1 kumpf 1.2 /*
2 //%2006////////////////////////////////////////////////////////////////////////
3 //
4 // Copyright (c) 2000, 2001, 2002 BMC Software; Hewlett-Packard Development
5 // Company, L.P.; IBM Corp.; The Open Group; Tivoli Systems.
6 // Copyright (c) 2003 BMC Software; Hewlett-Packard Development Company, L.P.;
7 // IBM Corp.; EMC Corporation, The Open Group.
8 // Copyright (c) 2004 BMC Software; Hewlett-Packard Development Company, L.P.;
9 // IBM Corp.; EMC Corporation; VERITAS Software Corporation; The Open Group.
10 // Copyright (c) 2005 Hewlett-Packard Development Company, L.P.; IBM Corp.;
11 // EMC Corporation; VERITAS Software Corporation; The Open Group.
12 // Copyright (c) 2006 Hewlett-Packard Development Company, L.P.; IBM Corp.;
13 // EMC Corporation; Symantec Corporation; The Open Group.
14 //
15 // Permission is hereby granted, free of charge, to any person obtaining a copy
16 // of this software and associated documentation files (the "Software"), to
17 // deal in the Software without restriction, including without limitation the
18 // rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
19 // sell copies of the Software, and to permit persons to whom the Software is
20 // furnished to do so, subject to the following conditions:
21 //
22 kumpf 1.2 // THE ABOVE COPYRIGHT NOTICE AND THIS PERMISSION NOTICE SHALL BE INCLUDED IN
23 // ALL COPIES OR SUBSTANTIAL PORTIONS OF THE SOFTWARE. THE SOFTWARE IS PROVIDED
24 // "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
25 // LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR
26 // PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
27 // HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN
28 // ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION
29 // WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
30 //
31 //%/////////////////////////////////////////////////////////////////////////////
32 */
33 #include <sys/types.h>
34 #include <sys/stat.h>
35 #include <unistd.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <stdio.h>
|
39 kumpf 1.3 #include <grp.h>
|
40 kumpf 1.2 #include "Defines.h"
|
41 kumpf 1.6 #include "Globals.h"
|
42 kumpf 1.2 #include "Fatal.h"
43 #include "Path.h"
44 #include "Log.h"
45 #include "User.h"
46
47 /*
48 **==============================================================================
49 **
50 ** Child
51 **
52 ** The child process.
53 **
54 **==============================================================================
55 */
56
57 void Child(
58 int argc,
59 char** argv,
60 const char* path,
|
61 kumpf 1.3 const char* userName,
|
62 kumpf 1.2 int uid,
63 int gid,
64 int sock)
65 {
66 char sockStr[EXECUTOR_BUFFER_SIZE];
67 char** execArgv;
68
|
69 kumpf 1.6 globals.isChildProcess = 1;
70
|
71 kumpf 1.2 /* Build argument list, adding "--executor-socket <sock>" option if
72 * sock non-negative.
73 */
74
75 execArgv = (char**)malloc(sizeof(char*) * (argc + 3));
76 memcpy(execArgv + 3, argv + 1, sizeof(char*) * argc);
77
78 sprintf(sockStr, "%d", sock);
79
80 execArgv[0] = CIMSERVERMAIN;
81 execArgv[1] = "--executor-socket";
82 execArgv[2] = strdup(sockStr);
83
84 /*
85 * Downgrade privileges by setting the UID and GID of this process. Use
86 * the owner of the CIMSERVERMAIN program obtained above.
87 */
88
89 if (uid == 0 || gid == 0)
90 {
91 Fatal(FL, "root may not own %s since the program is run as owner",
92 kumpf 1.2 path);
93 }
94
95 if (setgid(gid) != 0)
96 {
97 Fatal(FL, "Failed to set gid to %d", gid);
98 }
99
|
100 kumpf 1.3 if (initgroups(userName, gid) != 0)
101 {
102 Fatal(FL, "Failed to initialize groups for user %s", userName);
103 }
104
|
105 kumpf 1.2 if (setuid(uid) != 0)
106 {
107 Fatal(FL, "Failed to set uid to %d", uid);
108 }
109
110 if ((int)getuid() != uid ||
111 (int)geteuid() != uid ||
112 (int)getgid() != gid ||
113 (int)getegid() != gid)
114 {
115 Fatal(FL, "setuid/setgid verification failed\n");
116 }
117
118 /* Log user info. */
119
120 Log(LL_TRACE, "%s running as %s (uid=%d, gid=%d)", CIMSERVERMAIN,
|
121 kumpf 1.4 userName, uid, gid);
|
122 kumpf 1.2
|
123 kumpf 1.5 /* Exec child process. */
|
124 kumpf 1.2
125 /* Flawfinder: ignore */
|
126 kumpf 1.5 execv(path, execArgv);
|
127 kumpf 1.2
|
128 kumpf 1.5 /* If we are still here, the exec failed. */
129 Fatal(FL, "failed to exec %s", path);
|
130 kumpf 1.2 }
|