SystemServiceControl.cpp

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "rootguard/SystemServiceControl.hpp"
 
#include <array>
#include <cerrno>
#include <cstring>
#include <filesystem>
#include <sstream>
#include <sys/types.h>
#include <sys/wait.h>
#include <unistd.h>
 
namespace bastionguard::rootguard {
namespace {
 
struct CommandResult {
    int exitCode{127};
    std::string output;
};
 
bool executableExists(const char* path) noexcept
{
    return path && ::access(path, X_OK) == 0;
}
 
std::string firstExecutable(std::initializer_list<const char*> candidates)
{
    for (const char* candidate : candidates) {
        if (executableExists(candidate))
            return candidate;
    }
    return {};
}
 
CommandResult runCommand(const std::vector<std::string>& arguments) noexcept
{
    CommandResult result;
    if (arguments.empty())
        return result;
 
    int descriptors[2]{};
    if (::pipe(descriptors) != 0)
        return result;
 
    const pid_t child = ::fork();
    if (child < 0) {
        ::close(descriptors[0]);
        ::close(descriptors[1]);
        return result;
    }
 
    if (child == 0) {
        ::close(descriptors[0]);
        ::dup2(descriptors[1], STDOUT_FILENO);
        ::dup2(descriptors[1], STDERR_FILENO);
        ::close(descriptors[1]);
 
        std::vector<char*> argv;
        argv.reserve(arguments.size() + 1);
        for (const auto& argument : arguments)
            argv.push_back(const_cast<char*>(argument.c_str()));
        argv.push_back(nullptr);
        ::execv(argv.front(), argv.data());
        _exit(127);
    }
 
    ::close(descriptors[1]);
    std::array<char, 2048> buffer{};
    for (;;) {
        const ssize_t count = ::read(descriptors[0], buffer.data(), buffer.size());
        if (count > 0) {
            result.output.append(buffer.data(), static_cast<std::size_t>(count));
            continue;
        }
        if (count < 0 && errno == EINTR)
            continue;
        break;
    }
    ::close(descriptors[0]);
 
    int status = 0;
    while (::waitpid(child, &status, 0) < 0 && errno == EINTR) {
    }
    if (WIFEXITED(status))
        result.exitCode = WEXITSTATUS(status);
    else if (WIFSIGNALED(status))
        result.exitCode = 128 + WTERMSIG(status);
    return result;
}
 
bool startsWithPath(const std::filesystem::path& path,
                    const std::filesystem::path& prefix) noexcept
{
    const auto normalizedPath = path.lexically_normal();
    const auto normalizedPrefix = prefix.lexically_normal();
    auto pathIt = normalizedPath.begin();
    for (auto prefixIt = normalizedPrefix.begin();
         prefixIt != normalizedPrefix.end(); ++prefixIt, ++pathIt) {
        if (pathIt == normalizedPath.end() || *pathIt != *prefixIt)
            return false;
    }
    return true;
}
 
bool isSystemdUnitExtension(const std::string& extension)
{
    return extension == ".service" || extension == ".socket" ||
           extension == ".timer" || extension == ".path" ||
           extension == ".mount" || extension == ".automount" ||
           extension == ".target";
}
 
std::optional<std::string> systemdUnitName(const std::filesystem::path& path)
{
    if (isSystemdUnitExtension(path.extension().string()))
        return path.filename().string();
 
    for (auto current = path.parent_path(); !current.empty() && current != current.root_path();
         current = current.parent_path()) {
        const std::string name = current.filename().string();
        if (name.size() > 2 && name.compare(name.size() - 2, 2, ".d") == 0) {
            const std::string unit = name.substr(0, name.size() - 2);
            if (isSystemdUnitExtension(std::filesystem::path(unit).extension().string()))
                return unit;
        }
    }
    return std::nullopt;
}
 
ServiceActionResult resultFrom(const std::string& operation,
                               const ServiceTarget& target,
                               const std::vector<CommandResult>& results)
{
    bool success = true;
    std::ostringstream message;
    message << operation << " " << target.name << " using " << toString(target.init);
    for (const auto& result : results) {
        if (result.exitCode != 0)
            success = false;
        if (!result.output.empty())
            message << ": " << result.output;
    }
    return {success, message.str()};
}
 
} // namespace
 
InitSystem detectInitSystem() noexcept
{
    try {
        if (std::filesystem::exists("/run/systemd/system") &&
            !firstExecutable({"/usr/bin/systemctl", "/bin/systemctl"}).empty())
            return InitSystem::Systemd;
        if (!firstExecutable({"/sbin/openrc-run", "/usr/bin/openrc-run"}).empty() &&
            !firstExecutable({"/sbin/rc-service", "/usr/bin/rc-service"}).empty())
            return InitSystem::OpenRC;
        if (!firstExecutable({"/usr/bin/dinitctl", "/bin/dinitctl"}).empty())
            return InitSystem::Dinit;
        if (std::filesystem::exists("/etc/init.d"))
            return InitSystem::SysVInit;
    } catch (...) {
    }
    return InitSystem::None;
}
 
const char* toString(const InitSystem init) noexcept
{
    switch (init) {
    case InitSystem::Systemd: return "systemd";
    case InitSystem::OpenRC: return "openrc";
    case InitSystem::Dinit: return "dinit";
    case InitSystem::SysVInit: return "sysvinit";
    case InitSystem::None: return "none";
    }
    return "none";
}
 
std::optional<ServiceTarget>
identifySystemService(const std::filesystem::path& input) noexcept
{
    try {
        if (input.empty() || !input.is_absolute())
            return std::nullopt;
        const auto path = input.lexically_normal();
        const auto init = detectInitSystem();
 
        const bool systemdPath =
            startsWithPath(path, "/etc/systemd/system") ||
            startsWithPath(path, "/usr/lib/systemd/system") ||
            startsWithPath(path, "/lib/systemd/system");
        if (systemdPath && init == InitSystem::Systemd) {
            if (const auto unit = systemdUnitName(path))
                return ServiceTarget{InitSystem::Systemd, *unit, path};
        }
 
        if (startsWithPath(path, "/etc/conf.d") &&
            init == InitSystem::OpenRC && path.has_filename())
            return ServiceTarget{InitSystem::OpenRC, path.filename().string(), path};
 
        if (startsWithPath(path, "/etc/init.d") && path.has_filename()) {
            const auto detected = init == InitSystem::OpenRC
                ? InitSystem::OpenRC : InitSystem::SysVInit;
            return ServiceTarget{detected, path.filename().string(), path};
        }
 
        if ((startsWithPath(path, "/etc/dinit.d") ||
             startsWithPath(path, "/usr/lib/dinit.d")) &&
            init == InitSystem::Dinit && path.has_filename())
            return ServiceTarget{InitSystem::Dinit, path.filename().string(), path};
    } catch (...) {
    }
    return std::nullopt;
}
 
ServiceActionResult blockSystemService(const std::filesystem::path& path) noexcept
{
    const auto target = identifySystemService(path);
    if (!target)
        return {false, "The path is not a recognized system service definition."};
    if (target->name == "bastionguard-rootguard.service" ||
        target->name == "bastionguard-rootguard")
        return {false, "RootGuard refuses to block its own service."};
 
    std::vector<CommandResult> results;
    switch (target->init) {
    case InitSystem::Systemd: {
        const auto systemctl = firstExecutable({"/usr/bin/systemctl", "/bin/systemctl"});
        if (systemctl.empty())
            return {false, "systemctl is unavailable."};
        results.push_back(runCommand({systemctl, "stop", target->name}));
        results.push_back(runCommand({systemctl, "mask", "--runtime", target->name}));
        break;
    }
    case InitSystem::OpenRC: {
        const auto rcService = firstExecutable({"/sbin/rc-service", "/usr/bin/rc-service"});
        if (rcService.empty())
            return {false, "rc-service is unavailable."};
        results.push_back(runCommand({rcService, target->name, "stop"}));
        break;
    }
    case InitSystem::Dinit: {
        const auto dinitctl = firstExecutable({"/usr/bin/dinitctl", "/bin/dinitctl"});
        if (dinitctl.empty())
            return {false, "dinitctl is unavailable."};
        results.push_back(runCommand({dinitctl, "stop", target->name}));
        break;
    }
    case InitSystem::SysVInit:
        results.push_back(runCommand({target->definition.string(), "stop"}));
        break;
    case InitSystem::None:
        return {false, "No supported init system was detected."};
    }
    return resultFrom("Blocked", *target, results);
}
 
ServiceActionResult unblockSystemService(const std::filesystem::path& path) noexcept
{
    const auto target = identifySystemService(path);
    if (!target)
        return {true, "The path is not a system service definition."};
 
    std::vector<CommandResult> results;
    switch (target->init) {
    case InitSystem::Systemd: {
        const auto systemctl = firstExecutable({"/usr/bin/systemctl", "/bin/systemctl"});
        if (systemctl.empty())
            return {false, "systemctl is unavailable."};
        results.push_back(runCommand({systemctl, "unmask", "--runtime", target->name}));
        break;
    }
    case InitSystem::OpenRC:
    case InitSystem::Dinit:
    case InitSystem::SysVInit:
        return {true, std::string("The service remains stopped; no runtime mask is used by ") +
                      toString(target->init) + "."};
    case InitSystem::None:
        return {false, "No supported init system was detected."};
    }
    return resultFrom("Unblocked", *target, results);
}
 
} // namespace bastionguard::rootguard