nfs-utils - 1 of 6 - statd - drop privs

The following 6 patches have been ported to the 1.0.3 release the nfs-utils package. I'm hopefully that Neil will incorate these so I no longer have to continue porting them... ;-)

This first patch allows statd to run as a non-root user. If there is not an rpcuser account (which there is in our world) it will try to use the nobody account.

SteveD.

@@ -17,6 +17,10 @@
 #include <rpc/rpc.h>
 #include <rpc/pmap_clnt.h>
 #include <rpcmisc.h>
+#include <pwd.h>
+#include <grp.h>
+#include <sys/types.h>
+#include <fcntl.h>
 #include "statd.h"
 #include "version.h"
 

@@ -34,6 +38,7 @@
 char *  SM_BAK_DIR =  DEFAULT_SM_BAK_DIR;
 char *  SM_STAT_PATH = DEFAULT_SM_STAT_PATH;
 
+
 /* ----- end of state directory path stuff ------- */
 
 short int restart = 0;

@@ -66,6 +71,47 @@
 extern void simulator (int, char **);
 #endif
 
+/*
+ * Privilege dropper
+ */
+static void
+drop_privs(void)
+{
+  /* First locate user to jump to */
+  /* Prefer _not_ to use nobody as we'll own some files */
+  struct passwd* pw;
+
+  pw = getpwnam(RUN_AS_USER);
+  if (pw == NULL)
+  {
+    /* i.e. nobody */
+    log (L_WARNING, "Warning: You should really create user %s\n",
+         RUN_AS_USER);
+    pw = getpwnam(RUN_AS_FALLBACK);
+  }
+  if (pw == NULL)
+  {
+    die("Cannot start - cannot drop privs: getpwnam()\n");
+  }
+
+  initgroups(pw->pw_name, pw->pw_gid);
+
+  setgid(pw->pw_gid);
+  setuid(pw->pw_uid);
+
+  if (getgid() == 0)
+  {
+    die("Cannot start - cannot drop privs: getgid()\n");
+  }
+  else if (getuid() == 0)
+  {
+    die("Cannot start - cannot drop privs: getuid()\n");
+  }
+
+  /* Good enough */
+}
+
+
 
 #ifdef HAVE_TCP_WRAPPER 
 #include "tcpwrapper.h"

@@ -264,8 +310,6 @@
 						   daemon mode. */
 	}
 
-	log_init (name_p,version_p);
-
 	log_modes();
 
 #ifdef SIMULATIONS

@@ -298,6 +342,8 @@
 		}
 	}
 
+	log_init (name_p, version_p);
+
 	/* Child. */
 	signal (SIGHUP, killer);
 	signal (SIGINT, killer);

@@ -305,9 +351,33 @@
 	/* WARNING: the following works on Linux and SysV, but not BSD! */
 	signal(SIGCHLD, SIG_IGN);
 
+ 
+	/* cevans - we're going to drop root privs, but before we do that,
+	 * make sure to get our port <1024 socket
+	 */
+ 
+	/* Insist on starting as root - this means that when we setuid() away
+	 * from root, we'll keep current->dumpable=0 and prevent being messed
+	 * with (we may revert to user "nobody" - it's better than root
+	 */
+	if (getuid() != 0)
+		die("Startup failed: Please start rpc.statd as root\n");
+ 
+	/* Arm the ****** resolver before chroot() so it doesn't fail
+	 * trying to open /etc/ for the dozenth time
+	 */
+	sethostent(1);
+
 	/* initialize out_port */
 	statd_get_socket(out_port);
 
+	/* Drop privs */
+	drop_privs();
+
+	/* After dropping privs, verify we can access all the files we need */
+	if (access(".", R_OK|W_OK|X_OK) != 0)
+		die("Cannot access current directory after dropping privs: access()\n");
+
 	for (;;) {
 		if (!(run_mode & MODE_NOTIFY_ONLY)) {
 			/* Do not do pmap_unset() when running in notify mode.

@@ -10,3 +10,10 @@
 #include "system.h"
 #include "log.h"
 
+/* Users we try and run as (prefer non-nobody because nobody is overloaded */
+/* Also, the user we run as will own some important nfs state files */
+#define RUN_AS_USER   "rpcuser"
+/* Bah */
+#define RUN_AS_FALLBACK   "nobody"
+
+

@@ -32,7 +32,7 @@
 void log_init()
 {
 	if (!(run_mode & MODE_LOG_STDERR)) 
-		openlog(name_p, LOG_PID, LOG_DAEMON);
+		openlog(name_p, LOG_PID | LOG_NDELAY, LOG_DAEMON);
 
 	mypid = getpid();
 

Sorry for not looking at these sooner...

An effect of this patch is that if someone does a 'make install', statd won't work anymore without some chowning.

What would you think if just getting stat to run as whichever users owns /var/lib/nfs, and printing a warning if it is root.

Also the patch makes references to 'chroot' but never actually uses chroot.

The second patch uses:
/var/run/rpc.statd/rpc.statd.pid
as a pid file, which doesn't seem like the right sort of name. Either
/var/run/rpc.statd.pid
or
/var/run/nfs/rpc.statd.pid

would seem more appropriate, or is there some RedHat standard you are following.

If we did do a chroot in statd we wouldn't be able to remove the pid file any more. We could if it went in /var/lib/nfs, but I don't think that is the right place.

Maybe if we held a fd of the pid file open and used ftruncate to remove the pid. Would that work ok?

And I wish I knew why you thought mountd needed protection against SIGPIPE, though I guess it cannot hurt.

NeilBrown

-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

Hello,

True.... We do an adduser during the package installation...

Looking around it appears root owns /var/lib/nfs.. and the point of the patch is not to run a root..... I guess it all comes do to how secure you want statd.... security is never free.... :) Maybe you could add a compilation flag allowing people to control it that way...

I had to make it a directory so the pid file could be removed after the privs have been dropped (i.e. not longer running as root).

The privs dropping patch (i.e the first patch) makes the chroot no longer necessary... but holding might work but how would the unlink occur?

TCP aborts.... If a sender has a socket open and the receiver close()s the socket with data still unread, the sender gets a SIGPIPE.

SteveD.

-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

I had assumed that /var/lib/nfs would need to be chowned to "rpcuser" for statd to work, but I guess it doesn't.
However "state", "sm" and "sm.bak" must already exist and be owned by whoever state runs as.
So this is what I think I will do:

If 'sm' exists, statd takes on the identity of the owner, otherwise
it takes on the identity of the owner of /var/lib/nfs.
The "make install" script creates state, sm, and sm.bak and chowns
them to $SOMEUSER
The configure script sets $SOMEUSER to rpcuser if that is in
/etc/passwd, or nobody, but this setting can be over-ridden via a config option

statd will create /var/run/rpc.statd.pid as root and will keep and
open filehandle for it to ftruncate later. Scripts which check for this existance of the need to

	[ -s /var/run/rpc.statd.pid ]

This allows for trouble free upgrading, a normal pid filename, and still allows and even encourages good security.

Arh, that makes sense. The patch has already gone in anyway.

NeilBrown

-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs

Ok, I've just commited the following patch (plus new configure generated by autoconf) to nfs-utils CVS. Hopefully it does most of what you need.
Are you interested in submitting your current 'rc' scripts or an updated .spec file?

NeilBrown

2003-07-04 NeilBrown <[email protected]>
Steve Dickson <[email protected]>

statd cleanup:
* utils/statd/statd.c: create a pidfile with pid of statd, and truncate it when statd exists.
* utils/statd/statd.c: drop privs by setuid to owner of SM_DIR, and warn if this is root.
* utils/statd/statd.c: when statd forks, connect child to parent with a pipe, and send a byte down the pipe once the child is working properly.
* Makefile: create and chown sm, sm.bak, state when "make install"
* configure.in: add --with-statduser= option which defaults to "rpcuser" or "nobody"
* config.mk.in: pass "statduser" through to Makefile

Index: Makefile
===================================================================
RCS file: /cvsroot/nfs/nfs-utils/Makefile,v
retrieving revision 1.1.1.1

diff -u -r1.1.1.1 Makefile
@@ -20,3 +20,7 @@
 	touch $(STATEDIR)/xtab; chmod 644 $(STATEDIR)/xtab
 	touch $(STATEDIR)/etab; chmod 644 $(STATEDIR)/etab
 	touch $(STATEDIR)/rmtab; chmod 644 $(STATEDIR)/rmtab
+	mkdir -p $(STATEDIR)/sm $(STATEDIR)/sm.bak
+	touch $(STATEDIR)/state
+	chmod go-rwx $(STATEDIR)/sm $(STATEDIR)/sm.bak $(STATEDIR)/state
+	chown $(STATDUSER) $(STATEDIR)/sm $(STATEDIR)/sm.bak $(STATEDIR)/state

Index: config.mk.in
===================================================================
RCS file: /cvsroot/nfs/nfs-utils/config.mk.in,v
retrieving revision 1.8

diff -u -r1.8 config.mk.in
@@ -10,6 +10,7 @@
 SBINDIR		= @sbindir@
 MANDIR		= @mandir@
 STATEDIR	= $(install_prefix)@statedir@
+STATDUSER	= @statduser@
 
 ##################################################################
 # This is the prefix that will be used for nfsd and mountd. Leave this

Index: configure.in
===================================================================
RCS file: /cvsroot/nfs/nfs-utils/configure.in,v
retrieving revision 1.35

diff -u -r1.35 configure.in
@@ -20,6 +20,15 @@
 	statedir=$withval,
 	statedir=/var/lib/nfs)
 	AC_SUBST(statedir)
+AC_ARG_WITH(statduser,
+	[  --with-statduser=rpcuser user for statd to run under [rpcuser or nobody]],
+	statduser=$withval,
+	if grep -s '^rpcuser:' /etc/passwd > /dev/null; then
+		statduser=rpcuser
+	else
+		statduser=nobody
+	fi)
+	AC_SUBST(statduser)
 AC_ARG_ENABLE(nfsv3,
 	[  --enable-nfsv3          enable support for NFSv3],
 	enable_nfsv3=$enableval,

Index: utils/statd/log.c
===================================================================
RCS file: /cvsroot/nfs/nfs-utils/utils/statd/log.c,v retrieving revision 1.5

diff -u -r1.5 log.c
@@ -32,7 +32,7 @@
 void log_init()
 {
 	if (!(run_mode & MODE_LOG_STDERR)) 
-		openlog(name_p, LOG_PID, LOG_DAEMON);
+		openlog(name_p, LOG_PID | LOG_NDELAY, LOG_DAEMON);
 
 	mypid = getpid();
 

Index: utils/statd/statd.c
===================================================================
RCS file: /cvsroot/nfs/nfs-utils/utils/statd/statd.c,v retrieving revision 1.13

-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including Data Reports, E-commerce, Portals, and Forums are available now. Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100006ave/direct;at.asp_061203_01/01
_______________________________________________
NFS maillist - [email protected]
https://lists.sourceforge.net/lists/listinfo/nfs