summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--doc/dlt.conf.5.md44
-rw-r--r--src/daemon/dlt-daemon.c38
-rw-r--r--src/daemon/dlt-daemon.h3
-rw-r--r--src/daemon/dlt.conf9
4 files changed, 91 insertions, 3 deletions
diff --git a/doc/dlt.conf.5.md b/doc/dlt.conf.5.md
index 08879b0..5142118 100644
--- a/doc/dlt.conf.5.md
+++ b/doc/dlt.conf.5.md
@@ -135,6 +135,50 @@ Read gateway configuration from another location
Default: /etc/dlt_gateway.conf
+# Permission configuration
+
+DLT daemon runs with e.g.
+ User: genivi_dlt
+ Group: genivi_dlt
+
+DLT user applications run with different user and group than dlt-daemon but with supplimentory group: dlt_user_apps_group
+
+<basedir>/dlt FIFO will be created by dlt-daemon with
+ User: genivi_dlt
+ Group: dlt_user_apps_group
+ Permission: 620
+
+so that only dlt-daemon can read and only processes in dlt_user_apps_group can write.
+
+<basedir>/dltpipes will be created by dlt-daemon with
+ User: genivi_dlt
+ Group: genivi_dlt
+ Permission: 3733 (i.e Sticky bit and SGID turned on)
+
+<basedir>/dltpipes/dlt<PID> FIFO will be created by dlt application (user lib) with
+ User: <user of the application>
+ Group: genivi_dlt (inherited from <basedir>dltpipes/ due to SGID)
+ Permission: 620
+
+Thus DLT user applications (and also or attackers) can create the dlt<PID> FIFO
+(for communication from dlt-daemon to DLT user application) under <basedir>/dltpipes/. Since sticky bit is set the applications who creates the FIFO can only rename/delete it.
+
+Since SGID of <basedir>/dltpipes is set the group of dlt<PID> FIFO will be genivi_dlt which enables dlt daemon to have write permission on all the dlt<PID> FIFO.
+
+One dlt user application cannot access dlt<PID> FIFO created by other dlt user application(if they run with different user).
+
+Owner group of daemon FIFO directory(Default: /tmp/dlt) (If not set, primary group of dlt-daemon process is used).
+Application should have write permission to this group for tracing into dlt. For this opton to work, dlt-daemon should have this group in it's supplementary group.
+
+## DaemonFifoGroup
+
+Owner group of daemon FIFO directory
+(If not set, primary group of dlt-daemon process is used)
+Application should have write permission to this group for tracing into dlt
+For this opton to work, dlt-daemon should have this group in it's Supplementary group
+
+ Default: group of dlt-daemon process (/tmp/dlt)
+
# CONTROL APPLICATION OPTIONS
## ControlSocketPath
diff --git a/src/daemon/dlt-daemon.c b/src/daemon/dlt-daemon.c
index 7b80ef1..c305887 100644
--- a/src/daemon/dlt-daemon.c
+++ b/src/daemon/dlt-daemon.c
@@ -39,6 +39,7 @@
#include <syslog.h>
#include <errno.h>
#include <pthread.h>
+#include <grp.h>
#ifdef linux
# include <sys/timerfd.h>
@@ -253,7 +254,8 @@ int option_file_parser(DltDaemonLocal *daemon_local)
if (strlen(DLT_USER_IPC_PATH) > DLT_IPC_PATH_MAX)
fprintf(stderr, "Provided path too long...trimming it to path[%s]\n",
daemon_local->flags.appSockPath);
-
+#else
+ memset(daemon_local->flags.daemonFifoGroup, 0, sizeof(daemon_local->flags.daemonFifoGroup));
#endif
daemon_local->flags.gatewayMode = 0;
strncpy(daemon_local->flags.gatewayConfigFile,
@@ -566,6 +568,11 @@ int option_file_parser(DltDaemonLocal *daemon_local)
intval);
}
}
+ else if(strcmp(token, "DaemonFifoGroup") == 0)
+ {
+ strncpy(daemon_local->flags.daemonFifoGroup, value, NAME_MAX);
+ daemon_local->flags.daemonFifoGroup[NAME_MAX] = 0;
+ }
else if (strcmp(token, "BindAddress") == 0)
{
DltBindAddress_t *newNode = NULL;
@@ -1085,6 +1092,35 @@ static int dlt_daemon_init_fifo(DltDaemonLocal *daemon_local)
return -1;
} /* if */
+ /* Set group of daemon FIFO */
+ if (daemon_local->flags.daemonFifoGroup[0] != 0)
+ {
+ errno = 0;
+ struct group * group_dlt = getgrnam(daemon_local->flags.daemonFifoGroup);
+ if (group_dlt)
+ {
+ ret = chown(tmpFifo, -1, group_dlt->gr_gid);
+ if (ret == -1)
+ {
+ dlt_vlog(LOG_ERR, "FIFO user %s cannot be chowned to group %s (%s)\n",
+ tmpFifo, daemon_local->flags.daemonFifoGroup,
+ strerror(errno));
+ }
+ }
+ else if ((errno == 0) || (errno == ENOENT) || (errno == EBADF) || (errno == EPERM))
+ {
+ dlt_vlog(LOG_ERR, "Group name %s is not found (%s)\n",
+ daemon_local->flags.daemonFifoGroup,
+ strerror(errno));
+ }
+ else
+ {
+ dlt_vlog(LOG_ERR, "Failed to get group id of %s (%s)\n",
+ daemon_local->flags.daemonFifoGroup,
+ strerror(errno));
+ }
+ }
+
fd = open(tmpFifo, O_RDWR);
if (fd == -1) {
diff --git a/src/daemon/dlt-daemon.h b/src/daemon/dlt-daemon.h
index 6c87335..3d35335 100644
--- a/src/daemon/dlt-daemon.h
+++ b/src/daemon/dlt-daemon.h
@@ -123,7 +123,8 @@ typedef struct
char userPipesDir[DLT_PATH_MAX]; /**< (String: Directory) directory where dltpipes reside (Default: /tmp/dltpipes) */
#endif
char daemonFifoName[DLT_PATH_MAX]; /**< (String: Filename) name of local fifo (Default: /tmp/dlt) */
- unsigned int port; /**< port number */
+ char daemonFifoGroup[DLT_PATH_MAX]; /**< (String: Group name) Owner group of local fifo (Default: Primary Group) */
+ unsigned int port; /**< port number */
char ctrlSockPath[DLT_DAEMON_FLAG_MAX]; /**< Path to Control socket */
int gatewayMode; /**< (Boolean) Gateway Mode */
char gatewayConfigFile[DLT_DAEMON_FLAG_MAX]; /**< Gateway config file path */
diff --git a/src/daemon/dlt.conf b/src/daemon/dlt.conf
index 746176d..f9f02a1 100644
--- a/src/daemon/dlt.conf
+++ b/src/daemon/dlt.conf
@@ -82,6 +82,13 @@ RingbufferStepSize = 500000
# GatewayConfigFile = /etc/dlt_gateway.conf
########################################################################
+# Permission configuration #
+# ==================================================================== #
+# Owner group of daemon FIFO directory(Default: /tmp/dlt)
+# (If not set, primary group of dlt-daemon process is used)
+# DaemonFifoGroup = dlt_user_apps_group
+
+########################################################################
# Control Application #
########################################################################
ControlSocketPath = /tmp/dlt-ctrl.sock
@@ -181,4 +188,4 @@ ControlSocketPath = /tmp/dlt-ctrl.sock
# The IP addresses must be separated with ',' or ';' but not with space character ' '
# If DLT_USE_IPv6 flag is ON, then only IPv6 addresses are accepted
# If DLT_USE_IPv6 flag is OFF, then only IPv4 addresses are accepted
-# BindAddress = 160.48.199.97;160.48.199.98 \ No newline at end of file
+# BindAddress = 160.48.199.97;160.48.199.98