Head

GCC Code Coverage Report

Directory:	cvmfs/		Exec	Total	Coverage
File:	cvmfs/cvmfs_suid_helper.cc	Lines:	0	165	0.0 %
Date:	2019-02-03 02:48:13	Branches:	0	119	0.0 %


/**
 * This file is part of the CernVM File System.
 *
 * Runs mount/umount commands and removes scratch space on behalf of a
 * repository owner.  Server-only utility.
 *
 * This binary does not use the cvmfs infrastructure code to stay lean.
 */

#include <sys/xattr.h>  // NOLINT

#include <dirent.h>
#include <errno.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <unistd.h>

#include <cstdio>
#include <cstdlib>
#include <cstring>
#include <string>

#include "cvmfs_suid_util.h"
#include "platform.h"
#include "sanitizer.h"

using namespace std;  // NOLINT

const char *kSpoolArea = "/var/spool/cvmfs";

enum RemountType {
  kRemountRdonly,
  kRemountRw
};

static void GetCredentials(uid_t *calling_uid, uid_t *effective_uid) {
  *calling_uid = getuid();
  *effective_uid = geteuid();
}

static void ExecAsRoot(const char *binary,
                       const char *arg1, const char *arg2, const char *arg3)
{
  char *argv[] = { strdup(binary),
                   arg1 ? strdup(arg1) : NULL,
                   arg2 ? strdup(arg2) : NULL,
                   arg3 ? strdup(arg3) : NULL,
                   NULL };
  char *environ[] = { NULL };

  int retval = setuid(0);
  if (retval != 0) {
    fprintf(stderr, "failed to gain root privileges (%d)\n", errno);
    exit(1);
  }

  execve(binary, argv, environ);
  fprintf(stderr, "failed to run %s... (%d)\n", binary, errno);
  exit(1);
}


static void Remount(const string &path, const RemountType how) {
  string remount_option = "remount,";
  switch (how) {
    case kRemountRw:
      remount_option += "rw";
      break;
    case kRemountRdonly:
      remount_option += "ro";
      break;
    default:
      fprintf(stderr, "internal error\n");
      exit(1);
  }

  ExecAsRoot("/bin/mount", "-o", remount_option.c_str(), path.c_str());
}

static void Mount(const string &path) {
  platform_stat64 info;
  int retval = platform_stat("/bin/systemctl", &info);
  if (retval == 0) {
    string systemd_unit = cvmfs_suid::EscapeSystemdUnit(path);
    // On newer versions of systemd, the mount unit is based on the fully
    // resolved path (discovered on Ubuntu 18.04, test 539)
    if (!cvmfs_suid::PathExists(
          string("/run/systemd/generator/") + systemd_unit))
    {
      string resolved_path = cvmfs_suid::ResolvePath(path);
      if (resolved_path.empty()) {
        fprintf(stderr, "cannot resolve %s\n", path.c_str());
        exit(1);
      }
      systemd_unit = cvmfs_suid::EscapeSystemdUnit(resolved_path);
    }
    ExecAsRoot("/bin/systemctl", "start", systemd_unit.c_str(), NULL);
  } else {
    ExecAsRoot("/bin/mount", path.c_str(), NULL, NULL);
  }
}

static void Umount(const string &path) {
  ExecAsRoot("/bin/umount", path.c_str(), NULL, NULL);
}

static void LazyUmount(const string &path) {
  ExecAsRoot("/bin/umount", "-l", path.c_str(), NULL);
}

static void KillCvmfs(const string &fqrn) {
  // prevent exploitation like:
  // fqrn = ../../../../usr/home/file_with_xattr_user.pid
  if (fqrn.find("/") != string::npos || fqrn.find("\\") != string::npos) {
    exit(1);
  }
  string pid;
  const string mountpoint = string(kSpoolArea) + "/" + fqrn + "/rdonly";
  const bool retval = platform_getxattr(mountpoint.c_str(), "user.pid", &pid);
  if (!retval || pid.empty())
    exit(1);
  sanitizer::PositiveIntegerSanitizer pid_sanitizer;
  if (!pid_sanitizer.IsValid(pid))
    exit(1);
  ExecAsRoot("/bin/kill", "-9", pid.c_str(), NULL);
}

class ScopedWorkingDirectory {
 public:
  explicit ScopedWorkingDirectory(const string &path)
    : previous_path_(GetCurrentWorkingDirectory())
    , directory_handle_(NULL)
  {
    ChangeDirectory(path);
    directory_handle_ = opendir(".");
  }

  ~ScopedWorkingDirectory() {
    if (directory_handle_ != NULL) {
      closedir(directory_handle_);
    }
    ChangeDirectory(previous_path_);
  }

  operator bool() const { return directory_handle_ != NULL; }

  struct DirectoryEntry {
    bool   is_directory;
    string name;
  };

  bool NextDirectoryEntry(DirectoryEntry *entry) {
    platform_dirent64 *dirent;
    while ((dirent = platform_readdir(directory_handle_)) != NULL &&
           IsDotEntry(dirent)) {}
    if (dirent == NULL) {
      return false;
    }

    platform_stat64 info;
    if (platform_lstat(dirent->d_name, &info) != 0) {
      return false;
    }

    entry->is_directory = S_ISDIR(info.st_mode);
    entry->name         = dirent->d_name;
    return true;
  }

 protected:
  string GetCurrentWorkingDirectory() {
    char path[PATH_MAX];
    const char* cwd = getcwd(path, PATH_MAX);
    assert(cwd == path);
    return string(cwd);
  }

  void ChangeDirectory(const string &path) {
    const int retval = chdir(path.c_str());
    assert(retval == 0);
  }

  bool IsDotEntry(const platform_dirent64 *dirent) {
    return (strcmp(dirent->d_name, ".")  == 0) ||
           (strcmp(dirent->d_name, "..") == 0);
  }

 private:
  const string  previous_path_;
        DIR    *directory_handle_;
};

static bool ClearDirectory(const string &path) {
  ScopedWorkingDirectory swd(path);
  if (!swd) {
    return false;
  }

  bool success = true;
  ScopedWorkingDirectory::DirectoryEntry dirent;
  while (success && swd.NextDirectoryEntry(&dirent)) {
    success = (dirent.is_directory)
      ? ClearDirectory(dirent.name) && (rmdir(dirent.name.c_str()) == 0)
      : (unlink(dirent.name.c_str()) == 0);
  }

  return success;
}

static int CleanupDirectory(const string &path) {
  if (!ClearDirectory(path)) {
    fprintf(stderr, "failed to clear %s\n", path.c_str());
    return 1;
  }
  return 0;
}

static int DoSynchronousScratchCleanup(const string &fqrn) {
  const string scratch = string(kSpoolArea) + "/" + fqrn + "/scratch/current";
  return CleanupDirectory(scratch);
}

static int DoAsynchronousScratchCleanup(const string &fqrn) {
  const string wastebin = string(kSpoolArea) + "/" + fqrn + "/scratch/wastebin";

  // double-fork to daemonize the process and redirect I/O to /dev/null
  pid_t pid;
  int statloc;
  if ((pid = fork()) == 0) {
    int retval = setsid();
    assert(retval != -1);
    if ((pid = fork()) == 0) {
      int null_read = open("/dev/null", O_RDONLY);
      int null_write = open("/dev/null", O_WRONLY);
      assert((null_read >= 0) && (null_write >= 0));
      retval = dup2(null_read, 0);
      assert(retval == 0);
      retval = dup2(null_write, 1);
      assert(retval == 1);
      retval = dup2(null_write, 2);
      assert(retval == 2);
      close(null_read);
      close(null_write);
    } else {
      assert(pid > 0);
      _exit(0);
    }
  } else {
    assert(pid > 0);
    waitpid(pid, &statloc, 0);
    _exit(0);
  }

  return CleanupDirectory(wastebin);
}

static void Usage(const string &exe, FILE *output) {
  fprintf(output,
    "Usage: %s lock|open|rw_mount|rw_umount|rdonly_mount|rdonly_umount|"
      "clear_scratch|clear_scratch_async|kill_cvmfs <fqrn>\n"
    "Example: %s rw_umount atlas.cern.ch\n"
    "This binary is typically called by cvmfs_server.\n",
    exe.c_str(), exe.c_str());
}


int main(int argc, char *argv[]) {
  umask(077);
  int retval;

  // Figure out real and effective uid
  uid_t calling_uid, effective_uid, repository_uid;
  GetCredentials(&calling_uid, &effective_uid);
  if (effective_uid != 0) {
    fprintf(stderr, "Needs to run as root\n");
    return 1;
  }

  // Arguments
  if (argc != 3) {
    Usage(argv[0], stderr);
    return 1;
  }
  const string command = argv[1];
  const string fqrn = argv[2];

  // Verify if repository exists
  platform_stat64 info;
  retval = platform_lstat((string(kSpoolArea) + "/" + fqrn).c_str(), &info);
  if (retval != 0) {
    fprintf(stderr, "unknown repository: %s\n", fqrn.c_str());
    return 1;
  }
  repository_uid = info.st_uid;

  // Verify if caller uid matches
  if ((calling_uid != 0) && (calling_uid != repository_uid)) {
    fprintf(stderr, "called as %d, repository owned by %d\n",
            calling_uid, repository_uid);
    return 1;
  }

  if (command == "lock") {
    Remount("/cvmfs/" + fqrn, kRemountRdonly);
  } else if (command == "open") {
    Remount("/cvmfs/" + fqrn, kRemountRw);
  } else if (command == "kill_cvmfs") {
    KillCvmfs(fqrn);
  } else if (command == "rw_mount") {
    Mount("/cvmfs/" + fqrn);
  } else if (command == "rw_umount") {
    Umount("/cvmfs/" + fqrn);
  } else if (command == "rw_lazy_umount") {
    LazyUmount("/cvmfs/" + fqrn);
  } else if (command == "rdonly_mount") {
    Mount(string(kSpoolArea) + "/" + fqrn + "/rdonly");
  } else if (command == "rdonly_umount") {
    Umount(string(kSpoolArea) + "/" + fqrn + "/rdonly");
  } else if (command == "rdonly_lazy_umount") {
    LazyUmount(string(kSpoolArea) + "/" + fqrn + "/rdonly");
  } else if (command == "clear_scratch") {
    return DoSynchronousScratchCleanup(fqrn);
  } else if (command == "clear_scratch_async") {
    return DoAsynchronousScratchCleanup(fqrn);
  } else {
    Usage(argv[0], stderr);
    return 1;
  }

  return 0;
}


Generated by: GCOVR (Version 4.1)

Line	Branch	Exec	Source
1			/**
2			* This file is part of the CernVM File System.
3			*
4			* Runs mount/umount commands and removes scratch space on behalf of a
5			* repository owner. Server-only utility.
6			*
7			* This binary does not use the cvmfs infrastructure code to stay lean.
8			*/
9
10			#include <sys/xattr.h> // NOLINT
11
12			#include <dirent.h>
13			#include <errno.h>
14			#include <sys/stat.h>
15			#include <sys/wait.h>
16			#include <unistd.h>
17
18			#include <cstdio>
19			#include <cstdlib>
20			#include <cstring>
21			#include <string>
22
23			#include "cvmfs_suid_util.h"
24			#include "platform.h"
25			#include "sanitizer.h"
26
27			using namespace std; // NOLINT
28
29			const char *kSpoolArea = "/var/spool/cvmfs";
30
31			enum RemountType {
32			kRemountRdonly,
33			kRemountRw
34			};
35
36			static void GetCredentials(uid_t calling_uid, uid_t effective_uid) {
37			*calling_uid = getuid();
38			*effective_uid = geteuid();
39			}
40
41			static void ExecAsRoot(const char *binary,
42			const char arg1, const char arg2, const char *arg3)
43			{
44			char *argv[] = { strdup(binary),
45			arg1 ? strdup(arg1) : NULL,
46			arg2 ? strdup(arg2) : NULL,
47			arg3 ? strdup(arg3) : NULL,
48			NULL };
49			char *environ[] = { NULL };
50
51			int retval = setuid(0);
52			if (retval != 0) {
53			fprintf(stderr, "failed to gain root privileges (%d)\n", errno);
54			exit(1);
55			}
56
57			execve(binary, argv, environ);
58			fprintf(stderr, "failed to run %s... (%d)\n", binary, errno);
59			exit(1);
60			}
61
62
63			static void Remount(const string &path, const RemountType how) {
64			string remount_option = "remount,";
65			switch (how) {
66			case kRemountRw:
67			remount_option += "rw";
68			break;
69			case kRemountRdonly:
70			remount_option += "ro";
71			break;
72			default:
73			fprintf(stderr, "internal error\n");
74			exit(1);
75			}
76
77			ExecAsRoot("/bin/mount", "-o", remount_option.c_str(), path.c_str());
78			}
79
80			static void Mount(const string &path) {
81			platform_stat64 info;
82			int retval = platform_stat("/bin/systemctl", &info);
83			if (retval == 0) {
84			string systemd_unit = cvmfs_suid::EscapeSystemdUnit(path);
85			// On newer versions of systemd, the mount unit is based on the fully
86			// resolved path (discovered on Ubuntu 18.04, test 539)
87			if (!cvmfs_suid::PathExists(
88			string("/run/systemd/generator/") + systemd_unit))
89			{
90			string resolved_path = cvmfs_suid::ResolvePath(path);
91			if (resolved_path.empty()) {
92			fprintf(stderr, "cannot resolve %s\n", path.c_str());
93			exit(1);
94			}
95			systemd_unit = cvmfs_suid::EscapeSystemdUnit(resolved_path);
96			}
97			ExecAsRoot("/bin/systemctl", "start", systemd_unit.c_str(), NULL);
98			} else {
99			ExecAsRoot("/bin/mount", path.c_str(), NULL, NULL);
100			}
101			}
102
103			static void Umount(const string &path) {
104			ExecAsRoot("/bin/umount", path.c_str(), NULL, NULL);
105			}
106
107			static void LazyUmount(const string &path) {
108			ExecAsRoot("/bin/umount", "-l", path.c_str(), NULL);
109			}
110
111			static void KillCvmfs(const string &fqrn) {
112			// prevent exploitation like:
113			// fqrn = ../../../../usr/home/file_with_xattr_user.pid
114			if (fqrn.find("/") != string::npos \|\| fqrn.find("\\") != string::npos) {
115			exit(1);
116			}
117			string pid;
118			const string mountpoint = string(kSpoolArea) + "/" + fqrn + "/rdonly";
119			const bool retval = platform_getxattr(mountpoint.c_str(), "user.pid", &pid);
120			if (!retval \|\| pid.empty())
121			exit(1);
122			sanitizer::PositiveIntegerSanitizer pid_sanitizer;
123			if (!pid_sanitizer.IsValid(pid))
124			exit(1);
125			ExecAsRoot("/bin/kill", "-9", pid.c_str(), NULL);
126			}
127
128			class ScopedWorkingDirectory {
129			public:
130			explicit ScopedWorkingDirectory(const string &path)
131			: previous_path_(GetCurrentWorkingDirectory())
132			, directory_handle_(NULL)
133			{
134			ChangeDirectory(path);
135			directory_handle_ = opendir(".");
136			}
137
138			~ScopedWorkingDirectory() {
139			if (directory_handle_ != NULL) {
140			closedir(directory_handle_);
141			}
142			ChangeDirectory(previous_path_);
143			}
144
145			operator bool() const { return directory_handle_ != NULL; }
146
147			struct DirectoryEntry {
148			bool is_directory;
149			string name;
150			};
151
152			bool NextDirectoryEntry(DirectoryEntry *entry) {
153			platform_dirent64 *dirent;
154			while ((dirent = platform_readdir(directory_handle_)) != NULL &&
155			IsDotEntry(dirent)) {}
156			if (dirent == NULL) {
157			return false;
158			}
159
160			platform_stat64 info;
161			if (platform_lstat(dirent->d_name, &info) != 0) {
162			return false;
163			}
164
165			entry->is_directory = S_ISDIR(info.st_mode);
166			entry->name = dirent->d_name;
167			return true;
168			}
169
170			protected:
171			string GetCurrentWorkingDirectory() {
172			char path[PATH_MAX];
173			const char* cwd = getcwd(path, PATH_MAX);
174			assert(cwd == path);
175			return string(cwd);
176			}
177
178			void ChangeDirectory(const string &path) {
179			const int retval = chdir(path.c_str());
180			assert(retval == 0);
181			}
182
183			bool IsDotEntry(const platform_dirent64 *dirent) {
184			return (strcmp(dirent->d_name, ".") == 0) \|\|
185			(strcmp(dirent->d_name, "..") == 0);
186			}
187
188			private:
189			const string previous_path_;
190			DIR *directory_handle_;
191			};
192
193			static bool ClearDirectory(const string &path) {
194			ScopedWorkingDirectory swd(path);
195			if (!swd) {
196			return false;
197			}
198
199			bool success = true;
200			ScopedWorkingDirectory::DirectoryEntry dirent;
201			while (success && swd.NextDirectoryEntry(&dirent)) {
202			success = (dirent.is_directory)
203			? ClearDirectory(dirent.name) && (rmdir(dirent.name.c_str()) == 0)
204			: (unlink(dirent.name.c_str()) == 0);
205			}
206
207			return success;
208			}
209
210			static int CleanupDirectory(const string &path) {
211			if (!ClearDirectory(path)) {
212			fprintf(stderr, "failed to clear %s\n", path.c_str());
213			return 1;
214			}
215			return 0;
216			}
217
218			static int DoSynchronousScratchCleanup(const string &fqrn) {
219			const string scratch = string(kSpoolArea) + "/" + fqrn + "/scratch/current";
220			return CleanupDirectory(scratch);
221			}
222
223			static int DoAsynchronousScratchCleanup(const string &fqrn) {
224			const string wastebin = string(kSpoolArea) + "/" + fqrn + "/scratch/wastebin";
225
226			// double-fork to daemonize the process and redirect I/O to /dev/null
227			pid_t pid;
228			int statloc;
229			if ((pid = fork()) == 0) {
230			int retval = setsid();
231			assert(retval != -1);
232			if ((pid = fork()) == 0) {
233			int null_read = open("/dev/null", O_RDONLY);
234			int null_write = open("/dev/null", O_WRONLY);
235			assert((null_read >= 0) && (null_write >= 0));
236			retval = dup2(null_read, 0);
237			assert(retval == 0);
238			retval = dup2(null_write, 1);
239			assert(retval == 1);
240			retval = dup2(null_write, 2);
241			assert(retval == 2);
242			close(null_read);
243			close(null_write);
244			} else {
245			assert(pid > 0);
246			_exit(0);
247			}
248			} else {
249			assert(pid > 0);
250			waitpid(pid, &statloc, 0);
251			_exit(0);
252			}
253
254			return CleanupDirectory(wastebin);
255			}
256
257			static void Usage(const string &exe, FILE *output) {
258			fprintf(output,
259			"Usage: %s lock\|open\|rw_mount\|rw_umount\|rdonly_mount\|rdonly_umount\|"
260			"clear_scratch\|clear_scratch_async\|kill_cvmfs <fqrn>\n"
261			"Example: %s rw_umount atlas.cern.ch\n"
262			"This binary is typically called by cvmfs_server.\n",
263			exe.c_str(), exe.c_str());
264			}
265
266
267			int main(int argc, char *argv[]) {
268			umask(077);
269			int retval;
270
271			// Figure out real and effective uid
272			uid_t calling_uid, effective_uid, repository_uid;
273			GetCredentials(&calling_uid, &effective_uid);
274			if (effective_uid != 0) {
275			fprintf(stderr, "Needs to run as root\n");
276			return 1;
277			}
278
279			// Arguments
280			if (argc != 3) {
281			Usage(argv[0], stderr);
282			return 1;
283			}
284			const string command = argv[1];
285			const string fqrn = argv[2];
286
287			// Verify if repository exists
288			platform_stat64 info;
289			retval = platform_lstat((string(kSpoolArea) + "/" + fqrn).c_str(), &info);
290			if (retval != 0) {
291			fprintf(stderr, "unknown repository: %s\n", fqrn.c_str());
292			return 1;
293			}
294			repository_uid = info.st_uid;
295
296			// Verify if caller uid matches
297			if ((calling_uid != 0) && (calling_uid != repository_uid)) {
298			fprintf(stderr, "called as %d, repository owned by %d\n",
299			calling_uid, repository_uid);
300			return 1;
301			}
302
303			if (command == "lock") {
304			Remount("/cvmfs/" + fqrn, kRemountRdonly);
305			} else if (command == "open") {
306			Remount("/cvmfs/" + fqrn, kRemountRw);
307			} else if (command == "kill_cvmfs") {
308			KillCvmfs(fqrn);
309			} else if (command == "rw_mount") {
310			Mount("/cvmfs/" + fqrn);
311			} else if (command == "rw_umount") {
312			Umount("/cvmfs/" + fqrn);
313			} else if (command == "rw_lazy_umount") {
314			LazyUmount("/cvmfs/" + fqrn);
315			} else if (command == "rdonly_mount") {
316			Mount(string(kSpoolArea) + "/" + fqrn + "/rdonly");
317			} else if (command == "rdonly_umount") {
318			Umount(string(kSpoolArea) + "/" + fqrn + "/rdonly");
319			} else if (command == "rdonly_lazy_umount") {
320			LazyUmount(string(kSpoolArea) + "/" + fqrn + "/rdonly");
321			} else if (command == "clear_scratch") {
322			return DoSynchronousScratchCleanup(fqrn);
323			} else if (command == "clear_scratch_async") {
324			return DoAsynchronousScratchCleanup(fqrn);
325			} else {
326			Usage(argv[0], stderr);
327			return 1;
328			}
329
330			return 0;
331			}