privsep: Only log chrooting from the launcher process

And the sandbox tech as well.
Rework stop_interface so we can reuse an option for marking
a process as the launcher.

diff --git a/src/dhcpcd.c b/src/dhcpcd.c
index 8f429bc5def7df0f4089b1e83b4730e654b1fedb..a9ced339b456bcda93ff29ae2b7ac2bc859df8ad 100644 (file)
--- a/src/dhcpcd.c
+++ b/src/dhcpcd.c
@@ -409,7 +409,7 @@ dhcpcd_drop(struct interface *ifp, int stop)
 }
 
 static void
-stop_interface(struct interface *ifp)
+stop_interface(struct interface *ifp, const char *reason)
 {
        struct dhcpcd_ctx *ctx;
 
@@ -418,10 +418,7 @@ stop_interface(struct interface *ifp)
        ifp->options->options |= DHCPCD_STOPPING;
 
        dhcpcd_drop(ifp, 1);
-       if (ifp->options->options & DHCPCD_DEPARTED)
-               script_runreason(ifp, "DEPARTED");
-       else
-               script_runreason(ifp, "STOPPED");
+       script_runreason(ifp, reason == NULL ? "STOPPED" : reason);
 
        /* Delete all timeouts for the interfaces */
        eloop_q_timeout_delete(ctx->eloop, ELOOP_QUEUE_ALL, NULL, ifp);
@@ -1025,8 +1022,7 @@ dhcpcd_handleinterface(void *arg, int action, const char *ifname)
                }
                if (ifp->active) {
                        logdebugx("%s: interface departed", ifp->name);
-                       ifp->options->options |= DHCPCD_DEPARTED;
-                       stop_interface(ifp);
+                       stop_interface(ifp, "DEPARTED");
                }
                TAILQ_REMOVE(ctx->ifaces, ifp, next);
                if_free(ifp);
@@ -1339,7 +1335,7 @@ stop_all_interfaces(struct dhcpcd_ctx *ctx, unsigned long long opts)
                if (ifp->options->options & DHCPCD_RELEASE)
                        ifp->options->options &= ~DHCPCD_PERSISTENT;
                ifp->options->options |= DHCPCD_EXITING;
-               stop_interface(ifp);
+               stop_interface(ifp, NULL);
        }
 }
 
@@ -1591,7 +1587,7 @@ dumperr:
                        ifp->options->options |= opts;
                        if (opts & DHCPCD_RELEASE)
                                ifp->options->options &= ~DHCPCD_PERSISTENT;
-                       stop_interface(ifp);
+                       stop_interface(ifp, NULL);
                }
                return 0;
        }
@@ -2293,7 +2289,7 @@ printpidfile:
                break;
        default:
                setproctitle("[launcher]");
-               ctx.options |= DHCPCD_FORKED;
+               ctx.options |= DHCPCD_FORKED | DHCPCD_LAUNCHER;
                ctx.fork_fd = fork_fd[0];
                close(fork_fd[1]);
 #ifdef PRIVSEP_RIGHTS

diff --git a/src/if-options.h b/src/if-options.h
index 2c974f578521c19a6baccf08f2ceefaa681fd3be..a73ba0d2b83ac792e6f69391fe623d3f6bbe8050 100644 (file)
--- a/src/if-options.h
+++ b/src/if-options.h
@@ -99,7 +99,7 @@
 #define DHCPCD_NOALIAS                 (1ULL << 39)
 #define DHCPCD_IA_FORCED               (1ULL << 40)
 #define DHCPCD_STOPPING                        (1ULL << 41)
-#define DHCPCD_DEPARTED                        (1ULL << 42)
+#define DHCPCD_LAUNCHER                        (1ULL << 42)
 #define DHCPCD_HOSTNAME_SHORT          (1ULL << 43)
 #define DHCPCD_EXITING                 (1ULL << 44)
 #define DHCPCD_WAITIP4                 (1ULL << 45)

diff --git a/src/privsep.c b/src/privsep.c
index d1c74f4ae9d9581512c773a0b9cacecac201349b..771e7317c2ea1c794cdf4049e0880115ab0f8faf 100644 (file)
--- a/src/privsep.c
+++ b/src/privsep.c
@@ -116,7 +116,7 @@ ps_dropprivs(struct dhcpcd_ctx *ctx)
 {
        struct passwd *pw = ctx->ps_user;
 
-       if (!(ctx->options & DHCPCD_FORKED))
+       if (ctx->options & DHCPCD_LAUNCHER)
                logdebugx("chrooting as %s to %s", pw->pw_name, pw->pw_dir);
        if (chroot(pw->pw_dir) == -1 &&
            (errno != EPERM || ctx->options & DHCPCD_FORKED))
@@ -566,7 +566,7 @@ ps_mastersandbox(struct dhcpcd_ctx *ctx, const char *_pledge)
                }
                logerr("%s: %s", __func__, sandbox);
                return -1;
-       } else if (!forked)
+       } else if (ctx->options & DHCPCD_LAUNCHER)
                logdebugx("sandbox: %s", sandbox);
        return 0;
 }