When -B is specified, the daemon will only operate on files within the

[rrdtool.git] / src / rrd_daemon.c

diff --git a/src/rrd_daemon.c b/src/rrd_daemon.c
index abcb788..e869a86 100644 (file)
--- a/src/rrd_daemon.c
+++ b/src/rrd_daemon.c
@@ -179,6 +179,8 @@ static int config_flush_interval = 3600;
 static int config_flush_at_shutdown = 0;
 static char *config_pid_file = NULL;
 static char *config_base_dir = NULL;
+static size_t _config_base_dir_len = 0;
+static int config_write_base_only = 0;
 
 static listen_socket_t **config_listen_address_list = NULL;
 static int config_listen_address_list_len = 0;
@@ -809,6 +811,38 @@ static int buffer_get_field (char **buffer_ret, /* {{{ */
   return (0);
 } /* }}} int buffer_get_field */
 
+/* if we're restricting writes to the base directory,
+ * check whether the file falls within the dir
+ * returns 1 if OK, otherwise 0
+ */
+static int check_file_access (const char *file, int fd) /* {{{ */
+{
+  char error[CMD_MAX];
+  assert(file != NULL);
+
+  if (!config_write_base_only
+      || fd < 0 /* journal replay */
+      || config_base_dir == NULL)
+    return 1;
+
+  if (strstr(file, "../") != NULL) goto err;
+
+  /* relative paths without "../" are ok */
+  if (*file != '/') return 1;
+
+  /* file must be of the format base + "/" + <1+ char filename> */
+  if (strlen(file) < _config_base_dir_len + 2) goto err;
+  if (strncmp(file, config_base_dir, _config_base_dir_len) != 0) goto err;
+  if (*(file + _config_base_dir_len) != '/') goto err;
+
+  return 1;
+
+err:
+  snprintf(error, sizeof(error)-1, "-1 %s\n", rrd_strerror(EACCES));
+  swrite(fd, error, strlen(error));
+  return 0;
+} /* }}} static int check_file_access */
+
 static int flush_file (const char *filename) /* {{{ */
 {
   cache_item_t *ci;
@@ -1051,6 +1085,8 @@ static int handle_request_flush (int fd, /* {{{ */
     stats_flush_received++;
     pthread_mutex_unlock(&stats_lock);
 
+    if (!check_file_access(file, fd)) return 0;
+
     status = flush_file (file);
     if (status == 0)
       snprintf (result, sizeof (result), "0 Successfully flushed %s.\n", file);
@@ -1141,6 +1177,8 @@ static int handle_request_update (int fd, /* {{{ */
   stats_updates_received++;
   pthread_mutex_unlock(&stats_lock);
 
+  if (!check_file_access(file, fd)) return 0;
+
   pthread_mutex_lock (&cache_lock);
   ci = g_tree_lookup (cache_tree, file);
 
@@ -1339,14 +1377,14 @@ static int handle_request (int fd, socket_privilege privilege, /* {{{ */
 
   if (strcasecmp (command, "update") == 0)
   {
-    /* don't re-write updates in replay mode */
-    if (fd >= 0)
-      journal_write(command, buffer_ptr);
-
     status = has_privilege(privilege, PRIV_HIGH, fd);
     if (status <= 0)
       return status;
 
+    /* don't re-write updates in replay mode */
+    if (fd >= 0)
+      journal_write(command, buffer_ptr);
+
     return (handle_request_update (fd, buffer_ptr, buffer_size));
   }
   else if (strcasecmp (command, "wrote") == 0 && fd < 0)
@@ -1508,7 +1546,8 @@ static int journal_replay (const char *file) /* {{{ */
     size_t entry_len;
 
     ++line;
-    fgets(entry, sizeof(entry), fh);
+    if (fgets(entry, sizeof(entry), fh) == NULL)
+      break;
     entry_len = strlen(entry);
 
     /* check \n termination in case journal writing crashed mid-line */
@@ -1998,6 +2037,7 @@ static int daemonize (void) /* {{{ */
 {
   int status;
   int fd;
+  char *base_dir;
 
   fd = open_pidfile();
   if (fd < 0) return fd;
@@ -2005,7 +2045,6 @@ static int daemonize (void) /* {{{ */
   if (!stay_foreground)
   {
     pid_t child;
-    char *base_dir;
 
     child = fork ();
     if (child < 0)
@@ -2018,17 +2057,6 @@ static int daemonize (void) /* {{{ */
       return (1);
     }
 
-    /* Change into the /tmp directory. */
-    base_dir = (config_base_dir != NULL)
-      ? config_base_dir
-      : "/tmp";
-    status = chdir (base_dir);
-    if (status != 0)
-    {
-      fprintf (stderr, "daemonize: chdir (%s) failed.\n", base_dir);
-      return (-1);
-    }
-
     /* Become session leader */
     setsid ();
 
@@ -2042,6 +2070,17 @@ static int daemonize (void) /* {{{ */
     dup (0);
   } /* if (!stay_foreground) */
 
+  /* Change into the /tmp directory. */
+  base_dir = (config_base_dir != NULL)
+    ? config_base_dir
+    : "/tmp";
+  status = chdir (base_dir);
+  if (status != 0)
+  {
+    fprintf (stderr, "daemonize: chdir (%s) failed.\n", base_dir);
+    return (-1);
+  }
+
   install_signal_handlers();
 
   openlog ("rrdcached", LOG_PID, LOG_DAEMON);
@@ -2078,7 +2117,7 @@ static int read_options (int argc, char **argv) /* {{{ */
   int option;
   int status = 0;
 
-  while ((option = getopt(argc, argv, "gl:L:f:w:b:z:p:j:h?F")) != -1)
+  while ((option = getopt(argc, argv, "gl:L:f:w:b:Bz:p:j:h?F")) != -1)
   {
     switch (option)
     {
@@ -2163,6 +2202,10 @@ static int read_options (int argc, char **argv) /* {{{ */
         break;
       }
 
+      case 'B':
+        config_write_base_only = 1;
+        break;
+
       case 'b':
       {
         size_t len;
@@ -2188,6 +2231,8 @@ static int read_options (int argc, char **argv) /* {{{ */
           fprintf (stderr, "Invalid base directory: %s\n", optarg);
           return (4);
         }
+
+        _config_base_dir_len = len;
       }
       break;
 
@@ -2257,6 +2302,7 @@ static int read_options (int argc, char **argv) /* {{{ */
             "  -f <seconds>  Interval in which to flush dead data.\n"
             "  -p <file>     Location of the PID-file.\n"
             "  -b <dir>      Base directory to change to.\n"
+            "  -B            Restrict file access to paths within -b <dir>\n"
             "  -g            Do not fork and run in the foreground.\n"
             "  -j <dir>      Directory in which to create the journal files.\n"
             "  -F            Always flush all updates at shutdown\n"
@@ -2278,6 +2324,10 @@ static int read_options (int argc, char **argv) /* {{{ */
     fprintf(stderr, "WARNING: write delay (-z) should NOT be larger than"
             " write interval (-w) !\n");
 
+  if (config_write_base_only && config_base_dir == NULL)
+    fprintf(stderr, "WARNING: -B does not make sense without -b!\n"
+            "  Consult the rrdcached documentation\n");
+
   if (journal_cur == NULL)
     config_flush_at_shutdown = 1;