Revert "Delete control socket when the server exits."

[freeradius.git] / src / main / mainconfig.c

diff --git a/src/main/mainconfig.c b/src/main/mainconfig.c
index d067da5..7a7bf4b 100644 (file)
--- a/src/main/mainconfig.c
+++ b/src/main/mainconfig.c
@@ -251,8 +251,10 @@ static const CONF_PARSER server_config[] = {
 };
 
 static const CONF_PARSER bootstrap_config[] = {
+#ifdef HAVE_SETUID
        { "user",  PW_TYPE_STRING_PTR, 0, &uid_name, NULL },
        { "group",  PW_TYPE_STRING_PTR, 0, &gid_name, NULL },
+#endif
        { "chroot",  PW_TYPE_STRING_PTR, 0, &chroot_dir, NULL },
        { "allow_core_dumps", PW_TYPE_BOOLEAN, 0, &allow_core_dumps, "no" },
 
@@ -422,6 +424,53 @@ static int r_mkdir(const char *part)
        return(0);
 }
 
+#ifdef HAVE_SYS_RESOURCE_H
+static struct rlimit core_limits;
+#endif
+
+static void fr_set_dumpable(void)
+{
+       /*
+        *      If configured, turn core dumps off.
+        */
+       if (!allow_core_dumps) {
+#ifdef HAVE_SYS_RESOURCE_H
+               struct rlimit no_core;
+
+
+               no_core.rlim_cur = 0;
+               no_core.rlim_max = 0;
+               
+               if (setrlimit(RLIMIT_CORE, &no_core) < 0) {
+                       radlog(L_ERR, "Failed disabling core dumps: %s",
+                              strerror(errno));
+               }
+#endif
+               return;
+       }
+
+       /*
+        *      Set or re-set the dumpable flag.
+        */
+#ifdef HAVE_SYS_PRCTL_H
+#ifdef PR_SET_DUMPABLE
+       if (prctl(PR_SET_DUMPABLE, 1) < 0) {
+               radlog(L_ERR,"Cannot re-enable core dumps: prctl(PR_SET_DUMPABLE) failed: '%s'",
+                      strerror(errno));
+       }
+#endif
+#endif
+
+       /*
+        *      Reset the core dump limits to their original value.
+        */
+#ifdef HAVE_SYS_RESOURCE_H
+       if (setrlimit(RLIMIT_CORE, &core_limits) < 0) {
+               radlog(L_ERR, "Cannot update core dump limit: %s",
+                      strerror(errno));
+       }
+#endif
+}
 
 #ifdef HAVE_SETUID
 static int doing_setuid = FALSE;
@@ -462,6 +511,8 @@ void fr_suid_down(void)
                        progname);
                _exit(1);
        }
+
+       fr_set_dumpable();
 }
 
 void fr_suid_down_permanent(void)
@@ -478,6 +529,8 @@ void fr_suid_down_permanent(void)
                radlog(L_ERR, "Switched to unknown uid");
                _exit(1);
        }
+
+       fr_set_dumpable();
 }
 #else
 /*
@@ -495,9 +548,12 @@ void fr_suid_down(void)
                        progname, uid_name, strerror(errno));
                _exit(1);
        }
+
+       fr_set_dumpable();
 }
 void fr_suid_down_permanent(void)
 {
+       fr_set_dumpable();
 }
 #endif /* HAVE_SETRESUID && HAVE_GETRESUID */
 #else  /* HAVE_SETUID */
@@ -506,9 +562,11 @@ void fr_suid_up(void)
 }
 void fr_suid_down(void)
 {
+       fr_set_dumpable();
 }
 void fr_suid_down_permanent(void)
 {
+       fr_set_dumpable();
 }
 #endif /* HAVE_SETUID */
  
@@ -522,7 +580,15 @@ void fr_suid_down_permanent(void)
 static int switch_users(CONF_SECTION *cs)
 {
 #ifdef HAVE_SYS_RESOURCE_H
-       struct rlimit core_limits;
+       /*
+        *      Get the current maximum for core files.  Do this
+        *      before anything else so as to ensure it's properly
+        *      initialized.
+        */
+       if (getrlimit(RLIMIT_CORE, &core_limits) < 0) {
+               radlog(L_ERR, "Failed to get current core limit:  %s", strerror(errno));
+               return 0;
+       }
 #endif
 
        /*
@@ -647,82 +713,18 @@ static int switch_users(CONF_SECTION *cs)
                doing_setuid = TRUE;
 
                fr_suid_down();
-
-               /*
-                *      Now core dumps are disabled on most secure systems.
-                */
-       }
-#endif
-
-#ifdef HAVE_SYS_RESOURCE_H
-       /*  Get the current maximum for core files.  */
-       if (getrlimit(RLIMIT_CORE, &core_limits) < 0) {
-               radlog(L_ERR, "Failed to get current core limit:  %s", strerror(errno));
-               return 0;
        }
 #endif
 
        /*
-        *      Core dumps are allowed if we're in debug mode, OR
-        *      we've allowed them, OR we did a setuid (which turns
-        *      core dumps off).
-        *
-        *      Otherwise, disable core dumps for security.
-        *      
+        *      This also clears the dumpable flag if core dumps
+        *      aren't allowed.
         */
-       if (!(debug_flag || allow_core_dumps || doing_setuid)) {
-#ifdef HAVE_SYS_RESOURCE_H
-               struct rlimit no_core;
-
-               no_core.rlim_cur = 0;
-               no_core.rlim_max = 0;
-
-               if (setrlimit(RLIMIT_CORE, &no_core) < 0) {
-                       radlog(L_ERR, "Failed disabling core dumps: %s",
-                              strerror(errno));
-                       return 0;
-               }
-#endif
-
-               /*
-                *      Otherwise, re-enable core dumps if we're
-                *      running as a daemon, AND core dumps are
-                *      allowed, AND we changed UID's.
-                */
-       } else if ((debug_flag == 0) && allow_core_dumps && doing_setuid) {
-               /*
-                *      Set the dumpable flag.
-                */
-#ifdef HAVE_SYS_PRCTL_H
-#ifdef PR_SET_DUMPABLE
-               if (prctl(PR_SET_DUMPABLE, 1) < 0) {
-                       radlog(L_ERR,"Cannot enable core dumps: prctl(PR_SET_DUMPABLE) failed: '%s'",
-                              strerror(errno));
-               }
-#endif
-#endif
-
-               /*
-                *      Reset the core dump limits again, just to
-                *      double check that they haven't changed.
-                */
-#ifdef HAVE_SYS_RESOURCE_H
-               if (setrlimit(RLIMIT_CORE, &core_limits) < 0) {
-                       radlog(L_ERR, "Cannot update core dump limit: %s",
-                                       strerror(errno));
-                       return 0;
-               }
-#endif
+       fr_set_dumpable();
 
+       if (allow_core_dumps) {
                radlog(L_INFO, "Core dumps are enabled.");
        }
-       /*
-        *      Else we're debugging (so core dumps are enabled)
-        *      OR we're not debugging, AND "allow_core_dumps == FALSE",
-        *      OR we're not debugging, AND core dumps are allowed,
-        *         BUT we didn't call setuid, so we haven't changed the
-        *         core dump capabilities inherited from the parent shell.
-        */
 
        return 1;
 }
@@ -834,11 +836,13 @@ int read_mainconfig(int reload)
                                return -1;
                        }
 
+#ifdef HAVE_SYSLOG_H
                        /*
                         *      Call openlog only once, when the
                         *      program starts.
                         */
                        openlog(progname, LOG_PID, mainconfig.syslog_facility);
+#endif
 
                } else if (mainconfig.radlog_dest == RADLOG_FILES) {
                        if (!mainconfig.log_file) {