */
 259   struct stat   commandinfo;            /* Command file information */
 260   cupsd_proc_t  *proc;                  /* New process record */
 261 #if defined(HAVE_SIGACTION) && !defined(HAVE_SIGSET)
 262   struct sigaction action;              /* POSIX signal handler */
 263 #endif /* HAVE_SIGACTION && !HAVE_SIGSET */
 264 #if defined(__APPLE__)
 265   char          processPath[1024],      /* CFProcessPath environment variable */
 266                 linkpath[1024];         /* Link path for symlinks... */
 267   int           linkbytes;              /* Bytes for link path */
 268 #endif /* __APPLE__ */
 269
 270
 271   if (RunUser)
 272     user = RunUser;
 273   else if (root)
 274     user = 0;
 275   else
 276     user = User;
 277
 278   if (stat(command, &commandinfo))
 279   {
 280     *pid = 0;
 281
 282     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 283                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 284                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 285                     "profile=%p, job=%p(%d), pid=%p) = %d",
 286                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 287                     root, profile, job, job ? job->id : 0, pid, *pid);
 288     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to execute %s: %s", command,
 289                     strerror(errno));
 290
 291     if (job && job->printer)
 292     {
 293       if (cupsdSetPrinterReasons(job->printer, "+cups-missing-filter-warning"))
 294         cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, job->printer, NULL,
 295                       "Printer driver %s is missing.", command);
 296     }
 297
 298     return (0);
 299   }
 300   else if (!RunUser &&
 301            ((commandinfo.st_mode & (S_ISUID | S_IWGRP | S_IWOTH)) ||
 302             commandinfo.st_uid))
 303   {
 304     *pid = 0;
 305
 306     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 307                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 308                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 309                     "profile=%p, job=%p(%d), pid=%p) = %d",
 310                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 311                     root, profile, job, job ? job->id : 0, pid, *pid);
 312     cupsdLogMessage(CUPSD_LOG_ERROR,
 313                     "Unable to execute %s: insecure file permissions (0%o)",
 314                     command, commandinfo.st_mode);
 315
 316     if (job && job->printer)
 317     {
 318       if (cupsdSetPrinterReasons(job->printer, "+cups-insecure-filter-warning"))
 319         cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, job->printer, NULL,
 320                       "Printer driver %s has insecure file permissions (0%o).",
 321                       command, commandinfo.st_mode);
 322     }
 323
 324     errno = EPERM;
 325
 326     return (0);
 327   }
 328   else if ((commandinfo.st_uid != user || !(commandinfo.st_mode & S_IXUSR)) &&
 329            (commandinfo.st_gid != Group || !(commandinfo.st_mode & S_IXGRP)) &&
 330            !(commandinfo.st_mode & S_IXOTH))
 331   {
 332     *pid = 0;
 333
 334     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 335                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 336                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 337                     "profile=%p, job=%p(%d), pid=%p) = %d",
 338                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 339                     root, profile, job, job ? job->id : 0, pid, *pid);
 340     cupsdLogMessage(CUPSD_LOG_ERROR,
 341                     "Unable to execute %s: no execute permissions (0%o)",
 342                     command, commandinfo.st_mode);
 343
 344     errno = EPERM;
 345     return (0);
 346   }
 347
 348 #if defined(__APPLE__)
 349   if (envp)
 350   {
 351    /*
 352     * Add special voodoo magic for MacOS X - this allows MacOS X
 353     * programs to access their bundle resources properly...
 354     */
 355
 356     if ((linkbytes = readlink(command, linkpath, sizeof(linkpath) - 1)) > 0)
 357     {
 358      /*
 359       * Yes, this is a symlink to the actual program, nul-terminate and
 360       * use it...
 361       */
 362
 363       linkpath[linkbytes] = '\0';
 364
 365       if (linkpath[0] == '/')
 366         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s",
 367                  linkpath);
 368       else
 369         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s/%s",
 370                  dirname((char *)command), linkpath);
 371     }
 372     else
 373       snprintf(processPath, sizeof(processPath), "CFProcessPath=%s", command);
 374
 375     envp[0] = processPath;              /* Replace <CFProcessPath> string */
 376   }
 377 #endif  /* __APPLE__ */
 378
 379  /*
 380   * Block signals before forking...
 381   */
 382
 383   cupsdHoldSignals();
 384
 385   if ((*pid = fork()) == 0)
 386   {
 387    /*
 388     * Child process goes here...
 389     *
 390     * Update stdin/stdout/stderr as needed...
 391     */
 392
 393     if (infd != 0)
 394     {
 395       if (infd < 0)
 396         infd = open("/dev/null", O_RDONLY);
 397
 398       if (infd != 0)
 399       {
 400         dup2(infd, 0);
 401         close(infd);
 402       }
 403     }
 404
 405     if (outfd != 1)
 406     {
 407       if (outfd < 0)
 408         outfd = open("/dev/null", O_WRONLY);
 409
 410       if (outfd != 1)
 411       {
 412         dup2(outfd, 1);
 413         close(outfd);
 414       }
 415     }
 416
 417     if (errfd != 2)
 418     {
 419       if (errfd < 0)
 420         errfd = open("/dev/null", O_WRONLY);
 421
 422       if (errfd != 2)
 423       {
 424         dup2(errfd, 2);
 425         close(errfd);
 426       }
 427     }
 428
 429     if (backfd != 3 && backfd >= 0)
 430     {
 431       dup2(backfd, 3);
 432       close(backfd);
 433       fcntl(3, F_SETFL, O_NDELAY);
 434     }
 435
 436     if (sidefd != 4 && sidefd >= 0)
 437     {
 438       dup2(sidefd, 4);
 439       close(sidefd);
 440       fcntl(4, F_SETFL, O_NDELAY);
 441     }
 442
 443    /*
 444     * Change the priority of the process based on the FilterNice setting.
 445     * (this is not done for root processes...)
 446     */
 447
 448     if (!root)
 449       nice(FilterNice);
 450
 451 #ifdef HAVE_SANDBOX_H
 452    /*
 453     * Run in a separate security profile...
 454     */
 455
 456     if (profile)
 457     {
 458       char *error = NULL;               /* Sandbox error, if any */
 459
 460       if (sandbox_init((char *)profile, SANDBOX_NAMED_EXTERNAL, &error))
 461       {
 462         fprintf(stderr, "ERROR: sandbox_init failed: %s (%s)\n", error,
 463                 strerror(errno));
 464         sandbox_free_error(error);
 465       }
 466     }
 467 #endif /* HAVE_SANDBOX_H */
 468
 469    /*
 470     * Change user to something "safe"...
 471     */
 472
 473     if (!root && !RunUser)
 474     {
 475      /*
 476       * Running as root, so change to non-priviledged user...
 477       */
 478
 479       if (setgid(Group))
 480         exit(errno);
 481
 482       if (setgroups(1, &Group))
 483         exit(errno);
 484
 485       if (setuid(User))
 486         exit(errno);
 487     }
 488     else
 489     {
 490      /*
 491       * Reset group membership to just the main one we belong to.
 492       */
 493
 494       if (setgid(Group) && !RunUser)
 495         exit(errno);
 496
 497       if (setgroups(1, &Group) && !RunUser)
 498         exit(errno);
 499     }
 500
 501    /*
 502     * Change umask to restrict permissions on created files...
 503     */
 504
 505     umask(077);
 506
 507    /*
 508     * Unblock signals before doing the exec...
 509     */
 510
 511 #ifdef HAVE_SIGSET
 512     sigset(SIGTERM, SIG_DFL);
 513     sigset(SIGCHLD, SIG_DFL);
 514     sigset(SIGPIPE, SIG_DFL);
 515 #elif defined(HAVE_SIGACTION)
 516     memset(&action, 0, sizeof(action));
 517
 518     sigemptyset(&action.sa_mask);
 519     action.sa_handler = SIG_DFL;
 520
 521     sigaction(SIGTERM, &action, NULL);
 522     sigaction(SIGCHLD, &action, NULL);
 523     sigaction(SIGPIPE, &action, NULL);
 524 #else
 525     signal(SIGTERM, SIG_DFL);
 526     signal(SIGCHLD, SIG_DFL);
 527     signal(SIGPIPE, SIG_DFL);
 528 #endif /* HAVE_SIGSET */
 529
 530     cupsdReleaseSignals();
 531
 532    /*
 533     * Execute the command; if for some reason this doesn't work,
 534     * return the error code...
 535     */
 536
 537     if (envp)
 538       execve(command, argv, envp);
 539     else
 540       execv(command, argv);
 541
 542     perror(command);
 543
 544     exit(errno);
 545   }
 546   else if (*pid < 0)
 547   {
 548    /*
 549     * Error - couldn't fork a new process!
 550     */
 551
 552     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to fork %s - %s.", command,
 553                     strerror(errno));
 554
 555     *pid = 0;
 556   }
 557   else
 558   {
 559     if (!process_array)
 560       process_array = cupsArrayNew((cups_array_func_t)compare_procs, NULL);
 561
 562     if (process_array)
 563     {
 564       if ((proc = calloc(1, sizeof(cupsd_proc_t) + strlen(command))) != NULL)
 565       {
 566         proc->pid    = *pid;
 567         proc->job_id = job ? job->id : 0;
 568         strcpy(proc->name, command);
 569
 570         cupsArrayAdd(process_array, proc);
 571       }
 572     }
 573   }
 574
 575   cupsdReleaseSignals();
 576
 577   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 578                   "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 579                   "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 580                   "profile=%p, job=%p(%d), pid=%p) = %d",
 581                   command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 582                   root, profile, job, job ? job->id : 0, pid, *pid);
 583
 584   return (*pid);
 585 }
 586
 587
 588 /*
 589  * 'compare_procs()' - Compare two processes.
 590  */
 591
 592 static int                              /* O - Result of comparison */
 593 compare_procs(cupsd_proc_t *a,          /* I - First process */
 594               cupsd_proc_t *b)          /* I - Second process */
 595 {
 596   return (a->pid - b->pid);
 597 }
 598
 599
 600 #ifdef HAVE_SANDBOX_H
 601 /*
 602  * 'cupsd_requote()' - Make a regular-expression version of a string.
 603  */
 604
 605 static char *                           /* O - Quoted string */
 606 cupsd_requote(char       *dst,          /* I - Destination buffer */
 607               const char *src,          /* I - Source string */
 608               size_t     dstsize)       /* I - Size of destination buffer */
 609 {
 610   int   ch;                             /* Current character */
 611   char  *dstptr,                        /* Current position in buffer */
 612         *dstend;                        /* End of destination buffer */
 613
 614
 615   dstptr = dst;
 616   dstend = dst + dstsize - 2;
 617
 618   while (*src && dstptr < dstend)
 619   {
 620     ch = *src++;
 621
 622     if (strchr(".?*()[]^$\\", ch))
 623       *dstptr++ = '\\';
 624
 625     *dstptr++ = ch;
 626   }
 627
 628   *dstptr = '\0';
 629
 630   return (dst);
 631 }
 632 #endif /* HAVE_SANDBOX_H */
 633
 634
 635 /*
 636  * End of "$Id: process.c 7256 2008-01-25 00:48:54Z mike $".
 637  */