1 mike  1.1.2.1 /*
  2               //%2006////////////////////////////////////////////////////////////////////////
  3               //
  4               // Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development
  5               // Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.
  6               // Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L.P.;
  7               // IBM Corp.; EMC Corporation, The Open Group.
  8               // Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.;
  9               // IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.
 10               // Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.;
 11               // EMC Corporation; VERITAS Software Corporation; The Open Group.
 12               // Copyright (c) 2006 Hewlett-Packard Development Company, L.P.; IBM Corp.;
 13               // EMC Corporation; Symantec Corporation; The Open Group.
 14               //
 15               // Permission is hereby granted, free of charge, to any person obtaining a copy
 16               // of this software and associated documentation files (the "Software"), to
 17               // deal in the Software without restriction, including without limitation the
 18               // rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 19               // sell copies of the Software, and to permit persons to whom the Software is
 20               // furnished to do so, subject to the following conditions:
 21               // 
 22 mike  1.1.2.1 // THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN
 23               // ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED
 24               // "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
 25               // LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
 26               // PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 27               // HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 28               // ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 29               // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 30               //
 31               //%/////////////////////////////////////////////////////////////////////////////
 32               */
 33               #include <sys/types.h>
 34               #include <sys/stat.h>
 35               #include <unistd.h>
 36               #include <stdlib.h>
 37               #include <string.h>
 38               #include <stdio.h>
 39               #include "Defines.h"
 40               #include "Fatal.h"
 41               #include "Path.h"
 42               #include "File.h"
 43 mike  1.1.2.1 #include "Log.h"
 44               #include "User.h"
 45               
 46               /*
 47               **==============================================================================
 48               **
 49               ** Child
 50               **
 51               **     The child process.
 52               **
 53               **==============================================================================
 54               */
 55               
 56               void Child(
 57                   int argc, 
 58                   char** argv, 
 59                   char path[EXECUTOR_BUFFER_SIZE],
 60                   int uid,
 61                   int gid,
 62                   int sock)
 63               {
 64 mike  1.1.2.1     char sockStr[EXECUTOR_BUFFER_SIZE];
 65                   char repositoryDir[EXECUTOR_BUFFER_SIZE];
 66                   char username[EXECUTOR_BUFFER_SIZE];
 67                   char** execArgv;
 68               
 69                   /* Build argument list, adding "-x <sock>" option if sock non-negative. */
 70               
 71                   execArgv = (char**)malloc(sizeof(char*) * (argc + 4));
 72                   memcpy(execArgv + 4, argv + 1, sizeof(char*) * argc);
 73               
 74                   sprintf(sockStr, "%d", sock);
 75               
 76                   execArgv[0] = CIMSERVERMAIN;
 77                   execArgv[1] = EXECUTOR_FINGERPRINT;
 78                   execArgv[2] = "-x";
 79                   execArgv[3] = strdup(sockStr);
 80               
 81                   /* Locate repository directory. */
 82               
 83                   if (LocateRepositoryDirectory(argc, argv, repositoryDir) != 0)
 84                       Fatal(FL, "failed to locate repository directory");
 85 mike  1.1.2.1 
 86                   /* Check whether repository directory exists. */
 87               
 88                   if (AccessDir(repositoryDir) != 0)
 89                       Fatal(FL, 
 90                           "failed to access repository directory: %s", repositoryDir);
 91               
 92                   /* 
 93                    * Change ownership of Pegasus repository directory (it should be owned
 94                    * by same user that owns CIMSERVERMAIN).
 95                    */
 96               
 97                   ChangeDirOwnerRecursive(repositoryDir, uid, gid);
 98               
 99                   Log(LL_TRACE, "Pegasus repositoryDir is \"%s\"", repositoryDir);
100               
101                   /*
102                    * Downgrade privileges by setting the UID and GID of this process. Use
103                    * the owner of the CIMSERVERMAIN program obtained above.
104                    */
105               
106 mike  1.1.2.1     if (uid == 0 || gid == 0)
107                   {
108                       Fatal(FL, "root may not own %s since the program is run as owner",
109                           path);
110                   }
111               
112                   if (setgid(gid) != 0)
113                   {
114                       Fatal(FL, "Failed to set gid to %d", gid);
115                   }
116               
117                   if (setuid(uid) != 0)
118                   {
119                       Fatal(FL, "Failed to set uid to %d", uid);
120                   }
121               
122                   if ((int)getuid() != uid || 
123                       (int)geteuid() != uid || 
124                       (int)getgid() != gid || 
125                       (int)getegid() != gid)
126                   {
127 mike  1.1.2.1         Fatal(FL, "setuid/setgid verification failed\n");
128                   }
129               
130                   /* Log user info. */
131               
132                   if (GetUserName(uid, username) != 0)
133                       Fatal(FL, "cannot resolve user from uid=%d", uid);
134               
135                   Log(LL_TRACE, "%s running as %s (uid=%d, gid=%d)", CIMSERVERMAIN, 
136                       username, uid, gid);
137               
138                   /*
139                    * Precheck that cimxml.socket is owned by cimservermain process. If 
140                    * not, then the bind would fail in the cimservermain process much 
141                    * later and the cause of the error would be difficult to determine.
142                    */
143               
144                   /* Flawfinder: ignore */
145                   if (access(PEGASUS_LOCAL_DOMAIN_SOCKET_PATH, F_OK) == 0)
146                   {
147                       struct stat st;
148 mike  1.1.2.1 
149                       if (stat(PEGASUS_LOCAL_DOMAIN_SOCKET_PATH, &st) != 0 ||
150                           (int)st.st_uid != uid || 
151                           (int)st.st_gid != gid)
152                       {
153                           Fatal(FL, 
154                               "cimservermain process cannot stat or does not own %s",
155                               PEGASUS_LOCAL_DOMAIN_SOCKET_PATH);
156                       }
157                   }
158               
159                   /* Exec child process. */
160               
161                   /* Flawfinder: ignore */
162                   if (execv(path, execArgv) != 0)
163                       Fatal(FL, "failed to exec %s", path);
164               
165                   exit(0);
166               }