|
 |
500513 |
diff -up ./src/daemon/fapolicyd.c.already-started ./src/daemon/fapolicyd.c
|
|
|
500513 |
--- ./src/daemon/fapolicyd.c.already-started 2023-01-12 17:40:45.366909652 +0100
|
|
|
500513 |
+++ ./src/daemon/fapolicyd.c 2023-01-12 17:46:22.458139519 +0100
|
|
|
500513 |
@@ -378,6 +378,58 @@ static void usage(void)
|
|
|
500513 |
}
|
|
|
500513 |
|
|
|
500513 |
|
|
|
500513 |
+int already_running(void)
|
|
|
500513 |
+{
|
|
|
500513 |
+ int pidfd = open(pidfile, O_RDONLY);
|
|
|
500513 |
+ if (pidfd >= 0) {
|
|
|
500513 |
+ char pid_buf[16];
|
|
|
500513 |
+
|
|
|
500513 |
+ if (fd_fgets(pid_buf, sizeof(pid_buf), pidfd)) {
|
|
|
500513 |
+ int pid;
|
|
|
500513 |
+ char exe_buf[80], my_path[80];
|
|
|
500513 |
+
|
|
|
500513 |
+ // Get our path
|
|
|
500513 |
+ if (get_program_from_pid(getpid(),
|
|
|
500513 |
+ sizeof(exe_buf), my_path) == NULL)
|
|
|
500513 |
+ goto err_out; // shouldn't happen, but be safe
|
|
|
500513 |
+
|
|
|
500513 |
+ // convert pidfile to integer
|
|
|
500513 |
+ errno = 0;
|
|
|
500513 |
+ pid = strtoul(pid_buf, NULL, 10);
|
|
|
500513 |
+ if (errno)
|
|
|
500513 |
+ goto err_out; // shouldn't happen, but be safe
|
|
|
500513 |
+
|
|
|
500513 |
+ // verify it really is fapolicyd
|
|
|
500513 |
+ if (get_program_from_pid(pid,
|
|
|
500513 |
+ sizeof(exe_buf), exe_buf) == NULL)
|
|
|
500513 |
+ goto good; //if pid doesn't exist, we're OK
|
|
|
500513 |
+
|
|
|
500513 |
+ // If the path doesn't have fapolicyd in it, we're OK
|
|
|
500513 |
+ if (strstr(exe_buf, "fapolicyd") == NULL)
|
|
|
500513 |
+ goto good;
|
|
|
500513 |
+
|
|
|
500513 |
+ if (strcmp(exe_buf, my_path) == 0)
|
|
|
500513 |
+ goto err_out; // if the same, we need to exit
|
|
|
500513 |
+
|
|
|
500513 |
+ // one last sanity check in case path is unexpected
|
|
|
500513 |
+ // for example: /sbin/fapolicyd & /home/test/fapolicyd
|
|
|
500513 |
+ if (pid != getpid())
|
|
|
500513 |
+ goto err_out;
|
|
|
500513 |
+good:
|
|
|
500513 |
+ close(pidfd);
|
|
|
500513 |
+ unlink(pidfile);
|
|
|
500513 |
+ return 0;
|
|
|
500513 |
+ } else
|
|
|
500513 |
+ msg(LOG_ERR, "fapolicyd pid file found but unreadable");
|
|
|
500513 |
+err_out: // At this point, we have a pid file, let's just assume it's alive
|
|
|
500513 |
+ // because if 2 are running, it deadlocks the machine
|
|
|
500513 |
+ close(pidfd);
|
|
|
500513 |
+ return 1;
|
|
|
500513 |
+ }
|
|
|
500513 |
+ return 0; // pid file doesn't exist, we're good to go
|
|
|
500513 |
+}
|
|
|
500513 |
+
|
|
|
500513 |
+
|
|
|
500513 |
int main(int argc, const char *argv[])
|
|
|
500513 |
{
|
|
|
500513 |
struct pollfd pfd[2];
|
|
|
500513 |
@@ -428,6 +480,11 @@ int main(int argc, const char *argv[])
|
|
|
500513 |
}
|
|
|
500513 |
}
|
|
|
500513 |
|
|
|
500513 |
+ if (already_running()) {
|
|
|
500513 |
+ msg(LOG_ERR, "fapolicyd is already running");
|
|
|
500513 |
+ exit(1);
|
|
|
500513 |
+ }
|
|
|
500513 |
+
|
|
|
500513 |
// Set a couple signal handlers
|
|
|
500513 |
sa.sa_flags = 0;
|
|
|
500513 |
sigemptyset(&sa.sa_mask);
|
|
|
500513 |
@@ -446,9 +503,6 @@ int main(int argc, const char *argv[])
|
|
|
500513 |
setrlimit(RLIMIT_FSIZE, &limit);
|
|
|
500513 |
setrlimit(RLIMIT_NOFILE, &limit);
|
|
|
500513 |
|
|
|
500513 |
- // Set strict umask
|
|
|
500513 |
- (void) umask( 0117 );
|
|
|
500513 |
-
|
|
|
500513 |
// get more time slices because everything is waiting on us
|
|
|
500513 |
rc = nice(-config.nice_val);
|
|
|
500513 |
if (rc == -1)
|
|
|
500513 |
@@ -473,17 +527,20 @@ int main(int argc, const char *argv[])
|
|
|
500513 |
exit(1);
|
|
|
500513 |
}
|
|
|
500513 |
|
|
|
500513 |
- if (preconstruct_fifo(&config)) {
|
|
|
500513 |
- msg(LOG_ERR, "Cannot contruct a pipe");
|
|
|
500513 |
- exit(1);
|
|
|
500513 |
- }
|
|
|
500513 |
-
|
|
|
500513 |
// Setup filesystem to watch list
|
|
|
500513 |
init_fs_list(config.watch_fs);
|
|
|
500513 |
|
|
|
500513 |
// Write the pid file for the init system
|
|
|
500513 |
write_pid_file();
|
|
|
500513 |
|
|
|
500513 |
+ // Set strict umask
|
|
|
500513 |
+ (void) umask( 0117 );
|
|
|
500513 |
+
|
|
|
500513 |
+ if (preconstruct_fifo(&config)) {
|
|
|
500513 |
+ msg(LOG_ERR, "Cannot contruct a pipe");
|
|
|
500513 |
+ exit(1);
|
|
|
500513 |
+ }
|
|
|
500513 |
+
|
|
|
500513 |
// If we are not going to be root, then setup necessary capabilities
|
|
|
500513 |
if (config.uid != 0) {
|
|
|
500513 |
capng_clear(CAPNG_SELECT_BOTH);
|