Closing it early results in zero length reads in some situations.
Logging that we forked via the launcher process also make more sense
and allows us to use log* functions.
While here, handle error condtions better by forcing a return
rather than handling an invalid state.
Fixes#260.
These won't be optimised away by the compiler and our arc4random
compat function should use them *if* available.
If none are then a warning will be emitted to say it's potentially insecure.
Hopefully only uclibc users will see this message.
Fixes#252.
This allows us to dup stdout and stderr onto stdin which is
guaranteed to be dupped to /dev/null.
This in turn avoids SIGPIPE when the privileged proccess launches
the script and it wants to write to stdout/stderr or stupidly
read from stdin.
Use memset instead of explicit_bzero to avoid the following build
failure with uclibc-ng since version 10.0.3 and
837d09e34c:
/home/fabrice/buildroot/output/host/lib/gcc/arm-buildroot-linux-uclibcgnueabi/12.3.0/../../../../arm-buildroot-linux-uclibcgnueabi/bin/ld: ../compat/arc4random.o: in function `_rs_stir_if_needed':
arc4random.c:(.text+0x8cc): undefined reference to `explicit_bzero'
Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
musl libc doesn't have __NR_clock_gettime definition,
but has __NR_clock_gettime32. clock_gettime implementation
fallbacks to 32-bit version if 64-bit is not supported by the kernel.
Signed-off-by: Oleg Lyovin <ovlevin@sberdevices.ru>
The issue occured while compiled by musl toolchain:
mmap2(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = ?
+++ killed by SIGSYS +++
This patchs allows seccomp to make __NR_mmap2 syscall.
Signed-off-by: Oleg Lyovin <ovlevin@sberdevices.ru>
Currently we don't attempt to validate a uri given, aside from
not allowing any space characters within.
If the option is `array uri` then the first two bytes are the
length of the uri in network order and the rest is a uri element.
The uri's are space separated for the variable because space is not
allowed within the uri.
This allows us to implement RFC 8572, Secure Zero Touch Provisioning.
* compat: use OpenSSL RAND_priv_bytes() for entropy
Use OpenSSL random number generator to seed arc4random() if available,
if it fails fall back to /dev/urandom.
* tests: link eloop-bench against LDADD lib
arc4random might depend on libcrypto so we need to link it.
The payload of the prefix exclude option was correctly created
but the amount of bytes to send in the DHCPv6 request was
always set to 0 which resulted in an invalid prefix exclude option
This patch fixes this behavior by calculating the correct amount
of bytes to send.
Privsep has a mini-eloop for reading data from other processes.
This mini-eloop processes signals as well so we can reap children.
During teardown we don't want to process SIGTERM or SIGINT again,
as that could trigger memory issues.
Hopefully fixes#247.
The optind get overwritten by reload_config(), so the reconf_reboot()
used a wrong argument count.
Signed-off-by: Petr Gotthard <petr.gotthard@centrum.cz>
* compat: Add OpenSSL libcrypto compatibility layer
Detect libcrypto in configure script. Only fall back
to using libcrypto when /usr libs are allowed and no
other compatible implementation is available or when
--with-openssl is passed explicitly.
Make sure libcrypto and libmd are never linked at the
same time.
Add OpenSSL based SHA256 and HMAC compat shims in
compat/crypt_openssl. Depeding on version and build flags,
libcrypto ships with a compatible SHA256 API in
"openssl/sha.h". OpenSSL 3 has deprecated the SHA API,
so if it is not detected we fall back to an EVP_DIGEST
based version.
Because the API might still be in use in OpenSSL internally,
the compatibility wrappers have a dhcpcd_ prefix to avoid
symbol conflicts.
* Add sha256 tests based on the existing hmac-md5 tests.
* compat: update arc4random() to newer chacha20 based version from OpenBSD
* arc4random: keep fd after first call to arc4random
privsep + chroot doesn't allow us to reopen /dev/urandom in
an unpriviledged process so we open the fd once and then
hold onto it.
When running our Ubuntu tests with libc6 and strlcpy overflow checks
enabled we found that the wrong size is passed to strlcpy resulting
in a crash because of an overflow.
This allows a POSIX resource limited sandbox to be used at least
with privilege separation, which is better than just disabling
privilege separation entirely for when SECCOMP stops working due to
libc/kernel changes.
* compat: sync pidfile.c with netbsd v1.16
- fix typos in word "otherwise".
- s/sucess/success/ in comment.
* compat: sync rb.c with netbsd v1.16
- fix typos in word "successfully", mainly s/succesfully/successfully/.
- toolify
* compat: sync strlcpy.c with openbsd v1.16
- I am retiring my old email address; replace it with my OpenBSD one.
* compat: sync arc4random_uniform.c with openbsd v1.3
