src/common/daemonize.c

/*****************************************************************************\
 *  daemonize.c - daemonization routine
 *****************************************************************************
 *  Copyright (C) 2002 The Regents of the University of California.
 *  Produced at Lawrence Livermore National Laboratory (cf, DISCLAIMER).
 *  Written by Mark A. Grondona <mgrondona@llnl.gov>.
 *  CODE-OCEC-09-009. All rights reserved.
 *
 *  This file is part of Slurm, a resource management program.
 *  For details, see <https://slurm.schedmd.com/>.
 *  Please also read the included file: DISCLAIMER.
 *
 *  Slurm is free software; you can redistribute it and/or modify it under
 *  the terms of the GNU General Public License as published by the Free
 *  Software Foundation; either version 2 of the License, or (at your option)
 *  any later version.
 *
 *  In addition, as a special exception, the copyright holders give permission
 *  to link the code of portions of this program with the OpenSSL library under
 *  certain conditions as described in each individual source file, and
 *  distribute linked combinations including the two. You must obey the GNU
 *  General Public License in all respects for all of the code used other than
 *  OpenSSL. If you modify file(s) with this exception, you may extend this
 *  exception to your version of the file(s), but you are not obligated to do
 *  so. If you do not wish to do so, delete this exception statement from your
 *  version.  If you delete this exception statement from all source files in
 *  the program, then also delete it here.
 *
 *  Slurm is distributed in the hope that it will be useful, but WITHOUT ANY
 *  WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
 *  FOR A PARTICULAR PURPOSE.  See the GNU General Public License for more
 *  details.
 *
 *  You should have received a copy of the GNU General Public License along
 *  with Slurm; if not, write to the Free Software Foundation, Inc.,
 *  51 Franklin Street, Fifth Floor, Boston, MA 02110-1301  USA.
\*****************************************************************************/

#include <config.h>

#define _GNU_SOURCE

#include <fcntl.h>
#include <grp.h>
#include <signal.h>
#include <sys/resource.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <unistd.h>

#if HAVE_SYS_PRCTL_H
#include <sched.h>
#include <sys/prctl.h>
#endif

#include "slurm/slurm_errno.h"

#include "src/common/daemonize.h"
#include "src/common/fd.h"
#include "src/common/log.h"
#include "src/common/macros.h"
#include "src/common/read_config.h"
#include "src/common/slurm_protocol_defs.h"
#include "src/common/uid.h"
#include "src/common/xassert.h"
#include "src/common/xsignal.h"

/*
 * Double-fork and go into background.
 * Caller is responsible for umasks
 */
int xdaemon(void)
{
	int devnull;

	switch (fork()) {
		case  0 : break;        /* child */
		case -1 : return -1;
		default : _exit(0);     /* exit parent */
	}

	if (setsid() < 0)
		return -1;

	switch (fork()) {
		case 0 : break;         /* child */
		case -1: return -1;
		default: _exit(0);      /* exit parent */
	}

	/*
	 * dup stdin, stdout, and stderr onto /dev/null
	 */
	devnull = open("/dev/null", O_RDWR);
	if (devnull < 0)
		error("Unable to open /dev/null: %m");
	if (dup2(devnull, STDIN_FILENO) < 0)
		error("Unable to dup /dev/null onto stdin: %m");
	if (dup2(devnull, STDOUT_FILENO) < 0)
		error("Unable to dup /dev/null onto stdout: %m");
	if (dup2(devnull, STDERR_FILENO) < 0)
		error("Unable to dup /dev/null onto stderr: %m");
	if (close(devnull) < 0)
		error("Unable to close /dev/null: %m");

	return 0;
}

/*
 * Read and return pid stored in pidfile.
 * Returns 0 if file doesn't exist or pid cannot be read.
 * If pidfd != NULL, the file will be kept open and the fd
 * returned.
 */
pid_t
read_pidfile(const char *pidfile, int *pidfd)
{
	int fd;
	FILE *fp = NULL;
	unsigned long pid;
	pid_t         lpid;

	if ((fd = open(pidfile, O_RDONLY)) < 0)
		return ((pid_t) 0);

	if (!(fp = fdopen(fd, "r"))) {
		error ("Unable to access old pidfile at `%s': %m", pidfile);
		(void) close(fd);
		return ((pid_t) 0);
	}

	if (fscanf(fp, "%lu", &pid) < 1) {
		error ("Possible corrupt pidfile `%s'", pidfile);
		(void) close(fd);
		return ((pid_t) 0);
	}

	if ((lpid = fd_is_read_lock_blocked(fd)) == (pid_t) 0) {
		verbose ("pidfile not locked, assuming no running daemon");
		(void) close(fd);
		return ((pid_t) 0);
	}

	if (lpid != (pid_t) pid)
		fatal ("pidfile locked by %lu but contains pid=%lu",
		       (unsigned long) lpid, (unsigned long) pid);

	if (pidfd != NULL)
		*pidfd = fd;
	else
		(void) close(fd);

/*	fclose(fp);	NOTE: DO NOT CLOSE, "fd" CONTAINS FILE DESCRIPTOR */
	return (lpid);
}



int
create_pidfile(const char *pidfile, uid_t uid)
{
	FILE *fp;
	int fd;
	mode_t mode = S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH;

	xassert(pidfile != NULL);
	xassert(pidfile[0] == '/');

	fd = open(pidfile, O_CREAT | O_WRONLY | O_TRUNC | O_CLOEXEC, mode);
	if (fd < 0) {
		error("Unable to open pidfile `%s': %m", pidfile);
		return -1;
	}

	if (fchmod(fd, mode) < 0) {
		error("Unable to chmod pidfile `%s': %m", pidfile);
		(void) close(fd);
		return -1;
	}

	if (!(fp = fdopen(fd, "w"))) {
		error("Unable to access pidfile at `%s': %m", pidfile);
		(void) close(fd);
		return -1;
	}

	if (fd_get_write_lock(fd) < 0) {
		error ("Unable to lock pidfile `%s': %m", pidfile);
		goto error;
	}

	if (fprintf(fp, "%lu\n", (unsigned long) getpid()) == EOF) {
		error("Unable to write to pidfile `%s': %m", pidfile);
		goto error;
	}

	fflush(fp);

	if (uid && (fchown(fd, uid, -1) < 0))
		error ("Unable to reset owner of pidfile: %m");

/*	fclose(fp);	NOTE: DO NOT CLOSE, "fd" CONTAINS FILE DESCRIPTOR */
	return fd;

  error:
	(void)fclose(fp); /* Ignore errors */

	if (unlink(pidfile) < 0)
		error("Unable to remove pidfile `%s': %m", pidfile);
	return -1;
}

static void _wait_for_pidfile_lock(int fd)
{
	int rc;
	bool retried = false;

	/* Need to wait for parent process to exit */
	while (((rc = fd_get_write_lock(fd)) < 0) &&
	       ((errno == EAGAIN) || (errno == EACCES))) {
		if (!retried) {
			debug("%s: failed to lock slurmctld's pidfile, retrying",
			      __func__);
			retried = true;
		}
		usleep(10000);
	}
	if (rc)
		error ("Unable to lock pidfile: %m");
}

extern int update_pidfile(int fd)
{
	FILE *fp;

	_wait_for_pidfile_lock(fd);

	if (!(fp = fdopen(fd, "w"))) {
		error("Unable to access pidfd=%d: %m", fd);
		return -1;
	}

	rewind(fp);

	if (fprintf(fp, "%lu\n", (unsigned long) getpid()) == EOF) {
		error("Unable to write to pidfd=%d: %m", fd);
		return -1;
	}

	fflush(fp);

	/* WARNING: Do not close fp, it would close fd as well. */
	return fd;
}

void
test_core_limit(void)
{
#ifdef RLIMIT_CORE
	struct rlimit rlim[1];
	if (getrlimit(RLIMIT_CORE, rlim) < 0)
		error("Unable to get core limit");
	else if (rlim->rlim_cur != RLIM_INFINITY) {
		rlim->rlim_cur /= 1024;	/* bytes to KB */
		if (rlim->rlim_cur < 2048) {
			warning("Core limit is only %ld KB",
				(long int) rlim->rlim_cur);
		}
	}
#endif
	return;
}

extern void become_slurm_user(void)
{
	gid_t slurm_user_gid;

	/* Determine SlurmUser gid */
	slurm_user_gid = gid_from_uid(slurm_conf.slurm_user_id);
	if (slurm_user_gid == (gid_t) -1) {
		fatal("Failed to determine gid of SlurmUser(%u)",
		      slurm_conf.slurm_user_id);
	}

	/* Initialize supplementary groups ID list for SlurmUser */
	if (getuid() == 0) {
		/* root does not need supplementary groups */
		if ((slurm_conf.slurm_user_id == 0) &&
		    (setgroups(0, NULL) != 0)) {
			fatal("Failed to drop supplementary groups, "
			      "setgroups: %m");
		} else if ((slurm_conf.slurm_user_id != 0) &&
		           initgroups(slurm_conf.slurm_user_name,
		                      slurm_user_gid)) {
			fatal("Failed to set supplementary groups, "
			      "initgroups: %m");
		}
	}

	/* Set GID to GID of SlurmUser */
	if ((slurm_user_gid != getegid()) &&
	    (setgid(slurm_user_gid))) {
		fatal("Failed to set GID to %u", slurm_user_gid);
	}

	/* Set UID to UID of SlurmUser */
	if ((slurm_conf.slurm_user_id != getuid()) &&
	    (setuid(slurm_conf.slurm_user_id))) {
		fatal("Can not set uid to SlurmUser(%u): %m",
		      slurm_conf.slurm_user_id);
	}
}

/*
 * Unshare the requested Linux namespaces for the calling process. A no-op on
 * platforms without unshare() support.
 *
 * IN unshare_sysv - unshare the System V semaphore namespace
 * IN unshare_files - unshare the file descriptor table
 * RET SLURM_SUCCESS or an errno on failure
 */
static int _unshare_namespaces(bool unshare_sysv, bool unshare_files)
{
#if HAVE_SYS_PRCTL_H
	int unshared = 0;

	if (unshare_files)
		unshared |= CLONE_FILES;
	if (unshare_sysv)
		unshared |= CLONE_SYSVSEM;

	if (unshared && unshare(unshared)) {
		int rc = errno;
		error("Unable to unshare(): %s", slurm_strerror(rc));
		return rc;
	}
#endif
	return SLURM_SUCCESS;
}

extern int restrict_privileges(void)
{
#if HAVE_SYS_PRCTL_H
	int rc;

	/* Stop any new privilege from being gained */
	if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) < 0) {
		rc = errno;
		error("Unable to disable new privileges: %s",
		      slurm_strerror(rc));
		return rc;
	}

	/*
	 * With keepcaps off, the kernel clears the permitted/effective/ambient
	 * capability sets when setresuid() transitions the uid away from 0.
	 * Combined with PR_SET_NO_NEW_PRIVS, no capabilities can be regained at
	 * exec().
	 */
	if (prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) < 0) {
		rc = errno;
		error("Unable to clear keepcaps: %s",
		      slurm_strerror(rc));
		return rc;
	}
#endif
	return SLURM_SUCCESS;
}

extern int start_new_session(void)
{
	/*
	 * Detach from the controlling terminal to prevent TIOCSTI input
	 * injection. EPERM means we are already a session leader.
	 */
	if (setsid() < 0) {
		int rc = errno;
		if (rc == EPERM) {
			debug2("%s: already a session leader: %s",
			       __func__, slurm_strerror(rc));
		} else {
			error("%s: Unable to setsid(): %s",
			      __func__, slurm_strerror(rc));
			return rc;
		}
	}

	return SLURM_SUCCESS;
}

extern int set_parent_death_signal(int sig)
{
#if HAVE_SYS_PRCTL_H
	/*
	 * Set the parent death signal after dropping credentials, as the kernel
	 * clears it on a credential change.
	 */
	if (prctl(PR_SET_PDEATHSIG, sig) < 0) {
		int rc = errno;
		error("Unable to autosend signal to child processes on process exit: %s",
		      slurm_strerror(rc));
		return rc;
	}
#endif
	return SLURM_SUCCESS;
}

extern int become_user(uid_t uid, gid_t gid, gid_t *gids, int gids_count,
		       bool drop_groups, bool unshare_sysv, bool unshare_files,
		       bool drop_priv, bool kill_child_on_exit,
		       bool reset_signals, bool new_session)
{
	int rc = EINVAL;

	/* Refuse the nobody user; resolve gid from the user if not set */
	if (uid == SLURM_AUTH_NOBODY)
		return ESLURM_AUTH_NOBODY;
	if (gid == SLURM_AUTH_NOBODY)
		gid = gid_from_uid(uid);

	/* gid resolution failed */
	if (gid == (gid_t) -1)
		return EINVAL;

	if (gids) {
		if ((rc = set_supplementary_groups(uid, gids, gids_count)))
			return rc;
	} else if (drop_groups && (rc = drop_supplementary_groups(uid, gid))) {
		return rc;
	}

	if ((rc = _unshare_namespaces(unshare_sysv, unshare_files)))
		return rc;

	if (drop_priv && (rc = restrict_privileges()))
		return rc;

	if (new_session && (rc = start_new_session()))
		return rc;

#ifdef __linux__
	if (setresgid(gid, gid, gid)) {
		rc = errno;
		error("%s: Unable to setresgid(): %s",
		      __func__, slurm_strerror(rc));
		return rc;
	}
	if (setresuid(uid, uid, uid)) {
		rc = errno;
		error("%s: Unable to setresuid(): %s",
		      __func__, slurm_strerror(rc));
		return rc;
	}
#else
	if (setgid(gid)) {
		rc = errno;
		error("Unable to setgid(): %s", slurm_strerror(rc));
		return rc;
	}
	if (setuid(uid)) {
		rc = errno;
		error("Unable to setuid(): %s", slurm_strerror(rc));
		return rc;
	}
#endif

	if (reset_signals)
		xsignal_reset_all();

	if (kill_child_on_exit && (rc = set_parent_death_signal(SIGKILL)))
		return rc;

#if HAVE_SYS_PRCTL_H
	/*
	 * Always allow normal user process to be dumpable even if privileged
	 * user was restricted
	 */
	if (prctl(PR_SET_DUMPABLE, 1) < 0)
		error("%s: Unable to set process as dumpable: %m", __func__);
#endif

	return SLURM_SUCCESS;
}