anonymous_namespace{Backend.cpp} Namespace Reference

Functions
bool	create_secure_firewall_input (const std::vector< std::string > &blacklistLines, std::string &outPath)
int	run_firewall_helper (const std::string &inputPath)

Function Documentation

create_secure_firewall_input()

bool anonymous_namespace{Backend.cpp}::create_secure_firewall_input	(	const std::vector< std::string > &	blacklistLines,
		std::string &	outPath )

Definition at line 3003 of file Backend.cpp.

  {
    std::string pathTemplate = "/tmp/bastionguard-firewall-ips-XXXXXX";
    std::vector<char> pathBuffer(pathTemplate.begin(), pathTemplate.end());
    pathBuffer.push_back('\0');
 
    const int fd = ::mkstemp(pathBuffer.data());
    if (fd < 0) {
        std::cerr << _("[Firewall] Impossibile creare il file temporaneo sicuro\n");
        return false;
    }
 
    outPath.assign(pathBuffer.data());
 
    if (::fchmod(fd, S_IRUSR | S_IWUSR) != 0) {
        ::close(fd);
        ::unlink(outPath.c_str());
        outPath.clear();
        std::cerr << _("[Firewall] Impossibile proteggere il file temporaneo\n");
        return false;
    }
 
    ::close(fd);
 
    if (!BlacklistIpExtractor::extractAndWrite(blacklistLines, outPath)) {
        ::unlink(outPath.c_str());
        outPath.clear();
        return false;
    }
 
    // extractAndWrite() riapre il file: imponiamo nuovamente 0600 e
    // verifichiamo che il pathname indichi ancora un singolo file regolare
    // appartenente all'utente che ha avviato BastionGuard.
    if (::chmod(outPath.c_str(), S_IRUSR | S_IWUSR) != 0) {
        ::unlink(outPath.c_str());
        outPath.clear();
        std::cerr << _("[Firewall] Impossibile impostare i permessi del file temporaneo\n");
        return false;
    }
 
    struct stat st {};
    if (::lstat(outPath.c_str(), &st) != 0 ||
        !S_ISREG(st.st_mode) ||
        st.st_uid != ::getuid() ||
        st.st_nlink != 1 ||
        (st.st_mode & (S_IWGRP | S_IWOTH)) != 0) {
        ::unlink(outPath.c_str());
        outPath.clear();
        std::cerr << _("[Firewall] File temporaneo non sicuro\n");
        return false;
    }
 
    return true;
}

References _, create_secure_firewall_input(), BlacklistIpExtractor::extractAndWrite(), S_IRUSR, S_IWGRP, S_IWOTH, and S_IWUSR.

Referenced by create_secure_firewall_input().

run_firewall_helper()

int anonymous_namespace{Backend.cpp}::run_firewall_helper

(

const std::string &

inputPath

)

Definition at line 3060 of file Backend.cpp.

                                                    {
    const pid_t pid = ::fork();
    if (pid < 0)
        return -1;
 
    if (pid == 0) {
        ::execl(
            "/usr/bin/pkexec",
            "pkexec",
            "/usr/bin/bastionguard-firewall",
            "apply",
            inputPath.c_str(),
            static_cast<char*>(nullptr)
        );
        _exit(127);
    }
 
    int status = 0;
    while (::waitpid(pid, &status, 0) < 0) {
        if (errno == EINTR)
            continue;
        return -1;
    }
 
    if (!WIFEXITED(status))
        return -1;
 
    return WEXITSTATUS(status);
}

References run_firewall_helper().

Referenced by run_firewall_helper().