1 kumpf 1.2 /*
  2           //%2006////////////////////////////////////////////////////////////////////////
  3           //
  4           // Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development
  5           // Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.
  6           // Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L.P.;
  7           // IBM Corp.; EMC Corporation, The Open Group.
  8           // Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.;
  9           // IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.
 10           // Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.;
 11           // EMC Corporation; VERITAS Software Corporation; The Open Group.
 12           // Copyright (c) 2006 Hewlett-Packard Development Company, L.P.; IBM Corp.;
 13           // EMC Corporation; Symantec Corporation; The Open Group.
 14           //
 15           // Permission is hereby granted, free of charge, to any person obtaining a copy
 16           // of this software and associated documentation files (the "Software"), to
 17           // deal in the Software without restriction, including without limitation the
 18           // rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
 19           // sell copies of the Software, and to permit persons to whom the Software is
 20           // furnished to do so, subject to the following conditions:
 21           // 
 22 kumpf 1.2 // THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN
 23           // ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED
 24           // "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
 25           // LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
 26           // PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
 27           // HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
 28           // ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
 29           // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 30           //
 31           //%/////////////////////////////////////////////////////////////////////////////
 32           */
 33           #include <sys/types.h>
 34           #include <sys/stat.h>
 35           #include <unistd.h>
 36           #include <stdlib.h>
 37           #include <string.h>
 38           #include <stdio.h>
 39           #include "Defines.h"
 40           #include "Fatal.h"
 41           #include "Path.h"
 42           #include "Log.h"
 43 kumpf 1.2 #include "User.h"
 44           
 45           /*
 46           **==============================================================================
 47           **
 48           ** Child
 49           **
 50           **     The child process.
 51           **
 52           **==============================================================================
 53           */
 54           
 55           void Child(
 56               int argc,
 57               char** argv,
 58               const char* path,
 59               int uid,
 60               int gid,
 61               int sock)
 62           {
 63               char sockStr[EXECUTOR_BUFFER_SIZE];
 64 kumpf 1.2     char username[EXECUTOR_BUFFER_SIZE];
 65               char** execArgv;
 66           
 67               /* Build argument list, adding "--executor-socket <sock>" option if
 68                * sock non-negative.
 69                */
 70           
 71               execArgv = (char**)malloc(sizeof(char*) * (argc + 3));
 72               memcpy(execArgv + 3, argv + 1, sizeof(char*) * argc);
 73           
 74               sprintf(sockStr, "%d", sock);
 75           
 76               execArgv[0] = CIMSERVERMAIN;
 77               execArgv[1] = "--executor-socket";
 78               execArgv[2] = strdup(sockStr);
 79           
 80               /*
 81                * Downgrade privileges by setting the UID and GID of this process. Use
 82                * the owner of the CIMSERVERMAIN program obtained above.
 83                */
 84           
 85 kumpf 1.2     if (uid == 0 || gid == 0)
 86               {
 87                   Fatal(FL, "root may not own %s since the program is run as owner",
 88                       path);
 89               }
 90           
 91               if (setgid(gid) != 0)
 92               {
 93                   Fatal(FL, "Failed to set gid to %d", gid);
 94               }
 95           
 96               if (setuid(uid) != 0)
 97               {
 98                   Fatal(FL, "Failed to set uid to %d", uid);
 99               }
100           
101               if ((int)getuid() != uid ||
102                   (int)geteuid() != uid ||
103                   (int)getgid() != gid ||
104                   (int)getegid() != gid)
105               {
106 kumpf 1.2         Fatal(FL, "setuid/setgid verification failed\n");
107               }
108           
109               /* Log user info. */
110           
111               if (GetUserName(uid, username) != 0)
112                   Fatal(FL, "cannot resolve user from uid=%d", uid);
113           
114               Log(LL_TRACE, "%s running as %s (uid=%d, gid=%d)", CIMSERVERMAIN,
115                   username, uid, gid);
116           
117               /*
118                * Precheck that cimxml.socket is owned by CIMSERVERMAIN process. If
119                * not, then the bind would fail in the CIMSERVERMAIN process much
120                * later and the cause of the error would be difficult to determine.
121                */
122           
123               /* Flawfinder: ignore */
124               if (access(PEGASUS_LOCAL_DOMAIN_SOCKET_PATH, F_OK) == 0)
125               {
126                   struct stat st;
127 kumpf 1.2 
128                   if (stat(PEGASUS_LOCAL_DOMAIN_SOCKET_PATH, &st) != 0 ||
129                       (int)st.st_uid != uid ||
130                       (int)st.st_gid != gid)
131                   {
132                       Fatal(FL, "%s process cannot stat or does not own %s",
133                           CIMSERVERMAIN, PEGASUS_LOCAL_DOMAIN_SOCKET_PATH);
134                   }
135               }
136           
137               /* Exec child process. */
138           
139               /* Flawfinder: ignore */
140               if (execv(path, execArgv) != 0)
141                   Fatal(FL, "failed to exec %s", path);
142           
143               exit(0);
144           }