Return to stream_service_unix.c CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / strongswan / src / libstrongswan / networking / streams

Annotation of embedaddon/strongswan/src/libstrongswan/networking/streams/stream_service_unix.c, revision 1.1

1.1     ! misho       1: /*
        !             2:  * Copyright (C) 2013 Martin Willi
        !             3:  * Copyright (C) 2013 revosec AG
        !             4:  *
        !             5:  * This program is free software; you can redistribute it and/or modify it
        !             6:  * under the terms of the GNU General Public License as published by the
        !             7:  * Free Software Foundation; either version 2 of the License, or (at your
        !             8:  * option) any later version.  See <http://www.fsf.org/copyleft/gpl.txt>.
        !             9:  *
        !            10:  * This program is distributed in the hope that it will be useful, but
        !            11:  * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
        !            12:  * or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
        !            13:  * for more details.
        !            14:  */
        !            15: 
        !            16: #include <library.h>
        !            17: #include <networking/streams/stream_unix.h>
        !            18: 
        !            19: #include <errno.h>
        !            20: #include <unistd.h>
        !            21: #include <sys/socket.h>
        !            22: #include <sys/un.h>
        !            23: #include <sys/stat.h>
        !            24: 
        !            25: /**
        !            26:  * See header
        !            27:  */
        !            28: stream_service_t *stream_service_create_unix(char *uri, int backlog)
        !            29: {
        !            30:        struct sockaddr_un addr;
        !            31:        mode_t old;
        !            32:        int fd, len;
        !            33: 
        !            34:        len = stream_parse_uri_unix(uri, &addr);
        !            35:        if (len == -1)
        !            36:        {
        !            37:                DBG1(DBG_NET, "invalid stream URI: '%s'", uri);
        !            38:                return NULL;
        !            39:        }
        !            40:        if (!lib->caps->check(lib->caps, CAP_CHOWN))
        !            41:        {       /* required to chown(2) service socket */
        !            42:                DBG1(DBG_NET, "cannot change ownership of socket '%s' without "
        !            43:                         "CAP_CHOWN capability. socket directory should be accessible to "
        !            44:                         "UID/GID under which the daemon will run", uri);
        !            45:        }
        !            46:        fd = socket(AF_UNIX, SOCK_STREAM, 0);
        !            47:        if (fd == -1)
        !            48:        {
        !            49:                DBG1(DBG_NET, "opening socket '%s' failed: %s", uri, strerror(errno));
        !            50:                return NULL;
        !            51:        }
        !            52:        unlink(addr.sun_path);
        !            53: 
        !            54:        old = umask(S_IRWXO);
        !            55:        if (bind(fd, (struct sockaddr*)&addr, len) < 0)
        !            56:        {
        !            57:                DBG1(DBG_NET, "binding socket '%s' failed: %s", uri, strerror(errno));
        !            58:                close(fd);
        !            59:                return NULL;
        !            60:        }
        !            61:        umask(old);
        !            62:        /* Only attempt to change owner of socket if we have CAP_CHOWN. Otherwise,
        !            63:         * attempt to change group of socket to group under which charon runs after
        !            64:         * dropping caps. This requires the user that charon starts as to:
        !            65:         * a) Have write access to the socket dir.
        !            66:         * b) Belong to the group that charon will run under after dropping caps. */
        !            67:        if (lib->caps->check(lib->caps, CAP_CHOWN))
        !            68:        {
        !            69:                if (chown(addr.sun_path, lib->caps->get_uid(lib->caps),
        !            70:                                  lib->caps->get_gid(lib->caps)) != 0)
        !            71:                {
        !            72:                        DBG1(DBG_NET, "changing socket owner/group for '%s' failed: %s",
        !            73:                                 uri, strerror(errno));
        !            74:                }
        !            75:        }
        !            76:        else
        !            77:        {
        !            78:                if (chown(addr.sun_path, -1, lib->caps->get_gid(lib->caps)) != 0)
        !            79:                {
        !            80:                        DBG1(DBG_NET, "changing socket group for '%s' failed: %s",
        !            81:                                 uri, strerror(errno));
        !            82:                }
        !            83:        }
        !            84:        if (listen(fd, backlog) < 0)
        !            85:        {
        !            86:                DBG1(DBG_NET, "listen on socket '%s' failed: %s", uri, strerror(errno));
        !            87:                unlink(addr.sun_path);
        !            88:                close(fd);
        !            89:                return NULL;
        !            90:        }
        !            91:        return stream_service_create_from_fd(fd);
        !            92: }