Add option to set owner group of daemon FIFO (#122)

New option to set owner group of daemon FIFO (Default: /tmp/dlt)
is added in dlt.conf. If this option is used properly, more
secure tracing can be realized.

Only application that is in dlt_user_apps_group can write log
message to daemon FIFO.

Signed-off-by: Yusuke Sato <yusuke-sato@apn.alpine.co.jp>

3 files changed, 47 insertions, 3 deletions

diff --git a/src/daemon/dlt-daemon.c b/src/daemon/dlt-daemon.c
index 7b80ef1..c305887 100644
--- a/src/daemon/dlt-daemon.c
+++ b/src/daemon/dlt-daemon.c
@@ -39,6 +39,7 @@
 #include <syslog.h>
 #include <errno.h>
 #include <pthread.h>
+#include <grp.h>
 
 #ifdef linux
 #   include <sys/timerfd.h>
@@ -253,7 +254,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
     if (strlen(DLT_USER_IPC_PATH) > DLT_IPC_PATH_MAX)
         fprintf(stderr, "Provided path too long...trimming it to path[%s]\n",
                 daemon_local->flags.appSockPath);
-
+#else
+    memset(daemon_local->flags.daemonFifoGroup, 0, sizeof(daemon_local->flags.daemonFifoGroup));
 #endif
     daemon_local->flags.gatewayMode = 0;
     strncpy(daemon_local->flags.gatewayConfigFile,
@@ -566,6 +568,11 @@ int option_file_parser(DltDaemonLocal *daemon_local)
                                     intval);
                         }
                     }
+                    else if(strcmp(token, "DaemonFifoGroup") == 0)
+                    {
+                        strncpy(daemon_local->flags.daemonFifoGroup, value, NAME_MAX);
+                        daemon_local->flags.daemonFifoGroup[NAME_MAX] = 0;
+                    }
                     else if (strcmp(token, "BindAddress") == 0)
                     {
                         DltBindAddress_t *newNode = NULL;
@@ -1085,6 +1092,35 @@ static int dlt_daemon_init_fifo(DltDaemonLocal *daemon_local)
         return -1;
     } /* if */
 
+    /* Set group of daemon FIFO */
+    if (daemon_local->flags.daemonFifoGroup[0] != 0)
+    {
+        errno = 0;
+        struct group * group_dlt = getgrnam(daemon_local->flags.daemonFifoGroup);
+        if (group_dlt)
+        {
+            ret = chown(tmpFifo, -1, group_dlt->gr_gid);
+            if (ret == -1)
+            {
+                dlt_vlog(LOG_ERR, "FIFO user %s cannot be chowned to group %s (%s)\n",
+                         tmpFifo, daemon_local->flags.daemonFifoGroup,
+                         strerror(errno));
+            }
+        }
+        else if ((errno == 0) || (errno == ENOENT) || (errno == EBADF) || (errno == EPERM))
+        {
+            dlt_vlog(LOG_ERR, "Group name %s is not found (%s)\n",
+                     daemon_local->flags.daemonFifoGroup,
+                     strerror(errno));
+        }
+        else
+        {
+            dlt_vlog(LOG_ERR, "Failed to get group id of %s (%s)\n",
+                     daemon_local->flags.daemonFifoGroup,
+                     strerror(errno));
+        }
+    }
+
     fd = open(tmpFifo, O_RDWR);
 
     if (fd == -1) {
diff --git a/src/daemon/dlt-daemon.h b/src/daemon/dlt-daemon.h
index 6c87335..3d35335 100644
--- a/src/daemon/dlt-daemon.h
+++ b/src/daemon/dlt-daemon.h
@@ -123,7 +123,8 @@ typedef struct
     char userPipesDir[DLT_PATH_MAX]; /**< (String: Directory) directory where dltpipes reside (Default: /tmp/dltpipes) */
 #endif
     char daemonFifoName[DLT_PATH_MAX]; /**< (String: Filename) name of local fifo (Default: /tmp/dlt) */
-    unsigned int port;  /**< port number */
+    char daemonFifoGroup[DLT_PATH_MAX]; /**< (String: Group name) Owner group of local fifo (Default: Primary Group) */
+    unsigned int port; /**< port number */
     char ctrlSockPath[DLT_DAEMON_FLAG_MAX]; /**< Path to Control socket */
     int gatewayMode; /**< (Boolean) Gateway Mode */
     char gatewayConfigFile[DLT_DAEMON_FLAG_MAX]; /**< Gateway config file path */
diff --git a/src/daemon/dlt.conf b/src/daemon/dlt.conf
index 746176d..f9f02a1 100644
--- a/src/daemon/dlt.conf
+++ b/src/daemon/dlt.conf
@@ -82,6 +82,13 @@ RingbufferStepSize = 500000
 # GatewayConfigFile = /etc/dlt_gateway.conf
 
 ########################################################################
+# Permission configuration                                             #
+# ==================================================================== #
+# Owner group of daemon FIFO directory(Default: /tmp/dlt)
+# (If not set, primary group of dlt-daemon process is used)
+# DaemonFifoGroup = dlt_user_apps_group
+
+########################################################################
 # Control Application                                                  #
 ########################################################################
 ControlSocketPath = /tmp/dlt-ctrl.sock
@@ -181,4 +188,4 @@ ControlSocketPath = /tmp/dlt-ctrl.sock
 # The IP addresses must be separated with ',' or ';' but not with space character ' ' 
 # If DLT_USE_IPv6 flag is ON, then only IPv6 addresses are accepted
 # If DLT_USE_IPv6 flag is OFF, then only IPv4 addresses are accepted
-# BindAddress = 160.48.199.97;160.48.199.98
\ No newline at end of file
+# BindAddress = 160.48.199.97;160.48.199.98