Update of /cvsroot/openantivirus/samba-vscan/f-secure
In directory sc8-pr-cvs1:/tmp/cvs-serv2379
Modified Files:
Tag: VSCAN_0_3
vscan-fsav.c vscan-fsav.conf vscan-fsav_core.c
vscan-fsav_core.h
Log Message:
patch by Oliver. If fsavd runs as scanning daemon for all users,
switch to a specified user ID.
Index: vscan-fsav.c
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/f-secure/Attic/vscan-fsav.c,v
retrieving revision 1.1.2.2
retrieving revision 1.1.2.3
diff -u -d -r1.1.2.2 -r1.1.2.3
--- vscan-fsav.c 10 Dec 2003 15:17:08 -0000 1.1.2.2
+++ vscan-fsav.c 8 Jan 2004 18:41:05 -0000 1.1.2.3
@@ -49,6 +49,7 @@
pstring fsav_user; /* needed only for userinstance socket name */
BOOL fsav_archive; /* scan archives */
BOOL fsav_mime; /* scan archives */
+uid_t fsav_connect_uid; /* connect to socket as uid */
int fsav_maxnested; /* maximum level archives */
int fsav_timeout; /* scan timeout */
@@ -156,7 +157,8 @@
} else if (StrCaseCmp("exclude file types", param) == 0) {
pstrcpy(exclude_file_types, value);
DEBUG(3, ("Exclude list is: %s\n", exclude_file_types));
- } else if (StrCaseCmp("fsav user instance", param) == 0) {
+ } else if (StrCaseCmp("fsav userinstance", param) == 0) {
+ DEBUG(3, ("fsav user instance value : %s\n", value));
set_boolean(&fsav_userinstance, value);
DEBUG(3,
("fsav user instance is: %d\n", fsav_userinstance));
@@ -166,7 +168,7 @@
} else if (StrCaseCmp("fsav binary", param) == 0) {
pstrcpy(fsav_binary, value);
DEBUG(3, ("fsav binary: %s\n", fsav_binary));
- } else if (StrCaseCmp("fsav db dir ", param) == 0) {
+ } else if (StrCaseCmp("fsav db dir", param) == 0) {
pstrcpy(fsav_db_dir, value);
DEBUG(3, ("fsav db dir is: %s\n", fsav_db_dir));
} else if (StrCaseCmp("fsav socket", param) == 0) {
@@ -175,6 +177,9 @@
} else if (StrCaseCmp("fsav mime scan", param) == 0) {
set_boolean(&fsav_mime, value);
DEBUG(3, ("fsav mime scan is : %d\n", fsav_mime));
+ } else if (StrCaseCmp("fsav connect uid", param) == 0) {
+ fsav_connect_uid = atoi(value);
+ DEBUG(3, ("fsav connect uid is : %i\n", fsav_connect_uid));
} else if (StrCaseCmp("fsav archive scan", param) == 0) {
set_boolean(&fsav_archive, value);
DEBUG(3, ("fsav archive scan is : %d\n", fsav_mime));
@@ -269,6 +274,7 @@
/* fsav specific defaults */
set_boolean(&fsav_userinstance, "yes");
+ fsav_connect_uid = -1;
fsav_timeout = 0; /* fsav default is 0 */
fsav_maxnested = 5; /* fsav default is 5 */
set_boolean(&fsav_archive, "yes");
@@ -420,6 +426,7 @@
fsav = fsav_create_handle();
if (fsav) {
fsav->userinstance = fsav_userinstance;
+ fsav->connect_uid = fsav_connect_uid;
fsav->maxnested = fsav_maxnested;
fsav->archive = fsav_archive;
fsav->timeout = fsav_timeout;
@@ -624,6 +631,7 @@
fsav = fsav_create_handle();
if (fsav) {
fsav->userinstance = fsav_userinstance;
+ fsav->connect_uid = fsav_connect_uid;
fsav->maxnested = fsav_maxnested;
fsav->archive = fsav_archive;
fsav->timeout = fsav_timeout;
Index: vscan-fsav.conf
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/f-secure/Attic/vscan-fsav.conf,v
retrieving revision 1.1.2.1
retrieving revision 1.1.2.2
diff -u -d -r1.1.2.1 -r1.1.2.2
--- vscan-fsav.conf 4 Dec 2003 16:31:13 -0000 1.1.2.1
+++ vscan-fsav.conf 8 Jan 2004 18:41:05 -0000 1.1.2.2
@@ -60,7 +60,9 @@
;
; if you start a fsav for each user, then you have dedicated scanner mode
-; else you have to start a scanning deamon for all users
+; else you have to start a scanning deamon for all users. please note, that
+; the scanner has to be started with a user, that can access all files for scanning,
+; so its normally started as root
;
; user deamons are stopped after 30 seconds inactivity.. and restarted again.
; this value is hardcoded by fsecure.. i'm sorry
@@ -68,6 +70,12 @@
fsav userinstance = yes;
;
+; connect user id if you have a scanning deamon for all users. to access the socket
+; you have to specify the userid we have to switch to access.
+;
+fsav connect uid = -1
+
+;
; which fsecure config file should be used
;
fsav config file = /etc/fsav.conf
@@ -87,24 +95,25 @@
; which socket prefix should be used, for the not dedicated mode, the
; socket name of the central scanning deamon
;
-fsav socket = /tmp/.fsav
+fsav socket = /tmp/.fsav-
;
; scan archives, normaly on
;
-fsav archive = yes
+fsav archive scan = yes
;
; scan mime, normaly on
;
-fsav mime = yes
+fsav mime scan = yes
;
; scan depth in archives
;
-fsav maxnested = 5
+fsav maxnested level = 5
;
; scan timeout (0) disable it... default
;
fsav timeout = 0
+
Index: vscan-fsav_core.c
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/f-secure/Attic/vscan-fsav_core.c,v
retrieving revision 1.1.2.1
retrieving revision 1.1.2.2
diff -u -d -r1.1.2.1 -r1.1.2.2
--- vscan-fsav_core.c 4 Dec 2003 16:31:13 -0000 1.1.2.1
+++ vscan-fsav_core.c 8 Jan 2004 18:41:05 -0000 1.1.2.2
@@ -63,7 +63,7 @@
fsav_free_handle(h);
return NULL;
}
-
+ h->uid = -1;
DEBUG(5, ("samba-vscan (%s) create handle success\n", module_id));
return h;
}
@@ -240,7 +240,7 @@
/*
- * switch user id of the fsavd process to the effective user id, else we cant connect
+ * switch user id of the fsavd process to the effective user id, else we cant connect
*/
setreuid(geteuid(), geteuid());
@@ -369,20 +369,25 @@
h->rc = 2;
return h->rc;
}
-
+ fsav_switch_uid(h);
DEBUG(5, ("samba-vscan (%s) connect try connect \n", module_id));
rc = connect(h->sockd, (struct sockaddr *) h->server,
sizeof(struct sockaddr_un));
+ fsav_switch_uid(h);
if (rc != 0 && h->userinstance) {
DEBUG(5,
("samba-vscan (%s) connect try restart and connect \n",
module_id));
fsav_start(h);
+ fsav_switch_uid(h);
rc = connect(h->sockd, (struct sockaddr *) h->server,
sizeof(struct sockaddr_un));
+ fsav_switch_uid(h);
}
DEBUG(5,
("samba-vscan (%s) connect done rc=%i \n", module_id, rc));
+
+
if (rc != 0) {
DEBUG(5,
("samba-vscan (%s) connect returns %s(%i) \n",
@@ -449,7 +454,27 @@
h->rc));
return h->rc;
}
+/**
+ * switch the uid , depend on the uid set in the handle
+ *
+ */
+void fsav_switch_uid(fsav_handle * h) {
+ if (h->connect_uid == -1)
+ return;
+ DEBUG(5,("samba-vscan (%s) switching user uid (%i) euid (%i)\n ",
+ module_id, getuid(),geteuid()));
+
+ if (h->uid == -1) {
+ h->uid = geteuid();
+ seteuid(h->connect_uid);
+ DEBUG(5,("samba-vscan (%s) switching user from (%i) to (%i)\n ", module_id, h->connect_uid,h->uid));
+ } else {
+ DEBUG(5,("samba-vscan (%s) switching user back (%i) to (%i)\n ", module_id, h->connect_uid,h->uid));
+ seteuid(h->uid);
+ h->uid = -1;
+ }
+}
/**
* process
*
@@ -467,8 +492,10 @@
("samba-vscan (%s) process write %s\n ", module_id,
h->buffer));
h->rc = 0;
+ fsav_switch_uid(h);
if (write(h->sockd, h->buffer, strlen(h->buffer)) <= 0) {
h->rc = 1;
+ fsav_switch_uid(h);
return h->rc;
}
fsav_clean_handle(h);
@@ -530,6 +557,7 @@
}
+ fsav_switch_uid(h);
DEBUG(5,
("samba-vscan (%s) process read end infected: %i fail: %i configured: %i buffer: %s \n ",
module_id, h->infected, h->fail, h->configured, h->buffer));
Index: vscan-fsav_core.h
===================================================================
RCS file: /cvsroot/openantivirus/samba-vscan/f-secure/Attic/vscan-fsav_core.h,v
retrieving revision 1.1.2.1
retrieving revision 1.1.2.2
diff -u -d -r1.1.2.1 -r1.1.2.2
--- vscan-fsav_core.h 4 Dec 2003 16:31:13 -0000 1.1.2.1
+++ vscan-fsav_core.h 8 Jan 2004 18:41:05 -0000 1.1.2.2
@@ -44,14 +44,16 @@
struct sockaddr_un *server;
int rc;
int sockd;
- short userinstance;
- short configured;
- short infected;
- short fail;
- short archive;
- short maxnested;
- short timeout;
- short mime;
+ uid_t uid;
+ uid_t connect_uid;
+ short userinstance;
+ short configured;
+ short infected;
+ short fail;
+ short archive;
+ short maxnested;
+ short timeout;
+ short mime;
char *buffer;
char *recv_buffer;
char *config_file; /* location of config file */
@@ -69,6 +71,7 @@
void fsav_clean_handle(fsav_handle *h);
void fsav_socket_create(fsav_handle *h);
void fsav_socket_name_create(fsav_handle *h);
+void fsav_switch_uid(fsav_handle *h);
int fsav_connect_handle(fsav_handle *h);
int fsav_configure(fsav_handle *h,char *option, int value);
-------------------------------------------------------
This SF.net email is sponsored by: Perforce Software.
Perforce is the Fast Software Configuration Management System offering
advanced branching capabilities and atomic changes on 50+ platforms.
Free Eval! http://www.perforce.com/perforce/loadprog.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.