path: root/src/daemon.c

#include "port/stdio.h"			/* for snprintf */
#include "port/string.h"		/* for strdup */
#include "port/limits.h"		/* for PATH_MAX */
#include "port/noreturn.h"		/* for NORETURN */

#include "daemon.h"
#include "log.h"
#include "signals.h"
#include "pidfile.h"

#include <sys/types.h>			/* for pid_t, ssize_t, off_t */
#include <unistd.h>			/* for getppid, geteuid, fork,
					       chdir, pipe, sysconf */
#include <stdlib.h>			/* for malloc, free */
#include <errno.h>			/* for errno */
#include <sys/stat.h>			/* for umask */
#include <fcntl.h>			/* for O_RDWR */
#include <grp.h>			/* for getgrnam, setgid */
#include <pwd.h>			/* for getpwnam, setuid */

static int exit_code_pipe[2] = { -1, -1 };

int daemon_parent_pipe[2] = { -1, -1 };

#define TERMINATE_EXIT_CODE 99
#define TERMINATE_PARENT 98

struct daemon_t {
	daemon_params_t params;		/**< the parameters for creation */
	error_t error;			/**< error of last start */
	struct pidfile_t pidfile;	/**< pid/lock file of the daemon */
	struct group *groupent;		/**< group entry */
	struct passwd *userent;		/**< password entry */
};

daemon_p daemon_new( daemon_params_t params,
		     error_t *error ) {
	daemon_p d;
	
	d = (struct daemon_t *)malloc( sizeof ( struct daemon_t ) );
	if( d == NULL ) {
		*error = ERR_OUT_OF_MEMORY;
		return NULL;
	}

	d->error = -1;	
	d->params = params;

	if( params.daemon_name == NULL ) {
		*error = ERR_INVALID_VALUE;
		return NULL;
	}
		
	if( params.pid_filename == NULL ) {
		pidfile_set_from_daemon_name( &d->pidfile, params.daemon_name );
	} else {
		pidfile_set_from_filename( &d->pidfile, params.pid_filename );
	}

	*error = OK;
	return d;
}

void daemon_free( daemon_p d ) {
	free( d );
	d = NULL;
}

static error_t close_fd( int fd ) {
	if( close( fd ) < 0 ) {
		switch( errno ) {
			case EBADF:
				/* skip */
				break;
	
			default:
				LOG( LOG_EMERG, "Error while closing file descriptor %d: %s (%d)",
					fd, strerror( errno ), errno );
				return ERR_INTERNAL;
		}
	}

	return OK;
}

static error_t daemon_close_standard_fds( void ) {
	error_t error;

	if( ( error = close_fd( STDIN_FILENO ) ) != OK ) return error;
	if( ( error = close_fd( STDOUT_FILENO ) ) != OK ) return error;
	if( ( error = close_fd( STDERR_FILENO ) ) != OK ) return error;

	return OK;
	
}

static error_t daemon_close_all_fds( void ) {
	long nof_files;
	int i;
	error_t error;
	
	nof_files = sysconf( _SC_OPEN_MAX );
	if( nof_files < 0 ) {
		LOG( LOG_EMERG, "Unable to retrieve maximal number of files: %s (%d)",
			strerror( errno ), errno );
		return ERR_INTERNAL;
	}
	LOG( LOG_DEBUG, "Closing all filedescriptors up to %ld", nof_files );

	for( i = 0; i < nof_files; i++ ) {
		if( ( i == STDIN_FILENO ) ||
		    ( i == STDOUT_FILENO ) ||
		    ( i == STDERR_FILENO ) ||
		    ( i == daemon_signal_pipe[0] ) ||
		    ( i == daemon_signal_pipe[1] ) ||
		    ( i == daemon_parent_pipe[0] ) ||
		    ( i == daemon_parent_pipe[1] ) ||
		    ( i == exit_code_pipe[0] ) ||
		    ( i == exit_code_pipe[1] ) ) {
			continue;
		}
		if( ( error = close_fd( i ) ) != OK ) return error;
	}

	return OK;
}

static error_t open_null_fd( int must_fd, int flags ) {
	int fd;

	fd = open( "/dev/null", flags );
	if( fd < 0 ) {
		LOG( LOG_EMERG, "Unable to open fd %d as /dev/null: %s (%d)",
			must_fd, strerror( errno ), errno );
		return ERR_INTERNAL;
	}
	if( fd != must_fd ) {
		LOG( LOG_EMERG, "Something is wrong with the file descriptors (expecting %d,got %d)!",
			must_fd, fd );
		return ERR_PROGRAMMING;
	}

	return OK;
}

static void atomar_write( int fd, void *data, size_t data_len ) {
	ssize_t res;

atomar_write_again:
	res = write( fd, data, data_len );
	if( res < 0 ) {
		if( errno == EINTR ) goto atomar_write_again;
		LOG( LOG_EMERG, "Error in atomar write to fd %d: %s (%d)",
			fd, strerror( errno ), errno );
	} else if( (size_t)res != data_len ) {
		LOG( LOG_EMERG, "Unexpected number of octets %zd in atomar write to fd %d (expected %zd)",
			res, fd, data_len );
	}
}

static void atomar_read( int fd, void *data, size_t data_len ) {
	ssize_t res;

atomar_read_again:
	res = read( fd, data, data_len );
	if( res < 0 ) {
		if( errno == EINTR ) goto atomar_read_again;
		LOG( LOG_EMERG, "Error in atmoar read from fd %d: %s (%d)",
			fd, strerror( errno ), errno );
	} else if( (size_t)res != data_len ) {
		LOG( LOG_EMERG, "Unexpected number of octets %zd in atomar read from fd %d (expected %zd)",
			res, fd, data_len );
	}
}

error_t daemon_start( daemon_p d ) {
	pid_t pid;
	mode_t mode;
	error_t error;
	int exit_code;
	
	/* Our parent is already the init process (which has pid 1 by
	 * convention), we are already a daemon. This is a programming
	 * error..
	 */
	if( getppid( ) == 1 ) {
		LOG( LOG_EMERG, "Already running as daemon!" );
		return( d->error = ERR_PROGRAMMING );
	}
	
	/* Are we starting as root? If not, bail out, we need root
	 * permissions because we have to listen to ports below 1024
	 * or we must open logfiles/pidfiles with proper permissions.
	 * Also we must change to the proper running user/group and
	 * we must be root (uid 0 by convention) for that.
	 */
	if( geteuid( ) != 0 ) {
		LOG( LOG_EMERG, "Unable to start daemon as not root user!" );
		return( d->error = ERR_INVALID_STATE );
	}

	/* We fork so SIGCHLD signals get to the parent and grandfather.
	 * We don't want that and we are installing empty signal handlers.
	 */
#if defined( SIGCHLD ) && defined( SIGCLD )
#if SIGCLD != SIGCHLD
	signal_install_empty( SIGCLD, 0 );
	signal_install_empty( SIGCHLD, 0 );
#else
#if defined( SIGCHLD )
	signal_install_empty( SIGCHLD, 0 );
#endif
#if defined( SIGCLD )
	signal_install_empty( SIGCLD, 0 );
#endif
#endif
#endif

	/* first pipe communicates from parent of daemon and daemon
	 * itself back to the grand-parent (exit codes).
	 */
	if( pipe( exit_code_pipe ) < 0 ) {
		LOG( LOG_EMERG, "Unable to create exit code pipe: %s (%d)",
			strerror( errno ), errno );
		return ( d->error = ERR_INTERNAL );
	}
	LOG( LOG_DEBUG, "Created exit code pipe (%d,%d)", exit_code_pipe[0], exit_code_pipe[1] );

	/* first fork: make sure we are no longer process group leader.
	 * So we can get our own process group leader by calling setsid
	 */
	switch( ( pid = fork( ) ) ) {
		case -1:
			/* error */
			LOG( LOG_EMERG, "Unable to fork the first time: %s", strerror( errno ) );
			return ( d->error = ERR_INTERNAL );
		
		case 0:
			/* the child becomes the daemon */
			LOG( LOG_DEBUG, "First fork reached" );
			break;
			
		default:
			/* the parent waits till it gets feedback from
			 * the child (error pipe)
			 */
			/* TODO: wait for some time for correct exit
			 * code from the error pipe
			 */
			LOG( LOG_DEBUG, "Parent after first fork: child is %d", pid );
			return ( d->error = TERMINATE_EXIT_CODE );
	}

	/* second pipe communicates from the daemon back to its parent
	 * (for termination and cleanup which can only be done as root) 
	 */
	if( pipe( daemon_parent_pipe ) < 0 ) {
		LOG( LOG_EMERG, "Unable to create parent pipe: %s (%d)",
			strerror( errno ), errno );
		return ( d->error = ERR_INTERNAL );
	}
	LOG( LOG_DEBUG, "Created parent pipe (%d,%d)", daemon_parent_pipe[0], daemon_parent_pipe[1] );

	/* Put the first child in it's own process group and finally detach it
	 * from its controlling terminal. This ensure we don't get funny
	 * signals which could kill the daemon.
	 */
	if( setsid( ) < 0 ) {
		/* should actually never fail */
		LOG( LOG_EMERG, "Starting new process group session for the parent of the daemon failed: %s", strerror( errno ) );
		return ERR_INTERNAL;
	}

	/* We fork so SIGCHLD signals get to the parent and grandfather.
	 * We don't want that and we are installing empty signal handlers.
	 */
#if defined( SIGCHLD ) && defined( SIGCLD )
#if SIGCLD != SIGCHLD
	signal_install_empty( SIGCLD, 0 );
	signal_install_empty( SIGCHLD, 0 );
#else
#if defined( SIGCHLD )
	signal_install_empty( SIGCHLD, 0 );
#endif
#if defined( SIGCLD )
	signal_install_empty( SIGCLD, 0 );
#endif
#endif
#endif
	
	/* Now that the parent is process group leader, fork again. This
	 * way the final child can not inherit a controlling terminal
	  */
	switch( ( pid = fork( ) ) ) {
		case -1:
			/* error */
			LOG( LOG_EMERG, "Unable to fork the second time: %s", strerror( errno ) );
			return ( d->error = ERR_INTERNAL );
		
		case 0:
			/* the child becomes the daemon */
			LOG( LOG_DEBUG, "Second fork reached" );
			break;
			
		default:
			(void)signal_install_handlers_parent( );
			LOG( LOG_DEBUG, "Parent after second fork: child (and daemon) is %d", pid );
			return ( d->error = TERMINATE_PARENT );
	}

	/* Now install signal handlers */
	if( ( error = signal_initialize( ) ) != OK )
		return ( d->error = error );
	if( ( error = signal_install_handlers_daemon( ) ) != OK )
		return ( d->error = error );
		
	/* Put the daemon in it's own process group and finally detach it
	 * from its controlling terminal. This ensure we don't get funny
	 * signals which could kill the daemon.
	 */
	if( setsid( ) < 0 ) {
		/* should actually never fail */
		LOG( LOG_EMERG, "Starting new process group for daemon session failed: %s", strerror( errno ) );
		return ERR_INTERNAL;
	}
		
	/* Change to the root directory for several reasons:
	 * - all but the root directory we may want to unmount without
	 *   stopping the daemon
	 * - we don't have write permissions there so a core dump
	 *   would not result in DoSA
	 * - non-priviledged users can't do anything in the root
	 *   directory (especially they can't write files there)
	 */
	if( chdir( "/" ) < 0 ) {
		LOG( LOG_EMERG, "Changing to root diretory failed: %s", strerror( errno ) );
		return ERR_INTERNAL;
	}
	LOG( LOG_DEBUG, "Changed to root directory /" );
	
	/* Change the umask to 0133 temporarily so we don't have to
	 * chmod the logfiles, pidfiles later.
	 *
	 * Create pid files with permissions 0644 (rw-r--r--)
	 */
	mode = umask( 0133 );
	LOG( LOG_DEBUG, "Switched umask from %04o to %04o", mode, 0133 );
	
	/* check if another daemon is already running, if yes, bail out */
	if( is_daemon_running( &d->pidfile, &pid, &error ) || ( error != OK ) ) {
		if( error == OK ) {
			LOG( LOG_EMERG, "Another daemon is already running with pid '%d', can't start!", pid );
		}
		return ERR_INTERNAL;
	}

	/* we loose logfile and syslog file descriptors anyway, so close
	 * them here */
	closelogtosyslog( );
	closelogtofile( );
	closelogtostderr( );
	
	/* close all filedescriptors */
	if( daemon_close_all_fds( ) != OK )
		return ERR_INTERNAL;

	/* reopen the logs to the logfile and syslog (not stderr) */
	reopenlogtosyslog( );
	reopenlogtofile( );
		
	/* create and lock the pidfile now, write pid of daemon into it */
	if( pidfile_create( &d->pidfile ) != OK ) {
		return ERR_INTERNAL;
	}
	
	/* Install the final permissions for new files. The reason is
	 * simple: We don't want to create files in a defective part
	 * of the daemon, especially third party code. We don't know
	 * what kind of plugins we gonna integrate..
	 *
	 * Make sure that no files can be written except the ones belonging
	 * to us (because now we are no longer root) and that no files can
	 * be created with executable permission (code injection!)
	 *
	 * New files always get the permission 640 (rw-r-----)
	 */
	mode = umask( 0137 );
	LOG( LOG_DEBUG, "Switched umask from %04o to %04o", mode, 0137 );

	/* drop permissions to a non-priviledged user now */
	if( ( d->params.group_name != NULL ) && ( d->params.user_name != NULL ) ) {
		errno = 0;
		d->groupent = getgrnam( d->params.group_name );
		if( d->groupent == NULL ) {
			if( errno == 0 ) {
				LOG( LOG_EMERG, "No group '%s' found", d->params.group_name );
			} else {
				LOG( LOG_EMERG, "Unable to retrieve group information for group '%s': %s (%d)",
					d->params.group_name, strerror( errno ), errno );
			}
			return ERR_INTERNAL;
		}

		errno = 0;
		d->userent = getpwnam( d->params.user_name );
		if( d->userent == NULL ) {
			if( errno == 0 ) {
				LOG( LOG_EMERG, "No user '%s' found", d->params.user_name );
			} else {
				LOG( LOG_EMERG, "Unable to retrieve user information for user '%s': %s (%d)",
					d->params.user_name, strerror( errno ), errno );
			}
			return ERR_INTERNAL;
		}

		if( setgid( d->userent->pw_gid ) < 0 ) {
			LOG( LOG_EMERG, "Setting unprivileged group failed: %s (%d)",
				strerror( errno ), errno );
			return ERR_INTERNAL;
		}

		if( setuid( d->userent->pw_uid ) < 0 ) {
			LOG( LOG_EMERG, "Setting unprivileged user failed: %s (%d)",
				strerror( errno ), errno );
			return ERR_INTERNAL;
		}

		/* TODO: setsid and setting all groups of the user */
		/* TODO: also check the permissions of the home dir
		 *       of the unpriviledged user */

		LOG( LOG_DEBUG, "Switched to user '%s' (%d) and group '%s' (%d)",
			d->params.user_name, d->userent->pw_uid,
			d->params.group_name, d->userent->pw_gid );
	}

	/* assign stdin/stdout/stderr again to something harmless
	 * (/dev/null). Do this as late as possible, so somebody
	 * starting the daemon by hand still gets error messages
	 * on stderr.
	 */
	if( ( error = daemon_close_standard_fds( ) ) != OK ) return error;
	if( ( error = open_null_fd( STDIN_FILENO, O_RDONLY ) ) != OK ) return error;
	if( ( error = open_null_fd( STDOUT_FILENO, O_WRONLY ) ) != OK ) return error;
	if( ( error = open_null_fd( STDERR_FILENO, O_WRONLY ) ) != OK ) return error;

	/* signal the grand-parent process, that he can return 0 to
	 * the calling shell/script
	 */
	exit_code = EXIT_SUCCESS;
	atomar_write( exit_code_pipe[1], &exit_code, sizeof( int ) );

	return ( d->error = OK );
}

NORETURN void daemon_exit( daemon_p d ) {
	int exit_code;
	int pid_file_fd;

	LOG( LOG_DEBUG, "daemon_exit called with error %d", d->error );

	switch( d->error ) {
		case TERMINATE_EXIT_CODE:
			/* wait here for exit code in exit_code_pipe
			 * so we can return the correct exit code to
			 * the calling script or shell
			 */
			LOG( LOG_DEBUG, "Waiting on exit_code pipe for exit code" );

			atomar_read( exit_code_pipe[0], &exit_code, sizeof( int ) );

			LOG( LOG_DEBUG, "Terminating grand-parent of daemon with code %d (PID: %lu)",
				exit_code, getpid( ) );

			signal_terminate( );

			/* Do not close file descriptors of the child!
			 * We are the father or grand-father process
			 */
			_exit( exit_code );

		case TERMINATE_PARENT:
			/* TODO: handle houskeeping here which needs
			 *       root rights (log rotation?)
			 */

			/* wait for termination signal */
			LOG( LOG_DEBUG, "Waiting on parent pipe for termination signal" );

			atomar_read( daemon_parent_pipe[0], &pid_file_fd, sizeof( int ) );
			LOG( LOG_DEBUG, "Parent got termination (pidfile fd: %d).. cleaning up now (PID: %lu)",
				pid_file_fd, getpid( ) );

			/* we need root permissions for that! */
			d->pidfile.fd = pid_file_fd;
			(void)pidfile_remove( &d->pidfile );

			signal_terminate( );

			LOG( LOG_DEBUG, "Terminating parent of daemon pid file fd %d (PID %lu)",
				pid_file_fd, getpid( ) );

			/* exit code is irrelevant here.. */
			exit( EXIT_SUCCESS );

		case OK:
			/* close and unlock the pidfile here */
			(void)pidfile_release( &d->pidfile );

			/* This is the daemon terminating, signal the
			 * parent that we are terminating
			 */
			atomar_write( daemon_parent_pipe[1], &d->pidfile.fd, sizeof( int ) );

			signal_terminate( );

			LOG( LOG_DEBUG, "Terminating daemon (PID: %lu)", getpid( ) );

			/* exit code is irrelevant here */
			_exit( EXIT_SUCCESS );
		
		default:
			/* no exit_code_pipe exists yet, we are before the
			 * first fork, so terminate with proper exit code
			 */
			if( exit_code_pipe[1] == -1 ) {
				exit( EXIT_FAILURE );
			}
			
			/* This is an error case, communicate exit code back
			 * to grand-parent
			 */
			exit_code = EXIT_FAILURE;
			atomar_write( exit_code_pipe[1], &exit_code, sizeof( int ) );

			/* also terminate the parent of the daemon */
			atomar_write( daemon_parent_pipe[1], &d->pidfile.fd, sizeof( int ) );

			signal_terminate( );

			LOG( LOG_DEBUG, "Terminating daemon (PID: %lu)", getpid( ) );

			/* exit code is irrelevant here */
			_exit( EXIT_SUCCESS );
	}
	
	/* silence up some versions of the GCC compiler ("noreturn function returns"),
	 * because they errornously tread _exit as a return, which is clearly wrong
	 * (experienced with gcc 3.3.5 on OpenBSD 4.3) */
	exit( EXIT_SUCCESS );
}