From f2426ff2f417cbfaa33133b91ab5e92763613be7 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 22 Oct 2023 21:23:30 +0200 Subject: [PATCH 1/2] Explicitly chown all rotated files to pihole:pihole Signed-off-by: DL6ER --- src/files.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) diff --git a/src/files.c b/src/files.c index 18c4d771..af7879e5 100644 --- a/src/files.c +++ b/src/files.c @@ -398,7 +398,33 @@ static int copy_file(const char *source, const char *destination) #endif } +// Change ownership of file to pihole user +static bool chown_pihole(const char *path) +{ + // Get pihole user's uid and gid + struct passwd *pwd = getpwnam("pihole"); + if(pwd == NULL) + { + log_warn("chown_pihole(): Failed to get pihole user's uid: %s", strerror(errno)); + return false; + } + struct group *grp = getgrnam("pihole"); + if(grp == NULL) + { + log_warn("chown_pihole(): Failed to get pihole user's gid: %s", strerror(errno)); + return false; + } + // Change ownership of file to pihole user + if(chown(path, pwd->pw_uid, grp->gr_gid) < 0) + { + log_warn("chown_pihole(): Failed to change ownership of \"%s\" to pihole user: %s", + path, strerror(errno)); + return false; + } + + return true; +} // Rotate files in a directory void rotate_files(const char *path, char **first_file) @@ -479,6 +505,9 @@ void rotate_files(const char *path, char **first_file) old_path, new_path); } + // Change ownership of file to pihole user + chown_pihole(new_path); + // Compress file if we are rotating a sufficiently old file if(i > ZIP_ROTATIONS) { @@ -489,6 +518,9 @@ void rotate_files(const char *path, char **first_file) // On success, we remove the uncompressed file remove(new_path); } + + // Change ownership of file to pihole user + chown_pihole(new_path_compressed); } } else if(file_exists(old_path_compressed)) @@ -505,6 +537,9 @@ void rotate_files(const char *path, char **first_file) log_debug(DEBUG_CONFIG, "Rotated %s -> %s", old_path_compressed, new_path_compressed); } + + // Change ownership of file to pihole user + chown_pihole(new_path_compressed); } // Free memory From 3d571ba862253450ba6c2e61e459f19fa33926f6 Mon Sep 17 00:00:00 2001 From: DL6ER Date: Sun, 22 Oct 2023 22:44:29 +0200 Subject: [PATCH 2/2] Add missing CAP_CHOWN to CMakeLists install target Signed-off-by: DL6ER --- src/CMakeLists.txt | 2 +- src/files.c | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt index e6b59925..4b02c2e9 100644 --- a/src/CMakeLists.txt +++ b/src/CMakeLists.txt @@ -339,7 +339,7 @@ find_program(SETCAP setcap) install(TARGETS pihole-FTL RUNTIME DESTINATION bin PERMISSIONS OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE) -install(CODE "execute_process(COMMAND ${SETCAP} CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_NET_ADMIN,CAP_SYS_NICE+eip \$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/bin/pihole-FTL)") +install(CODE "execute_process(COMMAND ${SETCAP} CAP_NET_BIND_SERVICE,CAP_NET_RAW,CAP_NET_ADMIN,CAP_SYS_NICE,CAP_CHOWN+eip \$ENV{DESTDIR}\${CMAKE_INSTALL_PREFIX}/bin/pihole-FTL)") add_subdirectory(api) add_subdirectory(webserver) diff --git a/src/files.c b/src/files.c index af7879e5..49247e4d 100644 --- a/src/files.c +++ b/src/files.c @@ -418,8 +418,8 @@ static bool chown_pihole(const char *path) // Change ownership of file to pihole user if(chown(path, pwd->pw_uid, grp->gr_gid) < 0) { - log_warn("chown_pihole(): Failed to change ownership of \"%s\" to pihole user: %s", - path, strerror(errno)); + log_warn("chown_pihole(): Failed to change ownership of \"%s\" to %u:%u: %s", + path, pwd->pw_uid, grp->gr_gid, strerror(errno)); return false; }