scheduler/process.c

   1 /*
   2  * "$Id: process.c 7256 2008-01-25 00:48:54Z mike $"
   3  *
   4  *   Process management routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 2007-2009 by Apple Inc.
   7  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
   8  *
   9  *   These coded instructions, statements, and computer programs are the
  10  *   property of Apple Inc. and are protected by Federal copyright
  11  *   law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  12  *   which should have been included with this file.  If this file is
  13  *   file is missing or damaged, see the license at "http://www.cups.org/".
  14  *
  15  * Contents:
  16  *
  17  *   cupsdCreateProfile()  - Create an execution profile for a subprocess.
  18  *   cupsdDestroyProfile() - Delete an execution profile.
  19  *   cupsdEndProcess()     - End a process.
  20  *   cupsdFinishProcess()  - Finish a process and get its name.
  21  *   cupsdStartProcess()   - Start a process.
  22  *   compare_procs()       - Compare two processes.
  23  *   cupsd_requote()       - Make a regular-expression version of a string.
  24  */
  25
  26 /*
  27  * Include necessary headers...
  28  */
  29
  30 #include "cupsd.h"
  31 #include <grp.h>
  32 #ifdef __APPLE__
  33 #  include <libgen.h>
  34 #endif /* __APPLE__ */
  35 #ifdef HAVE_SANDBOX_H
  36 #  define __APPLE_API_PRIVATE
  37 #  include <sandbox.h>
  38 #endif /* HAVE_SANDBOX_H */
  39
  40
  41 /*
  42  * Process structure...
  43  */
  44
  45 typedef struct
  46 {
  47   int   pid,                            /* Process ID */
  48         job_id;                         /* Job associated with process */
  49   char  name[1];                        /* Name of process */
  50 } cupsd_proc_t;
  51
  52
  53 /*
  54  * Local globals...
  55  */
  56
  57 static cups_array_t     *process_array = NULL;
  58
  59
  60 /*
  61  * Local functions...
  62  */
  63
  64 static int      compare_procs(cupsd_proc_t *a, cupsd_proc_t *b);
  65 #ifdef HAVE_SANDBOX_H
  66 static char     *cupsd_requote(char *dst, const char *src, size_t dstsize);
  67 #endif /* HAVE_SANDBOX_H */
  68
  69
  70 /*
  71  * 'cupsdCreateProfile()' - Create an execution profile for a subprocess.
  72  */
  73
  74 void *                                  /* O - Profile or NULL on error */
  75 cupsdCreateProfile(int job_id)          /* I - Job ID or 0 for none */
  76 {
  77 #ifdef HAVE_SANDBOX_H
  78   cups_file_t   *fp;                    /* File pointer */
  79   char          profile[1024],          /* File containing the profile */
  80                 cache[1024],            /* Quoted CacheDir */
  81                 request[1024],          /* Quoted RequestRoot */
  82                 root[1024],             /* Quoted ServerRoot */
  83                 temp[1024];             /* Quoted TempDir */
  84
  85
  86   if (!UseProfiles || RunUser)
  87   {
  88    /*
  89     * Only use sandbox profiles as root...
  90     */
  91
  92     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
  93                     job_id);
  94
  95     return (NULL);
  96   }
  97
  98   if ((fp = cupsTempFile2(profile, sizeof(profile))) == NULL)
  99   {
 100     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 101                     job_id);
 102     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to create security profile: %s",
 103                     strerror(errno));
 104     return (NULL);
 105   }
 106
 107   cupsd_requote(cache, CacheDir, sizeof(cache));
 108   cupsd_requote(request, RequestRoot, sizeof(request));
 109   cupsd_requote(root, ServerRoot, sizeof(root));
 110   cupsd_requote(temp, TempDir, sizeof(temp));
 111
 112   cupsFilePuts(fp, "(version 1)\n");
 113   cupsFilePuts(fp, "(debug deny)\n");
 114   cupsFilePuts(fp, "(allow default)\n");
 115   cupsFilePrintf(fp,
 116                  "(deny file-write* file-read-data file-read-metadata\n"
 117                  "  (regex #\"^%s/\"))\n", request);
 118   cupsFilePrintf(fp,
 119                  "(deny file-write*\n"
 120                  "  (regex #\"^%s\" #\"^/private/etc\" #\"^/usr/local/etc\" "
 121                  "#\"^/Library\" #\"^/System\" #\"^/Users\"))\n", root);
 122   cupsFilePrintf(fp,
 123                  "(allow file-write* file-read-data file-read-metadata\n"
 124                  "  (regex #\"^%s$\" #\"^%s/\" #\"^%s$\" #\"^%s/\""
 125                  " #\"^/Library/Application Support/\""
 126                  " #\"^/Library/Caches/\""
 127                  " #\"^/Library/Preferences/\""
 128                  " #\"^/Library/Printers/\""
 129                  "))\n",
 130                  temp, temp, cache, cache);
 131   cupsFilePuts(fp,
 132                "(deny file-write*\n"
 133                "  (regex #\"^/Library/Printers/PPDs/\""
 134                " #\"^/Library/Printers/PPD Plugins/\""
 135                "))\n");
 136   if (job_id)
 137     cupsFilePrintf(fp,
 138                    "(allow file-read-data file-read-metadata\n"
 139                    "  (regex #\"^%s/([ac]%05d|d%05d-[0-9][0-9][0-9])$\"))\n",
 140                    request, job_id, job_id);
 141
 142   cupsFileClose(fp);
 143
 144   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = \"%s\"",
 145                   job_id, profile);
 146   return ((void *)strdup(profile));
 147
 148 #else
 149   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 150                   job_id);
 151
 152   return (NULL);
 153 #endif /* HAVE_SANDBOX_H */
 154 }
 155
 156
 157 /*
 158  * 'cupsdDestroyProfile()' - Delete an execution profile.
 159  */
 160
 161 void
 162 cupsdDestroyProfile(void *profile)      /* I - Profile */
 163 {
 164   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDeleteProfile(profile=\"%s\")",
 165                   profile ? (char *)profile : "(null)");
 166
 167 #ifdef HAVE_SANDBOX_H
 168   if (profile)
 169   {
 170     unlink((char *)profile);
 171     free(profile);
 172   }
 173 #endif /* HAVE_SANDBOX_H */
 174 }
 175
 176
 177 /*
 178  * 'cupsdEndProcess()' - End a process.
 179  */
 180
 181 int                                     /* O - 0 on success, -1 on failure */
 182 cupsdEndProcess(int pid,                /* I - Process ID */
 183                 int force)              /* I - Force child to die */
 184 {
 185   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdEndProcess(pid=%d, force=%d)", pid,
 186                   force);
 187
 188   if (force)
 189     return (kill(pid, SIGKILL));
 190   else
 191     return (kill(pid, SIGTERM));
 192 }
 193
 194
 195 /*
 196  * 'cupsdFinishProcess()' - Finish a process and get its name.
 197  */
 198
 199 const char *                            /* O - Process name */
 200 cupsdFinishProcess(int  pid,            /* I - Process ID */
 201                    char *name,          /* I - Name buffer */
 202                    int  namelen,        /* I - Size of name buffer */
 203                    int  *job_id)        /* O - Job ID pointer or NULL */
 204 {
 205   cupsd_proc_t  key,                    /* Search key */
 206                 *proc;                  /* Matching process */
 207
 208
 209   key.pid = pid;
 210
 211   if ((proc = (cupsd_proc_t *)cupsArrayFind(process_array, &key)) != NULL)
 212   {
 213     if (job_id)
 214       *job_id = proc->job_id;
 215
 216     strlcpy(name, proc->name, namelen);
 217     cupsArrayRemove(process_array, proc);
 218     free(proc);
 219   }
 220   else
 221   {
 222     if (job_id)
 223       *job_id = 0;
 224
 225     strlcpy(name, "unknown", namelen);
 226   }
 227
 228   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 229                   "cupsdFinishProcess(pid=%d, name=%p, namelen=%d, "
 230                   "job_id=%p(%d)) = \"%s\"", pid, name, namelen, job_id,
 231                   job_id ? *job_id : 0, name);
 232
 233   return (name);
 234 }
 235
 236
 237 /*
 238  * 'cupsdStartProcess()' - Start a process.
 239  */
 240
 241 int                                     /* O - Process ID or 0 */
 242 cupsdStartProcess(
 243     const char  *command,               /* I - Full path to command */
 244     char        *argv[],                /* I - Command-line arguments */
 245     char        *envp[],                /* I - Environment */
 246     int         infd,                   /* I - Standard input file descriptor */
 247     int         outfd,                  /* I - Standard output file descriptor */
 248     int         errfd,                  /* I - Standard error file descriptor */
 249     int         backfd,                 /* I - Backchannel file descriptor */
 250     int         sidefd,                 /* I - Sidechannel file descriptor */
 251     int         root,                   /* I - Run as root? */
 252     void        *profile,               /* I - Security profile to use */
 253     cupsd_job_t *job,                   /* I - Job associated with process */
 254     int         *pid)                   /* O - Process ID */
 255 {
 256   int           user;                   /* Command UID */
 257   struct stat   commandinfo;            /* Command file information */
 258   cupsd_proc_t  *proc;                  /* New process record */
 259 #if defined(HAVE_SIGACTION) && !defined(HAVE_SIGSET)
 260   struct sigaction action;              /* POSIX signal handler */
 261 #endif /* HAVE_SIGACTION && !HAVE_SIGSET */
 262 #if defined(__APPLE__)
 263   char          processPath[1024],      /* CFProcessPath environment variable */
 264                 linkpath[1024];         /* Link path for symlinks... */
 265   int           linkbytes;              /* Bytes for link path */
 266 #endif /* __APPLE__ */
 267
 268
 269   if (RunUser)
 270     user = RunUser;
 271   else if (root)
 272     user = 0;
 273   else
 274     user = User;
 275
 276   if (stat(command, &commandinfo))
 277   {
 278     *pid = 0;
 279
 280     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 281                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 282                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 283                     "profile=%p, job=%p(%d), pid=%p) = %d",
 284                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 285                     root, profile, job, job ? job->id : 0, pid, *pid);
 286     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to execute %s: %s", command,
 287                     strerror(errno));
 288
 289     if (job && job->printer)
 290     {
 291       if (cupsdSetPrinterReasons(job->printer, "+cups-missing-filter-warning"))
 292         cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, job->printer, NULL,
 293                       "Printer driver %s is missing.", command);
 294     }
 295
 296     return (0);
 297   }
 298   else if ((commandinfo.st_mode & (S_ISUID | S_IWGRP | S_IWOTH)) ||
 299            (!RunUser && commandinfo.st_uid))
 300   {
 301     *pid = 0;
 302
 303     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 304                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 305                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 306                     "profile=%p, job=%p(%d), pid=%p) = %d",
 307                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 308                     root, profile, job, job ? job->id : 0, pid, *pid);
 309     cupsdLogMessage(CUPSD_LOG_ERROR,
 310                     "Unable to execute %s: insecure file permissions (0%o)",
 311                     command, commandinfo.st_mode);
 312
 313     if (job && job->printer)
 314     {
 315       if (cupsdSetPrinterReasons(job->printer, "+cups-insecure-filter-warning"))
 316         cupsdAddEvent(CUPSD_EVENT_PRINTER_STATE, job->printer, NULL,
 317                       "Printer driver %s has insecure file permissions (0%o).",
 318                       command, commandinfo.st_mode);
 319     }
 320
 321     errno = EPERM;
 322
 323     return (0);
 324   }
 325   else if ((commandinfo.st_uid != user || !(commandinfo.st_mode & S_IXUSR)) &&
 326            (commandinfo.st_gid != Group || !(commandinfo.st_mode & S_IXGRP)) &&
 327            !(commandinfo.st_mode & S_IXOTH))
 328   {
 329     *pid = 0;
 330
 331     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 332                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 333                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 334                     "profile=%p, job=%p(%d), pid=%p) = %d",
 335                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 336                     root, profile, job, job ? job->id : 0, pid, *pid);
 337     cupsdLogMessage(CUPSD_LOG_ERROR,
 338                     "Unable to execute %s: no execute permissions (0%o)",
 339                     command, commandinfo.st_mode);
 340
 341     errno = EPERM;
 342     return (0);
 343   }
 344
 345 #if defined(__APPLE__)
 346   if (envp)
 347   {
 348    /*
 349     * Add special voodoo magic for MacOS X - this allows MacOS X
 350     * programs to access their bundle resources properly...
 351     */
 352
 353     if ((linkbytes = readlink(command, linkpath, sizeof(linkpath) - 1)) > 0)
 354     {
 355      /*
 356       * Yes, this is a symlink to the actual program, nul-terminate and
 357       * use it...
 358       */
 359
 360       linkpath[linkbytes] = '\0';
 361
 362       if (linkpath[0] == '/')
 363         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s",
 364                  linkpath);
 365       else
 366         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s/%s",
 367                  dirname((char *)command), linkpath);
 368     }
 369     else
 370       snprintf(processPath, sizeof(processPath), "CFProcessPath=%s", command);
 371
 372     envp[0] = processPath;              /* Replace <CFProcessPath> string */
 373   }
 374 #endif  /* __APPLE__ */
 375
 376  /*
 377   * Block signals before forking...
 378   */
 379
 380   cupsdHoldSignals();
 381
 382   if ((*pid = fork()) == 0)
 383   {
 384    /*
 385     * Child process goes here...
 386     *
 387     * Update stdin/stdout/stderr as needed...
 388     */
 389
 390     if (infd != 0)
 391     {
 392       if (infd < 0)
 393         infd = open("/dev/null", O_RDONLY);
 394
 395       if (infd != 0)
 396       {
 397         dup2(infd, 0);
 398         close(infd);
 399       }
 400     }
 401
 402     if (outfd != 1)
 403     {
 404       if (outfd < 0)
 405         outfd = open("/dev/null", O_WRONLY);
 406
 407       if (outfd != 1)
 408       {
 409         dup2(outfd, 1);
 410         close(outfd);
 411       }
 412     }
 413
 414     if (errfd != 2)
 415     {
 416       if (errfd < 0)
 417         errfd = open("/dev/null", O_WRONLY);
 418
 419       if (errfd != 2)
 420       {
 421         dup2(errfd, 2);
 422         close(errfd);
 423       }
 424     }
 425
 426     if (backfd != 3 && backfd >= 0)
 427     {
 428       dup2(backfd, 3);
 429       close(backfd);
 430       fcntl(3, F_SETFL, O_NDELAY);
 431     }
 432
 433     if (sidefd != 4 && sidefd >= 0)
 434     {
 435       dup2(sidefd, 4);
 436       close(sidefd);
 437       fcntl(4, F_SETFL, O_NDELAY);
 438     }
 439
 440    /*
 441     * Change the priority of the process based on the FilterNice setting.
 442     * (this is not done for root processes...)
 443     */
 444
 445     if (!root)
 446       nice(FilterNice);
 447
 448 #ifdef HAVE_SANDBOX_H
 449    /*
 450     * Run in a separate security profile...
 451     */
 452
 453     if (profile)
 454     {
 455       char *error = NULL;               /* Sandbox error, if any */
 456
 457       if (sandbox_init((char *)profile, SANDBOX_NAMED_EXTERNAL, &error))
 458       {
 459         fprintf(stderr, "ERROR: sandbox_init failed: %s (%s)\n", error,
 460                 strerror(errno));
 461         sandbox_free_error(error);
 462       }
 463     }
 464 #endif /* HAVE_SANDBOX_H */
 465
 466    /*
 467     * Change user to something "safe"...
 468     */
 469
 470     if (!root && !RunUser)
 471     {
 472      /*
 473       * Running as root, so change to non-priviledged user...
 474       */
 475
 476       if (setgid(Group))
 477         exit(errno);
 478
 479       if (setgroups(1, &Group))
 480         exit(errno);
 481
 482       if (setuid(User))
 483         exit(errno);
 484     }
 485     else
 486     {
 487      /*
 488       * Reset group membership to just the main one we belong to.
 489       */
 490
 491       setgid(Group);
 492       setgroups(1, &Group);
 493     }
 494
 495    /*
 496     * Change umask to restrict permissions on created files...
 497     */
 498
 499     umask(077);
 500
 501    /*
 502     * Unblock signals before doing the exec...
 503     */
 504
 505 #ifdef HAVE_SIGSET
 506     sigset(SIGTERM, SIG_DFL);
 507     sigset(SIGCHLD, SIG_DFL);
 508 #elif defined(HAVE_SIGACTION)
 509     memset(&action, 0, sizeof(action));
 510
 511     sigemptyset(&action.sa_mask);
 512     action.sa_handler = SIG_DFL;
 513
 514     sigaction(SIGTERM, &action, NULL);
 515     sigaction(SIGCHLD, &action, NULL);
 516 #else
 517     signal(SIGTERM, SIG_DFL);
 518     signal(SIGCHLD, SIG_DFL);
 519 #endif /* HAVE_SIGSET */
 520
 521     cupsdReleaseSignals();
 522
 523    /*
 524     * Execute the command; if for some reason this doesn't work,
 525     * return the error code...
 526     */
 527
 528     if (envp)
 529       execve(command, argv, envp);
 530     else
 531       execv(command, argv);
 532
 533     perror(command);
 534
 535     exit(errno);
 536   }
 537   else if (*pid < 0)
 538   {
 539    /*
 540     * Error - couldn't fork a new process!
 541     */
 542
 543     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to fork %s - %s.", command,
 544                     strerror(errno));
 545
 546     *pid = 0;
 547   }
 548   else
 549   {
 550     if (!process_array)
 551       process_array = cupsArrayNew((cups_array_func_t)compare_procs, NULL);
 552
 553     if (process_array)
 554     {
 555       if ((proc = calloc(1, sizeof(cupsd_proc_t) + strlen(command))) != NULL)
 556       {
 557         proc->pid    = *pid;
 558         proc->job_id = job ? job->id : 0;
 559         strcpy(proc->name, command);
 560
 561         cupsArrayAdd(process_array, proc);
 562       }
 563     }
 564   }
 565
 566   cupsdReleaseSignals();
 567
 568   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 569                   "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 570                   "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 571                   "profile=%p, job=%p(%d), pid=%p) = %d",
 572                   command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 573                   root, profile, job, job ? job->id : 0, pid, *pid);
 574
 575   return (*pid);
 576 }
 577
 578
 579 /*
 580  * 'compare_procs()' - Compare two processes.
 581  */
 582
 583 static int                              /* O - Result of comparison */
 584 compare_procs(cupsd_proc_t *a,          /* I - First process */
 585               cupsd_proc_t *b)          /* I - Second process */
 586 {
 587   return (a->pid - b->pid);
 588 }
 589
 590
 591 #ifdef HAVE_SANDBOX_H
 592 /*
 593  * 'cupsd_requote()' - Make a regular-expression version of a string.
 594  */
 595
 596 static char *                           /* O - Quoted string */
 597 cupsd_requote(char       *dst,          /* I - Destination buffer */
 598               const char *src,          /* I - Source string */
 599               size_t     dstsize)       /* I - Size of destination buffer */
 600 {
 601   int   ch;                             /* Current character */
 602   char  *dstptr,                        /* Current position in buffer */
 603         *dstend;                        /* End of destination buffer */
 604
 605
 606   dstptr = dst;
 607   dstend = dst + dstsize - 2;
 608
 609   while (*src && dstptr < dstend)
 610   {
 611     ch = *src++;
 612
 613     if (strchr(".?*()[]^$\\", ch))
 614       *dstptr++ = '\\';
 615
 616     *dstptr++ = ch;
 617   }
 618
 619   *dstptr = '\0';
 620
 621   return (dst);
 622 }
 623 #endif /* HAVE_SANDBOX_H */
 624
 625
 626 /*
 627  * End of "$Id: process.c 7256 2008-01-25 00:48:54Z mike $".
 628  */