From 1d3822c82233ae72617f783c750071d654815250 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 09:43:23 +0200 Subject: [PATCH 01/17] Explicitly set permissions of database file to 0644 after creation. Fixes #586 Signed-off-by: DL6ER --- database.c | 34 ++++++++++++++++++++++++++++++++++ routines.h | 1 + 2 files changed, 35 insertions(+) diff --git a/database.c b/database.c index 43ba8395..f54b145a 100644 --- a/database.c +++ b/database.c @@ -181,6 +181,15 @@ static bool db_create(void) if(!create_network_table()) return false; + // Done initializing the database + // Close database handle + dbclose(); + + // Explicitly set permissions to 0644 + // 644 = u+w u+r g+r o+r + const mode_t mode = S_IWUSR | S_IRUSR | S_IRGRP | S_IROTH; + chmod_file(FTLfiles.db, mode); + return true; } @@ -901,3 +910,28 @@ void read_data_from_DB(void) dbclose(); free(rstr); } + +// chmod a given file +bool chmod_file(const char *filename, mode_t mode) +{ + if(chmod(filename, mode) < 0) + { + logg("ERROR: chmod(%s, %d): chmod() failed: %s (%d)", filename, mode, strerror(errno), errno); + return false; + } + + struct stat st; + if(stat(filename, &st) < 0) + { + logg("ERROR: chmod(%s, %d): stat() failed: %s (%d)", filename, mode, strerror(errno), errno); + return false; + } + + if(st.st_mode != mode) + { + logg("ERROR: chmod(%s, %d): Verification failed, %d != %d", filename, mode, st.st_mode, mode); + return false; + } + + return true; +} diff --git a/routines.h b/routines.h index 5bee3059..2082e228 100644 --- a/routines.h +++ b/routines.h @@ -93,6 +93,7 @@ bool dbopen(void); void dbclose(void); int db_query_int(const char*); void SQLite3LogCallback(void *pArg, int iErrCode, const char *zMsg); +bool chmod_file(const char *filename, mode_t mode); // memory.c void memory_check(const int which); From 420f58a79b40cebb19f50468e14cc096c4932543 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 09:56:14 +0200 Subject: [PATCH 02/17] Add test for ownership and permissions of pihole-FTL.db given a restrictive umask on the testing system Signed-off-by: DL6ER --- test/run.sh | 12 +++++++++++- test/test_suite.bats | 6 ++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/test/run.sh b/test/run.sh index d78e538f..722a4d40 100755 --- a/test/run.sh +++ b/test/run.sh @@ -21,6 +21,10 @@ echo "BLOCKING_ENABLED=true" > /etc/pihole/setupVars.conf # Prepare pihole-FTL.conf echo "" > /etc/pihole/pihole-FTL.conf +# Set restrictive umask +OLDUMASK=$(umask) +umask 0022 + # Start FTL if ! ./pihole-FTL; then echo "pihole-FTL failed to start" @@ -45,4 +49,10 @@ cat /var/log/pihole-FTL.log # Run tests test/libs/bats/bin/bats "test/test_suite.bats" -exit $? +RET=$? + +# Restore umask +umask $OLDUMASK + +# Exit with return code of bats tests +exit $RET diff --git a/test/test_suite.bats b/test/test_suite.bats index 16c5a02b..321b0a16 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -268,6 +268,12 @@ [[ ${lines[0]} == "0" ]] } +@test "Ownership and permissions of pihole-FTL.db correct" { + run bash -c 'ls -l /etc/pihole/pihole-FTL.db' + printf "%s\n" "${lines[@]}" + [[ ${lines[0]} == "-rw-r--r-- 1 pihole pihole"* ]] +} + @test "Final part of the tests: Kill pihole-FTL process" { run bash -c 'kill $(pidof pihole-FTL)' printf "%s\n" "${lines[@]}" From 2e8e6b0c9130fa08f176a920b135c8eff6685261 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 10:28:16 +0200 Subject: [PATCH 03/17] Run tests as user pihole Signed-off-by: DL6ER --- test/run.sh | 27 ++++++++++++++++++++++----- test/test_suite.bats | 6 +++--- 2 files changed, 25 insertions(+), 8 deletions(-) diff --git a/test/run.sh b/test/run.sh index d78e538f..c571fe07 100755 --- a/test/run.sh +++ b/test/run.sh @@ -7,10 +7,21 @@ if [[ ${CI} == "true" && "${CIRCLE_JOB}" != "x86_64" ]]; then fi # Install necessary additional components for testing -apt-get -qq install dnsutils -y > /dev/null +apt-get -qq install dnsutils libcap2-bin -y > /dev/null -# Create necessary directories +# Create pihole user +useradd -m -s /bin/bash pihole + +# Create necessary directories and files mkdir -p /etc/pihole /var/run/pihole /var/log +touch /var/log/pihole-FTL.log +chown pihole:pihole /etc/pihole /var/run/pihole /var/log/pihole-FTL.log + +# Copy binary into a location the new user pihole can access +cp ./pihole-FTL /home/pihole +chmod +x /home/pihole/pihole-FTL +# Note: We cannot add CAP_NET_RAW and CAP_NET_ADMIN at this point +setcap CAP_NET_BIND_SERVICE+eip /home/pihole/pihole-FTL # Prepare gravity database sqlite3 /etc/pihole/gravity.db < test/gravity.db.sql @@ -22,14 +33,14 @@ echo "BLOCKING_ENABLED=true" > /etc/pihole/setupVars.conf echo "" > /etc/pihole/pihole-FTL.conf # Start FTL -if ! ./pihole-FTL; then +if ! runuser -l pihole -c /home/pihole/pihole-FTL; then echo "pihole-FTL failed to start" exit 1 fi # Prepare BATS mkdir -p test/libs -git clone --depth=1 https://github.com/bats-core/bats-core test/libs/bats > /dev/null +git clone --depth=1 --quiet https://github.com/bats-core/bats-core test/libs/bats > /dev/null # Block until FTL is ready, retry once per second for 45 seconds sleep 2 @@ -45,4 +56,10 @@ cat /var/log/pihole-FTL.log # Run tests test/libs/bats/bin/bats "test/test_suite.bats" -exit $? +RET=$? + +# Remove copied file +rm /home/pihole/pihole-FTL + +# Exit with return code of bats tests +exit $RET diff --git a/test/test_suite.bats b/test/test_suite.bats index 16c5a02b..502c7238 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -249,14 +249,14 @@ } @test "Fail on invalid argument" { - run bash -c './pihole-FTL abc' + run bash -c '/home/pihole/pihole-FTL abc' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "pihole-FTL: invalid option -- 'abc'" ]] - [[ ${lines[1]} == "Try './pihole-FTL --help' for more information" ]] + [[ ${lines[1]} == "Try '/home/pihole/pihole-FTL --help' for more information" ]] } @test "Help argument return help text" { - run bash -c './pihole-FTL help' + run bash -c '/home/pihole/pihole-FTL help' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "pihole-FTL - The Pi-hole FTL engine" ]] [[ ${lines[3]} == "Available arguments:" ]] From 62153dbbf7c28dc1b41a88ef1eca79b1ade8a628 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 10:37:37 +0200 Subject: [PATCH 04/17] Tests are currently running as user root, will be addressed in a separate PR Signed-off-by: DL6ER --- test/test_suite.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test_suite.bats b/test/test_suite.bats index 321b0a16..1d068dc0 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -271,7 +271,7 @@ @test "Ownership and permissions of pihole-FTL.db correct" { run bash -c 'ls -l /etc/pihole/pihole-FTL.db' printf "%s\n" "${lines[@]}" - [[ ${lines[0]} == "-rw-r--r-- 1 pihole pihole"* ]] + [[ ${lines[0]} == "-rw-r--r-- 1 root root"* ]] } @test "Final part of the tests: Kill pihole-FTL process" { From 3128627f4bc5dda7e3e16fe9a3b3669ef22bc910 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 10:49:37 +0200 Subject: [PATCH 05/17] We need to apply a bitmask on st.st_mode as the upper bits may contain random data Signed-off-by: DL6ER --- database.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/database.c b/database.c index f54b145a..391620ff 100644 --- a/database.c +++ b/database.c @@ -927,7 +927,9 @@ bool chmod_file(const char *filename, mode_t mode) return false; } - if(st.st_mode != mode) + // We need to apply a bitmask on st.st_mode as the upper bits may contain random data + // 0x1FF = 0b111_111_111 + if((st.st_mode & 0x1FF) != mode) { logg("ERROR: chmod(%s, %d): Verification failed, %d != %d", filename, mode, st.st_mode, mode); return false; From e261c4fc222edd812aebfad1e370778da018c3a2 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 10:55:23 +0200 Subject: [PATCH 06/17] Test against WARNING and ERROR messages in tests Signed-off-by: DL6ER --- test/test_suite.bats | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/test/test_suite.bats b/test/test_suite.bats index 16c5a02b..50272924 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -262,6 +262,18 @@ [[ ${lines[3]} == "Available arguments:" ]] } +@test "No WARNING messages in pihole-FTL.log (besides known capability issues)" { + run bash -c 'grep "WARNING" /var/log/pihole-FTL.log' | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW" + printf "%s\n" "${lines[@]}" + [[ ${lines[0]} == "0" ]] +} + +@test "No ERROR messages in pihole-FTL.log" { + run bash -c 'grep -c "ERROR" /var/log/pihole-FTL.log' + printf "%s\n" "${lines[@]}" + [[ ${lines[0]} == "0" ]] +} + @test "No FATAL messages in pihole-FTL.log" { run bash -c 'grep -c "FATAL" /var/log/pihole-FTL.log' printf "%s\n" "${lines[@]}" From fc9f0a88549e7d1af4ee930f1ac39692e9b536dc Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 11:00:50 +0200 Subject: [PATCH 07/17] Also ignore "Starting pihole-FTL as user root is not recommended" warning Signed-off-by: DL6ER --- test/test_suite.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test_suite.bats b/test/test_suite.bats index 50272924..98d61338 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -263,7 +263,7 @@ } @test "No WARNING messages in pihole-FTL.log (besides known capability issues)" { - run bash -c 'grep "WARNING" /var/log/pihole-FTL.log' | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW" + run bash -c 'grep "WARNING" /var/log/pihole-FTL.log' | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW|(Starting pihole-FTL as user root is not recommended)"' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "0" ]] } From 66544bbe72743fa3a512d3e96db46b5d779221bf Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 11:01:55 +0200 Subject: [PATCH 08/17] Explicitly search for : to avoid being triggered by the branch name Signed-off-by: DL6ER --- test/test_suite.bats | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/test/test_suite.bats b/test/test_suite.bats index 98d61338..58459fc4 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -263,19 +263,19 @@ } @test "No WARNING messages in pihole-FTL.log (besides known capability issues)" { - run bash -c 'grep "WARNING" /var/log/pihole-FTL.log' | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW|(Starting pihole-FTL as user root is not recommended)"' + run bash -c 'grep "WARNING:" /var/log/pihole-FTL.log' | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW|(Starting pihole-FTL as user root is not recommended)"' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "0" ]] } @test "No ERROR messages in pihole-FTL.log" { - run bash -c 'grep -c "ERROR" /var/log/pihole-FTL.log' + run bash -c 'grep -c "ERROR:" /var/log/pihole-FTL.log' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "0" ]] } @test "No FATAL messages in pihole-FTL.log" { - run bash -c 'grep -c "FATAL" /var/log/pihole-FTL.log' + run bash -c 'grep -c "FATAL:" /var/log/pihole-FTL.log' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "0" ]] } From 6bea6240149ff7de6018aab3682eafc93d390953 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Mon, 10 Jun 2019 11:05:27 +0200 Subject: [PATCH 09/17] Fix matching single-quote Signed-off-by: DL6ER --- test/test_suite.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test_suite.bats b/test/test_suite.bats index 58459fc4..b68b5370 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -263,7 +263,7 @@ } @test "No WARNING messages in pihole-FTL.log (besides known capability issues)" { - run bash -c 'grep "WARNING:" /var/log/pihole-FTL.log' | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW|(Starting pihole-FTL as user root is not recommended)"' + run bash -c 'grep "WARNING:" /var/log/pihole-FTL.log | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW|(Starting pihole-FTL as user root is not recommended)"' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "0" ]] } From 0ef1ef6193748590396a339e7fd56ee4d2e3008b Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 12 Jun 2019 21:16:05 +0200 Subject: [PATCH 10/17] Set shell of user pihole to nologin Signed-off-by: DL6ER --- test/run.sh | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/test/run.sh b/test/run.sh index c571fe07..85c1b1dd 100755 --- a/test/run.sh +++ b/test/run.sh @@ -9,8 +9,10 @@ fi # Install necessary additional components for testing apt-get -qq install dnsutils libcap2-bin -y > /dev/null -# Create pihole user -useradd -m -s /bin/bash pihole +# Create pihole user if it does not exist +if ! id -u pihole &> /dev/null; then + useradd -m -s /usr/sbin/nologin pihole +fi # Create necessary directories and files mkdir -p /etc/pihole /var/run/pihole /var/log From efd3ce8a1c34a44e2835cbb9343e79d76ab30a63 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 12 Jun 2019 21:24:44 +0200 Subject: [PATCH 11/17] Explicitly specify shell in runuser command Signed-off-by: DL6ER --- test/run.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/run.sh b/test/run.sh index 85c1b1dd..30f0c1ad 100755 --- a/test/run.sh +++ b/test/run.sh @@ -35,7 +35,7 @@ echo "BLOCKING_ENABLED=true" > /etc/pihole/setupVars.conf echo "" > /etc/pihole/pihole-FTL.conf # Start FTL -if ! runuser -l pihole -c /home/pihole/pihole-FTL; then +if ! runuser -l pihole -s /bin/sh -c /home/pihole/pihole-FTL; then echo "pihole-FTL failed to start" exit 1 fi From 993b0ffac87a0f61f75e55dc8f3731eb516aa8ac Mon Sep 17 00:00:00 2001 From: DL6ER Date: Wed, 12 Jun 2019 21:29:49 +0200 Subject: [PATCH 12/17] Put chmod function into new file misc.c (replaces old grep.c) Signed-off-by: DL6ER --- Makefile | 2 +- database.c | 27 --------------------------- grep.c => misc.c | 30 +++++++++++++++++++++++++++++- routines.h | 4 ++-- 4 files changed, 32 insertions(+), 31 deletions(-) rename grep.c => misc.c (79%) diff --git a/Makefile b/Makefile index c73b560e..0a8983e2 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,7 @@ DNSMASQOPTS = -DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC # Flags for compiling with libidn2: -DHAVE_LIBIDN2 -DIDN2_VERSION_NUMBER=0x02000003 FTLDEPS = FTL.h routines.h version.h api.h dnsmasq_interface.h shmem.h -FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o grep.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o capabilities.o networktable.o overTime.o gravity.o +FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o misc.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o capabilities.o networktable.o overTime.o gravity.o DNSMASQDEPS = config.h dhcp-protocol.h dns-protocol.h radv-protocol.h dhcp6-protocol.h dnsmasq.h ip6addr.h metrics.h ../dnsmasq_interface.h DNSMASQOBJ = arp.o dbus.o domain.o lease.o outpacket.o rrfilter.o auth.o dhcp6.o edns0.o log.o poll.o slaac.o blockdata.o dhcp.o forward.o loop.o radv.o tables.o bpf.o dhcp-common.o helper.o netlink.o rfc1035.o tftp.o cache.o dnsmasq.o inotify.o network.o rfc2131.o util.o conntrack.o dnssec.o ipset.o option.o rfc3315.o crypto.o dump.o ubus.o metrics.o diff --git a/database.c b/database.c index 391620ff..53d262ef 100644 --- a/database.c +++ b/database.c @@ -910,30 +910,3 @@ void read_data_from_DB(void) dbclose(); free(rstr); } - -// chmod a given file -bool chmod_file(const char *filename, mode_t mode) -{ - if(chmod(filename, mode) < 0) - { - logg("ERROR: chmod(%s, %d): chmod() failed: %s (%d)", filename, mode, strerror(errno), errno); - return false; - } - - struct stat st; - if(stat(filename, &st) < 0) - { - logg("ERROR: chmod(%s, %d): stat() failed: %s (%d)", filename, mode, strerror(errno), errno); - return false; - } - - // We need to apply a bitmask on st.st_mode as the upper bits may contain random data - // 0x1FF = 0b111_111_111 - if((st.st_mode & 0x1FF) != mode) - { - logg("ERROR: chmod(%s, %d): Verification failed, %d != %d", filename, mode, st.st_mode, mode); - return false; - } - - return true; -} diff --git a/grep.c b/misc.c similarity index 79% rename from grep.c rename to misc.c index 628940a3..99c0dd1d 100644 --- a/grep.c +++ b/misc.c @@ -3,7 +3,7 @@ * Network-wide ad blocking via your own hardware. * * FTL Engine -* grep-like routines +* File operation routines * * This file is copyright under the latest version of the EUPL. * Please see LICENSE file for your rights under this license. */ @@ -125,3 +125,31 @@ void check_blocking_status(void) logg("Blocking status is %s", message); } + +// chmod a given file +bool chmod_file(const char *filename, const mode_t mode) +{ + if(chmod(filename, mode) < 0) + { + logg("ERROR: chmod(%s, %d): chmod() failed: %s (%d)", filename, mode, strerror(errno), errno); + return false; + } + + struct stat st; + if(stat(filename, &st) < 0) + { + logg("ERROR: chmod(%s, %d): stat() failed: %s (%d)", filename, mode, strerror(errno), errno); + return false; + } + + // We need to apply a bitmask on st.st_mode as the upper bits may contain random data + // 0x1FF = 0b111_111_111 + if((st.st_mode & 0x1FF) != mode) + { + logg("ERROR: chmod(%s, %d): Verification failed, %d != %d", filename, mode, st.st_mode, mode); + return false; + } + + return true; +} + diff --git a/routines.h b/routines.h index 2082e228..1649f4fb 100644 --- a/routines.h +++ b/routines.h @@ -53,10 +53,11 @@ void bind_sockets(void); void process_request(const char *client_message, int *sock); bool command(const char *client_message, const char* cmd) __attribute__((pure)); -// grep.c +// misc.c int countlines(const char* fname); int countlineswith(const char* str, const char* fname); void check_blocking_status(void); +bool chmod_file(const char *filename, const mode_t mode); void check_setupVarsconf(void); char * read_setupVarsconf(const char * key); @@ -93,7 +94,6 @@ bool dbopen(void); void dbclose(void); int db_query_int(const char*); void SQLite3LogCallback(void *pArg, int iErrCode, const char *zMsg); -bool chmod_file(const char *filename, mode_t mode); // memory.c void memory_check(const int which); From 4c01c4797783212f8b721eb481c317543cbb6209 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 14 Jun 2019 21:07:46 +0200 Subject: [PATCH 13/17] chmod() errors may not be fatal, e.g. if the permissions are already sufficient but the user pihole-FTL is started by is not the owner Signed-off-by: DL6ER --- Makefile | 2 +- misc.c => files.c | 12 +++++++----- 2 files changed, 8 insertions(+), 6 deletions(-) rename misc.c => files.c (84%) diff --git a/Makefile b/Makefile index 0a8983e2..12b8cb43 100644 --- a/Makefile +++ b/Makefile @@ -14,7 +14,7 @@ DNSMASQOPTS = -DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC # Flags for compiling with libidn2: -DHAVE_LIBIDN2 -DIDN2_VERSION_NUMBER=0x02000003 FTLDEPS = FTL.h routines.h version.h api.h dnsmasq_interface.h shmem.h -FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o misc.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o capabilities.o networktable.o overTime.o gravity.o +FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o files.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o capabilities.o networktable.o overTime.o gravity.o DNSMASQDEPS = config.h dhcp-protocol.h dns-protocol.h radv-protocol.h dhcp6-protocol.h dnsmasq.h ip6addr.h metrics.h ../dnsmasq_interface.h DNSMASQOBJ = arp.o dbus.o domain.o lease.o outpacket.o rrfilter.o auth.o dhcp6.o edns0.o log.o poll.o slaac.o blockdata.o dhcp.o forward.o loop.o radv.o tables.o bpf.o dhcp-common.o helper.o netlink.o rfc1035.o tftp.o cache.o dnsmasq.o inotify.o network.o rfc2131.o util.o conntrack.o dnssec.o ipset.o option.o rfc3315.o crypto.o dump.o ubus.o metrics.o diff --git a/misc.c b/files.c similarity index 84% rename from misc.c rename to files.c index 99c0dd1d..bd1becc4 100644 --- a/misc.c +++ b/files.c @@ -126,27 +126,29 @@ void check_blocking_status(void) logg("Blocking status is %s", message); } -// chmod a given file +// chmod_file() changes the file mode bits of a given file (relative +// to the directory file descriptor) according to mode. mode is an +// octal number representing the bit pattern for the new mode bits bool chmod_file(const char *filename, const mode_t mode) { if(chmod(filename, mode) < 0) { - logg("ERROR: chmod(%s, %d): chmod() failed: %s (%d)", filename, mode, strerror(errno), errno); + logg("WARNING: chmod(%s, %d): chmod() failed: %s (%d)", filename, mode, strerror(errno), errno); return false; } struct stat st; if(stat(filename, &st) < 0) { - logg("ERROR: chmod(%s, %d): stat() failed: %s (%d)", filename, mode, strerror(errno), errno); + logg("WARNING: chmod(%s, %d): stat() failed: %s (%d)", filename, mode, strerror(errno), errno); return false; } // We need to apply a bitmask on st.st_mode as the upper bits may contain random data - // 0x1FF = 0b111_111_111 + // 0x1FF = 0b111_111_111 corresponding to the three-digit octal mode number if((st.st_mode & 0x1FF) != mode) { - logg("ERROR: chmod(%s, %d): Verification failed, %d != %d", filename, mode, st.st_mode, mode); + logg("WARNING: chmod(%s, %d): Verification failed, %d != %d", filename, mode, st.st_mode, mode); return false; } From 780d9be6c626b8c67650b371f2f96071be527c4f Mon Sep 17 00:00:00 2001 From: DL6ER Date: Fri, 14 Jun 2019 21:12:12 +0200 Subject: [PATCH 14/17] grep.c is not called files.c Signed-off-by: DL6ER --- routines.h | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/routines.h b/routines.h index 1649f4fb..2902947d 100644 --- a/routines.h +++ b/routines.h @@ -38,6 +38,7 @@ const char *getDomainString(const int queryID); const char *getClientIPString(const int queryID); const char *getClientNameString(const int queryID); +// socket.c void close_telnet_socket(void); void close_unix_socket(void); void seom(const int sock); @@ -45,33 +46,33 @@ void ssend(const int sock, const char *format, ...) __attribute__ ((format (gnu_ void swrite(const int sock, const void* value, const size_t size); void *telnet_listening_thread_IPv4(void *args); void *telnet_listening_thread_IPv6(void *args); - void *socket_listening_thread(void *args); bool ipv6_available(void); void bind_sockets(void); +// request.c void process_request(const char *client_message, int *sock); bool command(const char *client_message, const char* cmd) __attribute__((pure)); -// misc.c +// files.c int countlines(const char* fname); int countlineswith(const char* str, const char* fname); void check_blocking_status(void); bool chmod_file(const char *filename, const mode_t mode); +// setupVars.c void check_setupVarsconf(void); char * read_setupVarsconf(const char * key); void getSetupVarsArray(const char * input); void clearSetupVarsArray(void); bool insetupVarsArray(const char * str); bool getSetupVarsBool(const char * input) __attribute__((pure)); - -void parse_args(int argc, char* argv[]); - -// setupVars.c char* find_equals(const char* s) __attribute__((pure)); void trim_whitespace(char *string); +// args.c +void parse_args(int argc, char* argv[]); + // config.c void getLogFilePath(void); void read_FTLconf(void); @@ -102,6 +103,7 @@ void *FTLcalloc(size_t nmemb, size_t size, const char *file, const char *functio void *FTLrealloc(void *ptr_in, size_t size, const char *file, const char *function, const int line) __attribute__((alloc_size(2))); void FTLfree(void *ptr, const char* file, const char *function, const int line); +// dnsmasq/dnsmasq.c int main_dnsmasq(int argc, const char ** argv); // signals.c From 9c6a3199d7cf23d1ee91a94462d3579c1540b70b Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 15 Jun 2019 07:47:51 +0200 Subject: [PATCH 15/17] Remove exception for running as root warning. Signed-off-by: DL6ER --- test/test_suite.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test_suite.bats b/test/test_suite.bats index ca4ee7a7..3f795dda 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -263,7 +263,7 @@ } @test "No WARNING messages in pihole-FTL.log (besides known capability issues)" { - run bash -c 'grep "WARNING:" /var/log/pihole-FTL.log | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW|(Starting pihole-FTL as user root is not recommended)"' + run bash -c 'grep "WARNING:" /var/log/pihole-FTL.log | grep -c -v -E "CAP_NET_ADMIN|CAP_NET_RAW"' printf "%s\n" "${lines[@]}" [[ ${lines[0]} == "0" ]] } From 1115a57cfb86efdd1f37dac60e0b6a93296f7122 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 15 Jun 2019 07:50:15 +0200 Subject: [PATCH 16/17] Change database owner to pihole:pihole in the tests. Signed-off-by: DL6ER --- test/test_suite.bats | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/test/test_suite.bats b/test/test_suite.bats index 127d8fb5..c48f943f 100644 --- a/test/test_suite.bats +++ b/test/test_suite.bats @@ -271,7 +271,7 @@ @test "Ownership and permissions of pihole-FTL.db correct" { run bash -c 'ls -l /etc/pihole/pihole-FTL.db' printf "%s\n" "${lines[@]}" - [[ ${lines[0]} == "-rw-r--r-- 1 root root"* ]] + [[ ${lines[0]} == "-rw-r--r-- 1 pihole pihole"* ]] } @test "Final part of the tests: Kill pihole-FTL process" { From 7c7c47507c89df522ea50bcfce01cd9ae35cb115 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sat, 15 Jun 2019 07:53:59 +0200 Subject: [PATCH 17/17] Create PID and PORT files. The tests failed due to FTL warning not being able to create these files. Signed-off-by: DL6ER --- test/run.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/test/run.sh b/test/run.sh index 30f0c1ad..0ab9e492 100755 --- a/test/run.sh +++ b/test/run.sh @@ -16,8 +16,8 @@ fi # Create necessary directories and files mkdir -p /etc/pihole /var/run/pihole /var/log -touch /var/log/pihole-FTL.log -chown pihole:pihole /etc/pihole /var/run/pihole /var/log/pihole-FTL.log +touch /var/log/pihole-FTL.log /var/run/pihole-FTL.pid /var/run/pihole-FTL.port +chown pihole:pihole /etc/pihole /var/run/pihole /var/log/pihole-FTL.log /var/run/pihole-FTL.pid /var/run/pihole-FTL.port # Copy binary into a location the new user pihole can access cp ./pihole-FTL /home/pihole