scheduler/process.c

   1 /*
   2  * "$Id: process.c 7256 2008-01-25 00:48:54Z mike $"
   3  *
   4  *   Process management routines for the Common UNIX Printing System (CUPS).
   5  *
   6  *   Copyright 2007-2009 by Apple Inc.
   7  *   Copyright 1997-2007 by Easy Software Products, all rights reserved.
   8  *
   9  *   These coded instructions, statements, and computer programs are the
  10  *   property of Apple Inc. and are protected by Federal copyright
  11  *   law.  Distribution and use rights are outlined in the file "LICENSE.txt"
  12  *   which should have been included with this file.  If this file is
  13  *   file is missing or damaged, see the license at "http://www.cups.org/".
  14  *
  15  * Contents:
  16  *
  17  *   cupsdCreateProfile()  - Create an execution profile for a subprocess.
  18  *   cupsdDestroyProfile() - Delete an execution profile.
  19  *   cupsdEndProcess()     - End a process.
  20  *   cupsdFinishProcess()  - Finish a process and get its name.
  21  *   cupsdStartProcess()   - Start a process.
  22  *   compare_procs()       - Compare two processes.
  23  *   cupsd_requote()       - Make a regular-expression version of a string.
  24  */
  25
  26 /*
  27  * Include necessary headers...
  28  */
  29
  30 #include "cupsd.h"
  31 #include <grp.h>
  32 #ifdef __APPLE__
  33 #  include <libgen.h>
  34 #endif /* __APPLE__ */
  35 #ifdef HAVE_SANDBOX_H
  36 #  define __APPLE_API_PRIVATE
  37 #  include <sandbox.h>
  38 #endif /* HAVE_SANDBOX_H */
  39
  40
  41 /*
  42  * Process structure...
  43  */
  44
  45 typedef struct
  46 {
  47   int   pid,                            /* Process ID */
  48         job_id;                         /* Job associated with process */
  49   char  name[1];                        /* Name of process */
  50 } cupsd_proc_t;
  51
  52
  53 /*
  54  * Local globals...
  55  */
  56
  57 static cups_array_t     *process_array = NULL;
  58
  59
  60 /*
  61  * Local functions...
  62  */
  63
  64 static int      compare_procs(cupsd_proc_t *a, cupsd_proc_t *b);
  65 #ifdef HAVE_SANDBOX_H
  66 static char     *cupsd_requote(char *dst, const char *src, size_t dstsize);
  67 #endif /* HAVE_SANDBOX_H */
  68
  69
  70 /*
  71  * 'cupsdCreateProfile()' - Create an execution profile for a subprocess.
  72  */
  73
  74 void *                                  /* O - Profile or NULL on error */
  75 cupsdCreateProfile(int job_id)          /* I - Job ID or 0 for none */
  76 {
  77 #ifdef HAVE_SANDBOX_H
  78   cups_file_t   *fp;                    /* File pointer */
  79   char          profile[1024],          /* File containing the profile */
  80                 cache[1024],            /* Quoted CacheDir */
  81                 request[1024],          /* Quoted RequestRoot */
  82                 root[1024],             /* Quoted ServerRoot */
  83                 temp[1024];             /* Quoted TempDir */
  84
  85
  86   if (RunUser)
  87   {
  88    /*
  89     * Only use sandbox profiles as root...
  90     */
  91
  92     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
  93                     job_id);
  94
  95     return (NULL);
  96   }
  97
  98   if ((fp = cupsTempFile2(profile, sizeof(profile))) == NULL)
  99   {
 100     cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 101                     job_id);
 102     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to create security profile: %s",
 103                     strerror(errno));
 104     return (NULL);
 105   }
 106
 107   cupsd_requote(cache, CacheDir, sizeof(cache));
 108   cupsd_requote(request, RequestRoot, sizeof(request));
 109   cupsd_requote(root, ServerRoot, sizeof(root));
 110   cupsd_requote(temp, TempDir, sizeof(temp));
 111
 112   cupsFilePuts(fp, "(version 1)\n");
 113   cupsFilePuts(fp, "(debug deny)\n");
 114   cupsFilePuts(fp, "(allow default)\n");
 115   cupsFilePrintf(fp,
 116                  "(deny file-write* file-read-data file-read-metadata\n"
 117                  "  (regex #\"^%s/\"))\n", request);
 118   cupsFilePrintf(fp,
 119                  "(deny file-write*\n"
 120                  "  (regex #\"^%s\" #\"^/private/etc\" #\"^/usr/local/etc\" "
 121                  "#\"^/Library\" #\"^/System\" #\"^/Users\"))\n", root);
 122   cupsFilePrintf(fp,
 123                  "(allow file-write* file-read-data file-read-metadata\n"
 124                  "  (regex #\"^%s$\" #\"^%s/\" #\"^%s$\" #\"^%s/\""
 125                  " #\"^/Library/Application Support/\""
 126                  " #\"^/Library/Caches/\""
 127                  " #\"^/Library/Preferences/\""
 128                  " #\"^/Library/Printers/\""
 129                  "))\n",
 130                  temp, temp, cache, cache);
 131   cupsFilePuts(fp,
 132                "(deny file-write*\n"
 133                "  (regex #\"^/Library/Printers/PPDs/\""
 134                " #\"^/Library/Printers/PPD Plugins/\""
 135                "))\n");
 136   if (job_id)
 137     cupsFilePrintf(fp,
 138                    "(allow file-read-data file-read-metadata\n"
 139                    "  (regex #\"^%s/([ac]%05d|d%05d-[0-9][0-9][0-9])$\"))\n",
 140                    request, job_id, job_id);
 141
 142   cupsFileClose(fp);
 143
 144   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = \"%s\"",
 145                   job_id, profile);
 146   return ((void *)strdup(profile));
 147
 148 #else
 149   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdCreateProfile(job_id=%d) = NULL",
 150                   job_id);
 151
 152   return (NULL);
 153 #endif /* HAVE_SANDBOX_H */
 154 }
 155
 156
 157 /*
 158  * 'cupsdDestroyProfile()' - Delete an execution profile.
 159  */
 160
 161 void
 162 cupsdDestroyProfile(void *profile)      /* I - Profile */
 163 {
 164   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdDeleteProfile(profile=\"%s\")",
 165                   profile ? (char *)profile : "(null)");
 166
 167 #ifdef HAVE_SANDBOX_H
 168   if (profile)
 169   {
 170     unlink((char *)profile);
 171     free(profile);
 172   }
 173 #endif /* HAVE_SANDBOX_H */
 174 }
 175
 176
 177 /*
 178  * 'cupsdEndProcess()' - End a process.
 179  */
 180
 181 int                                     /* O - 0 on success, -1 on failure */
 182 cupsdEndProcess(int pid,                /* I - Process ID */
 183                 int force)              /* I - Force child to die */
 184 {
 185   cupsdLogMessage(CUPSD_LOG_DEBUG2, "cupsdEndProcess(pid=%d, force=%d)", pid,
 186                   force);
 187
 188   if (force)
 189     return (kill(pid, SIGKILL));
 190   else
 191     return (kill(pid, SIGTERM));
 192 }
 193
 194
 195 /*
 196  * 'cupsdFinishProcess()' - Finish a process and get its name.
 197  */
 198
 199 const char *                            /* O - Process name */
 200 cupsdFinishProcess(int  pid,            /* I - Process ID */
 201                    char *name,          /* I - Name buffer */
 202                    int  namelen,        /* I - Size of name buffer */
 203                    int  *job_id)        /* O - Job ID pointer or NULL */
 204 {
 205   cupsd_proc_t  key,                    /* Search key */
 206                 *proc;                  /* Matching process */
 207
 208
 209   key.pid = pid;
 210
 211   if ((proc = (cupsd_proc_t *)cupsArrayFind(process_array, &key)) != NULL)
 212   {
 213     if (job_id)
 214       *job_id = proc->job_id;
 215
 216     strlcpy(name, proc->name, namelen);
 217     cupsArrayRemove(process_array, proc);
 218     free(proc);
 219   }
 220   else
 221   {
 222     if (job_id)
 223       *job_id = 0;
 224
 225     strlcpy(name, "unknown", namelen);
 226   }
 227
 228   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 229                   "cupsdFinishProcess(pid=%d, name=%p, namelen=%d, "
 230                   "job_id=%p(%d)) = \"%s\"", pid, name, namelen, job_id,
 231                   job_id ? *job_id : 0, name);
 232
 233   return (name);
 234 }
 235
 236
 237 /*
 238  * 'cupsdStartProcess()' - Start a process.
 239  */
 240
 241 int                                     /* O - Process ID or 0 */
 242 cupsdStartProcess(
 243     const char  *command,               /* I - Full path to command */
 244     char        *argv[],                /* I - Command-line arguments */
 245     char        *envp[],                /* I - Environment */
 246     int         infd,                   /* I - Standard input file descriptor */
 247     int         outfd,                  /* I - Standard output file descriptor */
 248     int         errfd,                  /* I - Standard error file descriptor */
 249     int         backfd,                 /* I - Backchannel file descriptor */
 250     int         sidefd,                 /* I - Sidechannel file descriptor */
 251     int         root,                   /* I - Run as root? */
 252     void        *profile,               /* I - Security profile to use */
 253     int         job_id,                 /* I - Job associated with process */
 254     int         *pid)                   /* O - Process ID */
 255 {
 256   int           user;                   /* Command UID */
 257   struct stat   commandinfo;            /* Command file information */
 258   cupsd_proc_t  *proc;                  /* New process record */
 259 #if defined(HAVE_SIGACTION) && !defined(HAVE_SIGSET)
 260   struct sigaction action;              /* POSIX signal handler */
 261 #endif /* HAVE_SIGACTION && !HAVE_SIGSET */
 262 #if defined(__APPLE__)
 263   char          processPath[1024],      /* CFProcessPath environment variable */
 264                 linkpath[1024];         /* Link path for symlinks... */
 265   int           linkbytes;              /* Bytes for link path */
 266 #endif /* __APPLE__ */
 267
 268
 269   if (RunUser)
 270     user = RunUser;
 271   else if (root)
 272     user = 0;
 273   else
 274     user = User;
 275
 276   if (stat(command, &commandinfo))
 277   {
 278     *pid = 0;
 279
 280     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 281                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 282                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 283                     "profile=%p, job_id=%d, pid=%p) = %d",
 284                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 285                     root, profile, job_id, pid, *pid);
 286     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to execute %s: %s", command,
 287                     strerror(errno));
 288     return (0);
 289   }
 290   else if (commandinfo.st_mode & S_IWOTH)
 291   {
 292     *pid = 0;
 293
 294     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 295                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 296                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 297                     "profile=%p, job_id=%d, pid=%p) = %d",
 298                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 299                     root, profile, job_id, pid, *pid);
 300     cupsdLogMessage(CUPSD_LOG_ERROR,
 301                     "Unable to execute %s: insecure file permissions (0%o)",
 302                     command, commandinfo.st_mode);
 303
 304     errno = EPERM;
 305     return (0);
 306   }
 307   else if ((commandinfo.st_uid != user || !(commandinfo.st_mode & S_IXUSR)) &&
 308            (commandinfo.st_gid != Group || !(commandinfo.st_mode & S_IXGRP)) &&
 309            !(commandinfo.st_mode & S_IXOTH))
 310   {
 311     *pid = 0;
 312
 313     cupsdLogMessage(CUPSD_LOG_DEBUG2,
 314                     "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 315                     "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 316                     "profile=%p, job_id=%d, pid=%p) = %d",
 317                     command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 318                     root, profile, job_id, pid, *pid);
 319     cupsdLogMessage(CUPSD_LOG_ERROR,
 320                     "Unable to execute %s: no execute permissions (0%o)",
 321                     command, commandinfo.st_mode);
 322
 323     errno = EPERM;
 324     return (0);
 325   }
 326
 327 #if defined(__APPLE__)
 328   if (envp)
 329   {
 330    /*
 331     * Add special voodoo magic for MacOS X - this allows MacOS X
 332     * programs to access their bundle resources properly...
 333     */
 334
 335     if ((linkbytes = readlink(command, linkpath, sizeof(linkpath) - 1)) > 0)
 336     {
 337      /*
 338       * Yes, this is a symlink to the actual program, nul-terminate and
 339       * use it...
 340       */
 341
 342       linkpath[linkbytes] = '\0';
 343
 344       if (linkpath[0] == '/')
 345         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s",
 346                  linkpath);
 347       else
 348         snprintf(processPath, sizeof(processPath), "CFProcessPath=%s/%s",
 349                  dirname((char *)command), linkpath);
 350     }
 351     else
 352       snprintf(processPath, sizeof(processPath), "CFProcessPath=%s", command);
 353
 354     envp[0] = processPath;              /* Replace <CFProcessPath> string */
 355   }
 356 #endif  /* __APPLE__ */
 357
 358  /*
 359   * Block signals before forking...
 360   */
 361
 362   cupsdHoldSignals();
 363
 364   if ((*pid = fork()) == 0)
 365   {
 366    /*
 367     * Child process goes here...
 368     *
 369     * Update stdin/stdout/stderr as needed...
 370     */
 371
 372     if (infd != 0)
 373     {
 374       close(0);
 375       if (infd > 0)
 376         dup(infd);
 377       else
 378         open("/dev/null", O_RDONLY);
 379     }
 380     if (outfd != 1)
 381     {
 382       close(1);
 383       if (outfd > 0)
 384         dup(outfd);
 385       else
 386         open("/dev/null", O_WRONLY);
 387     }
 388     if (errfd != 2)
 389     {
 390       close(2);
 391       if (errfd > 0)
 392         dup(errfd);
 393       else
 394         open("/dev/null", O_WRONLY);
 395     }
 396     if (backfd != 3)
 397     {
 398       close(3);
 399       if (backfd > 0)
 400         dup(backfd);
 401       else
 402         open("/dev/null", O_RDWR);
 403       fcntl(3, F_SETFL, O_NDELAY);
 404     }
 405     if (sidefd != 4 && sidefd > 0)
 406     {
 407       close(4);
 408       dup(sidefd);
 409       fcntl(4, F_SETFL, O_NDELAY);
 410     }
 411
 412    /*
 413     * Change the priority of the process based on the FilterNice setting.
 414     * (this is not done for root processes...)
 415     */
 416
 417     if (!root)
 418       nice(FilterNice);
 419
 420 #ifdef HAVE_SANDBOX_H
 421    /*
 422     * Run in a separate security profile...
 423     */
 424
 425     if (profile)
 426     {
 427       char *error = NULL;               /* Sandbox error, if any */
 428
 429       if (sandbox_init((char *)profile, SANDBOX_NAMED_EXTERNAL, &error))
 430       {
 431         fprintf(stderr, "ERROR: sandbox_init failed: %s (%s)\n", error,
 432                 strerror(errno));
 433         sandbox_free_error(error);
 434       }
 435     }
 436 #endif /* HAVE_SANDBOX_H */
 437
 438    /*
 439     * Change user to something "safe"...
 440     */
 441
 442     if (!root && !RunUser)
 443     {
 444      /*
 445       * Running as root, so change to non-priviledged user...
 446       */
 447
 448       if (setgid(Group))
 449         exit(errno);
 450
 451       if (setgroups(1, &Group))
 452         exit(errno);
 453
 454       if (setuid(User))
 455         exit(errno);
 456     }
 457     else
 458     {
 459      /*
 460       * Reset group membership to just the main one we belong to.
 461       */
 462
 463       setgid(Group);
 464       setgroups(1, &Group);
 465     }
 466
 467    /*
 468     * Change umask to restrict permissions on created files...
 469     */
 470
 471     umask(077);
 472
 473    /*
 474     * Unblock signals before doing the exec...
 475     */
 476
 477 #ifdef HAVE_SIGSET
 478     sigset(SIGTERM, SIG_DFL);
 479     sigset(SIGCHLD, SIG_DFL);
 480 #elif defined(HAVE_SIGACTION)
 481     memset(&action, 0, sizeof(action));
 482
 483     sigemptyset(&action.sa_mask);
 484     action.sa_handler = SIG_DFL;
 485
 486     sigaction(SIGTERM, &action, NULL);
 487     sigaction(SIGCHLD, &action, NULL);
 488 #else
 489     signal(SIGTERM, SIG_DFL);
 490     signal(SIGCHLD, SIG_DFL);
 491 #endif /* HAVE_SIGSET */
 492
 493     cupsdReleaseSignals();
 494
 495    /*
 496     * Execute the command; if for some reason this doesn't work,
 497     * return the error code...
 498     */
 499
 500     if (envp)
 501       execve(command, argv, envp);
 502     else
 503       execv(command, argv);
 504
 505     perror(command);
 506
 507     exit(errno);
 508   }
 509   else if (*pid < 0)
 510   {
 511    /*
 512     * Error - couldn't fork a new process!
 513     */
 514
 515     cupsdLogMessage(CUPSD_LOG_ERROR, "Unable to fork %s - %s.", command,
 516                     strerror(errno));
 517
 518     *pid = 0;
 519   }
 520   else
 521   {
 522     if (!process_array)
 523       process_array = cupsArrayNew((cups_array_func_t)compare_procs, NULL);
 524
 525     if (process_array)
 526     {
 527       if ((proc = calloc(1, sizeof(cupsd_proc_t) + strlen(command))) != NULL)
 528       {
 529         proc->pid    = *pid;
 530         proc->job_id = job_id;
 531         strcpy(proc->name, command);
 532
 533         cupsArrayAdd(process_array, proc);
 534       }
 535     }
 536   }
 537
 538   cupsdReleaseSignals();
 539
 540   cupsdLogMessage(CUPSD_LOG_DEBUG2,
 541                   "cupsdStartProcess(command=\"%s\", argv=%p, envp=%p, "
 542                   "infd=%d, outfd=%d, errfd=%d, backfd=%d, sidefd=%d, root=%d, "
 543                   "profile=%p, job_id=%d, pid=%p) = %d",
 544                   command, argv, envp, infd, outfd, errfd, backfd, sidefd,
 545                   root, profile, job_id, pid, *pid);
 546
 547   return (*pid);
 548 }
 549
 550
 551 /*
 552  * 'compare_procs()' - Compare two processes.
 553  */
 554
 555 static int                              /* O - Result of comparison */
 556 compare_procs(cupsd_proc_t *a,          /* I - First process */
 557               cupsd_proc_t *b)          /* I - Second process */
 558 {
 559   return (a->pid - b->pid);
 560 }
 561
 562
 563 #ifdef HAVE_SANDBOX_H
 564 /*
 565  * 'cupsd_requote()' - Make a regular-expression version of a string.
 566  */
 567
 568 static char *                           /* O - Quoted string */
 569 cupsd_requote(char       *dst,          /* I - Destination buffer */
 570               const char *src,          /* I - Source string */
 571               size_t     dstsize)       /* I - Size of destination buffer */
 572 {
 573   int   ch;                             /* Current character */
 574   char  *dstptr,                        /* Current position in buffer */
 575         *dstend;                        /* End of destination buffer */
 576
 577
 578   dstptr = dst;
 579   dstend = dst + dstsize - 2;
 580
 581   while (*src && dstptr < dstend)
 582   {
 583     ch = *src++;
 584
 585     if (strchr(".?*()[]^$\\", ch))
 586       *dstptr++ = '\\';
 587
 588     *dstptr++ = ch;
 589   }
 590
 591   *dstptr = '\0';
 592
 593   return (dst);
 594 }
 595 #endif /* HAVE_SANDBOX_H */
 596
 597
 598 /*
 599  * End of "$Id: process.c 7256 2008-01-25 00:48:54Z mike $".
 600  */