All the setrlimit calls have been moved to a new setup_limits function
that is called regardless the presence of the -U and -G options.
The new RLIMIT_CORE limit is set to allow the core dump to be written
in case of a crash (for more details: man core).
Signed-off-by: Federico Simoncelli <fsimonce(a)redhat.com>
---
src/main.c | 42 ++++++++++++++++++++++++++++++------------
1 files changed, 30 insertions(+), 12 deletions(-)
diff --git a/src/main.c b/src/main.c
index 552641e..a7922b5 100644
--- a/src/main.c
+++ b/src/main.c
@@ -24,6 +24,7 @@
#include <pwd.h>
#include <grp.h>
#include <sys/types.h>
+#include <sys/prctl.h>
#include <sys/wait.h>
#include <sys/stat.h>
#include <sys/socket.h>
@@ -1329,19 +1330,10 @@ static void setup_host_name(void)
uuid, name.nodename);
}
-static void setup_groups(void)
+static void setup_limits(void)
{
- int rv, i, j, h;
- int pngroups, sngroups, ngroups_max;
- gid_t *pgroup, *sgroup;
- struct rlimit rlim;
-
- if (!com.uname || !com.gname)
- return;
-
- /* before switching to a different user/group we must configure
- the limits for memlock and rtprio */
- rlim.rlim_cur = rlim.rlim_max= -1;
+ int rv;
+ struct rlimit rlim = { .rlim_cur = -1, .rlim_max= -1 };
rv = setrlimit(RLIMIT_MEMLOCK, &rlim);
if (rv < 0) {
@@ -1355,6 +1347,22 @@ static void setup_groups(void)
exit(EXIT_FAILURE);
}
+ rv = setrlimit(RLIMIT_CORE, &rlim);
+ if (rv < 0) {
+ log_error("cannot set the limits for core dumps %i", errno);
+ exit(EXIT_FAILURE);
+ }
+}
+
+static void setup_groups(void)
+{
+ int rv, i, j, h;
+ int pngroups, sngroups, ngroups_max;
+ gid_t *pgroup, *sgroup;
+
+ if (!com.uname || !com.gname)
+ return;
+
ngroups_max = sysconf(_SC_NGROUPS_MAX);
if (ngroups_max < 0) {
log_error("cannot get the max number of groups %i", errno);
@@ -1418,6 +1426,15 @@ static void setup_groups(void)
log_error("cannot set user id to %i errno %i", com.uid, errno);
}
+ /* When a program is owned by a user (group) other than the real user
+ * (group) ID of the process, the PR_SET_DUMPABLE option gets cleared.
+ * See RLIMIT_CORE in setup_limits and man 5 core.
+ */
+ rv = prctl(PR_SET_DUMPABLE, 1, 0, 0, 0);
+ if (rv < 0) {
+ log_error("cannot set dumpable process errno %i", com.uid, errno);
+ }
+
out:
free(pgroup);
}
@@ -1577,6 +1594,7 @@ static int do_daemon(void)
}
}
+ setup_limits();
setup_helper();
/* main task never does disk io, so we don't really need to set
--
1.7.1
Show replies by date