sockroot

sockroot.c (3648B)

---

 #include <errno.h>
 #include <signal.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/un.h>
 #include <sys/wait.h>
 #include <unistd.h>
 
 #define SERVER_SOCK_FILE "sockroot.sock"
 #define CHROOT           "test/"
 #define EXECUTE          "/bin/sh"
 #define SOCKET_LIMIT     64
 
 int processes[SOCKET_LIMIT];
 int processes_size = 0;
 
 void handle_client(int client) {
 	int pid;
 
 	if (processes_size == SOCKET_LIMIT) {
 		fprintf(stderr, "error: cannot accept client: process-limit reached\n");
 		return;
 	}
 
 	while ((pid = fork()) == -1) {
 		fprintf(stderr, "warning: fork for process: %s, waiting 1sec...\n", strerror(errno));
 		sleep(1);
 	}
 
 	if (pid == 0) {    // is child
 		dup2(client, 0);
 		dup2(client, 1);
 		dup2(client, 2);
 		close(client);
 
 		if (chroot(CHROOT) == -1) {
 			fprintf(stderr, "error: cannot chroot to '" CHROOT "': %s\n", strerror(errno));
 			_exit(1);
 		}
 		if (chdir("/") == -1) {
 			fprintf(stderr, "error: cannot chdir to '/': %s\n", strerror(errno));
 			_exit(1);
 		}
 
 		execl(EXECUTE, EXECUTE, "-i", NULL);
 		fprintf(stderr, "error: cannot execute '" EXECUTE "': %s\n", strerror(errno));
 		_exit(1);
 	}
 
 	close(client);
 
 	printf("new connection: %d\n", pid);
 
 	for (int i = 0; i < SOCKET_LIMIT; i++) {
 		if (processes[i] == 0) {
 			processes[i] = pid;
 			processes_size++;
 			return;
 		}
 	}
 }
 
 void on_child(int signal) {
 	(void) signal;
 
 	int pid, status;
 	if ((pid = wait(&status)) == -1) {
 		fprintf(stderr, "error: cannot await child: %s\n", strerror(errno));
 		return;
 	}
 	printf("%d terminated\n", pid);
 
 	for (int i = 0; i < SOCKET_LIMIT; i++) {
 		if (processes[i] == pid) {
 			processes[i] = 0;
 			processes_size--;
 			return;
 		}
 	}
 	fprintf(stderr, "error: cannot find %d in process-table\n", pid);
 }
 
 void on_interrupt(int signal) {
 	(void) signal;
 
 	for (int i = 0; i < SOCKET_LIMIT; i++) {
 		if (processes[i] > 0 && kill(processes[i], SIGTERM) == -1) {
 			fprintf(stderr, "warning: unable to terminate %d: %s\n", processes[i], strerror(errno));
 		}
 	}
 
 	while (processes_size > 0) {
 		printf("awaiting %d processes to stop\n", processes_size);
 		sleep(1);
 	}
 
 	if (processes_size > 0) {
 		printf("kill %d left over processes\n", processes_size);
 		for (int i = 0; i < SOCKET_LIMIT; i++) {
 			if (processes[i] > 0 && kill(processes[i], SIGKILL) == -1) {
 				fprintf(stderr, "warning: unable to kill %d: %s\n", processes[i], strerror(errno));
 			}
 		}
 		sleep(1);
 	}
 	exit(0);
 }
 
 int main(void) {
 	if (unlink(SERVER_SOCK_FILE) == -1 && errno != ENOENT) {
 		fprintf(stderr, "error: cannot unlink socket: %s\n", strerror(errno));
 		return 1;
 	}
 
 	int server;
 
 	if ((server = socket(AF_UNIX, SOCK_STREAM, 0)) == -1) {
 		fprintf(stderr, "error: cannot create socket: %s\n", strerror(errno));
 		return 1;
 	}
 
 	umask(0);
 
 	// bind socket to address
 	struct sockaddr_un addr = { 0 };
 	addr.sun_family         = AF_UNIX;
 	strncpy(addr.sun_path, SERVER_SOCK_FILE, sizeof(addr.sun_path));
 	if (bind(server, (struct sockaddr*) &addr, sizeof(addr)) == -1) {
 		fprintf(stderr, "error: cannot bind to socket: %s\n", strerror(errno));
 		return 1;
 	}
 
 	// listen for connections
 	if (listen(server, 5) == -1) {
 		fprintf(stderr, "error: cannot listen socket: %s\n", strerror(errno));
 		return 1;
 	}
 
 	for (int i = 0; i < SOCKET_LIMIT; i++) {
 		processes[i] = 0;
 	}
 
 	signal(SIGINT, on_interrupt);
 	signal(SIGCHLD, on_child);
 
 	while (1) {
 		int client_fd;
 		if ((client_fd = accept(server, NULL, NULL)) == -1) {
 			fprintf(stderr, "error: cannot accept client from socket: %s\n", strerror(errno));
 			continue;
 		}
 		handle_client(client_fd);
 	}
 
 	return 0;
 }