Release v47

Fixes a bug with clr_debug_prepare's handling of broken symlinks.

Signed-off-by: Patrick McCarty <patrick.mccarty@intel.com>

.gitignore

@@ -8,6 +8,7 @@ clr_debug_prepare
 Makefile
 Makefile.in
 aclocal.m4
+ar-lib
 autom4te.cache/
 compile
 config.h

Makefile.am

@@ -1,4 +1,4 @@
-EXTRA_DIST = COPYING clr_debug_fuse.service clr_debug_daemon.service debuginfo.conf
+EXTRA_DIST = COPYING clr_debug_fuse.service clr_debug_daemon.service clr_debug_daemon.socket debuginfo.conf
 
 DISTCHECK_CONFIGURE_FLAGS = \
 	--with-systemdsystemunitdir=$$dc_install_base/$(systemdsystemunitdir) \
@@ -33,15 +33,16 @@ clr_debug_fuse_SOURCES = src/fuse.c src/client.c
 clr_debug_daemon_SOURCES = src/server.c
 clr_debug_daemon_CFLAGS = \
 	-pthread \
-	$(AM_CFLAGS)
+	$(AM_CFLAGS) \
+	$(LIBSYSTEMD_CFLAGS)
 
 clr_debug_prepare_SOURCES = src/prepare.c
 
 
 clr_debug_fuse_LDADD = ${fuse_LIBS} libnica.la
-clr_debug_daemon_LDADD = ${curl_LIBS} libnica.la
+clr_debug_daemon_LDADD = ${curl_LIBS} libnica.la ${LIBSYSTEMD_LIBS}
 clr_debug_prepare_LDADD = libnica.la
 
-systemdsystemunit_DATA = clr_debug_fuse.service clr_debug_daemon.service
+systemdsystemunit_DATA = clr_debug_fuse.service clr_debug_daemon.service clr_debug_daemon.socket
 
 tmpfiles_DATA = debuginfo.conf

clr_debug_daemon.service

@@ -1,5 +1,6 @@
 [Unit]
 Description=Clear Linux debuginfo daemon
+DefaultDependencies=no
 
 [Service]
 Type=simple

clr_debug_daemon.socket

@@ -0,0 +1,9 @@
+[Unit]
+Description=Clear Linux OS debuginfo daemon
+
+[Socket]
+ListenStream=/run/clr-debug-info
+SocketMode=0600
+
+[Install]
+WantedBy=sockets.target

clr_debug_fuse.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=Clear Linux debuginfo fuse monitor
 After=clr_debug_daemon.service
+DefaultDependencies=no
 
 [Service]
 Type=simple

configure.ac

@@ -2,15 +2,17 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.66])
-AC_INIT(clr-debug-info, 31, arjan@linux.intel.com)
+AC_INIT(clr-debug-info, 47, arjan@linux.intel.com)
 AM_INIT_AUTOMAKE([foreign -Wall -W subdir-objects])
 AM_SILENT_RULES([yes])
 AC_PROG_CC
+AM_PROG_AR
 AC_LANG(C)
 AC_CONFIG_HEADERS([config.h])
 PKG_CHECK_MODULES([curl], [libcurl])
 PKG_CHECK_MODULES([fuse], [fuse])
 PKG_CHECK_MODULES([SYSTEMD], [systemd])
+PKG_CHECK_MODULES([LIBSYSTEMD], [libsystemd])
 LT_INIT
 
 dir=""
@@ -27,5 +29,32 @@ AC_ARG_WITH([systemdtmpfilesdir], AS_HELP_STRING([--with-systemdtmpfilesdir=DIR]
 test -z "${dir}" && dir=/usr/lib/tmpfiles.d
 AC_SUBST(tmpfilesdir, [${dir}])
 
+AC_CHECK_HEADER([stdatomic.h], [have_atomics="yes"], [have_atomics="no"])
+if test x$have_atomics = "xyes"; then
+        AC_DEFINE([HAVE_ATOMIC_SUPPORT], [1], [stdatomic supported by compiler])
+else
+        AC_MSG_WARN([C11 stdatomic support unavailable. Falling back to slow mutex])
+fi
+
 AC_CONFIG_FILES([Makefile])
 AC_OUTPUT
+
+AC_MSG_RESULT([
+        clr-debuginfo $VERSION
+
+        prefix:                 ${prefix}
+        libdir:                 ${libdir}
+        sysconfdir:             ${sysconfdir}
+        exec_prefix:            ${exec_prefix}
+        bindir:                 ${bindir}
+        datarootdir:            ${datarootdir}
+
+        compiler:               ${CC}
+        cflags:                 ${CFLAGS}
+        ldflags:                ${LDFLAGS}
+
+        systemd-unit-dir:       ${systemdsystemunitdir}
+        tmpfiles.d:             ${tmpfilesdir}
+
+        C11 stdatomic support:  ${have_atomics}
+])

debuginfo.conf

@@ -8,5 +8,7 @@
 # See tmpfiles.d(5) for details
 
 # Clear tmp directories separately, to make them easier to override
-d /var/cache/debuginfo/lib 755 root root 10d
+# Unfortunatly tmpfiles doesn't change the ownership for things if they
-d /var/cache/debuginfo/src 755 root root 1d
+# are not listed.
+d /var/cache/debuginfo/lib 755 dbginfo dbginfo 10d
+d /var/cache/debuginfo/src 755 dbginfo dbginfo 1d

src/client.c

@@ -37,8 +37,8 @@
 #include <unistd.h>
 
 /* 0.75 seconds timeout */
-#define TIMEOUT 750000
+#define TIMEOUT 75000
-#define TIMEOUT2 15000
+#define TIMEOUT2 1500
 #define TIMEOUT3 500
 
 char *prefix = "src";
@@ -66,12 +66,11 @@ void try_to_get(const char *path, int pid, time_t timestamp)
         }
 
         sun.sun_family = AF_UNIX;
-        strcpy(sun.sun_path, ":clr-debug-info");
+        strcpy(sun.sun_path, "/run/clr-debug-info");
-        sun.sun_path[0] = 0; /* anonymous unix socket */
 
         ret = connect(sockfd,
                       (struct sockaddr *)&sun,
-                      offsetof(struct sockaddr_un, sun_path) + strlen(":clr-debug-info") + 1);
+                      offsetof(struct sockaddr_un, sun_path) + strlen("/run/clr-debug-info") + 1);
         if (ret < 0) {
                 printf("Cannot connect %s\n", strerror(errno));
                 close(sockfd);
@@ -85,6 +84,7 @@ void try_to_get(const char *path, int pid, time_t timestamp)
         if (ret == 0 && cred.pid == pid) {
                 printf("Recursion\n");
                 close(sockfd);
+                return;
         }
 
         command = NULL;

src/nica/files.c

@@ -113,7 +113,7 @@ bool nc_copy_file(const char *src, const char *dst, mode_t mode, bool remove_tar
         while (true) {
                 if ((r = read(src_fd, &buffer, sizeof(buffer))) < 0) {
                         ret = false;
-                        break;
+                        goto end;
                 }
                 if (write(dest_fd, buffer, sizeof(buffer)) != r) {
                         break;

src/nica/hashmap.c

@@ -123,8 +123,8 @@ static inline unsigned nc_hashmap_get_hash(NcHashmap *self, const void *key)
         return hash;
 }
 
-static bool nc_hashmap_insert_bucket(NcHashmap *self, NcHashmapEntry *buckets, int n_buckets,
+static int nc_hashmap_insert_bucket(NcHashmap *self, NcHashmapEntry *buckets, int n_buckets,
-                                     unsigned hash, const void *key, void *value)
+                                    unsigned hash, const void *key, void *value)
 {
         NcHashmapEntry *row = &(buckets[hash % n_buckets]);
         NcHashmapEntry *head = NULL;
@@ -458,10 +458,12 @@ bool nc_hashmap_iter_next(NcHashmapIter *citer, void **key, void **value)
                         }
                         item = &(map->buckets[iter->bucket]);
                 }
-                if (item && item->occ) {
+                if (item) {
-                        goto success;
+                        if (item->occ) {
+                                goto success;
+                        }
+                        item = item->next;
                 }
-                item = item->next;
         }
         return false;
 

src/server.c

@@ -27,14 +27,17 @@
 #define _GNU_SOURCE
 
 #include <errno.h>
+#include <grp.h>
+#include <linux/capability.h>
 #include <malloc.h>
 #include <pthread.h>
+#include <pwd.h>
 #include <signal.h>
-#include <stdatomic.h>
 #include <stddef.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <sys/prctl.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
 #include <sys/types.h>
@@ -46,18 +49,24 @@
 
 #include <curl/curl.h>
 
+#include "systemd/sd-daemon.h"
+
+#include "config.h"
+
+#ifdef HAVE_ATOMIC_SUPPORT
+#include <stdatomic.h>
+#endif
+
 static pthread_mutex_t dupes_mutex = PTHREAD_MUTEX_INITIALIZER;
 
-char *urls[2] = { "https://debuginfo.clearlinux.org/debuginfo/",
+char *urls[2] = { "https://cdn.download.clearlinux.org/debuginfo/",
-                  "https://debuginfo.clearlinux.org/debuginfo/" };
+                  "https://cdn-alt.download.clearlinux.org/debuginfo/" };
 int urlcounter = 1;
 
 static NcHashmap *hash = NULL;
 
 #define MAX_CONNECTIONS 16
 
-static atomic_int current_connection_count = 0;
-
 static int avoid_dupes(const char *url)
 {
         int retval = 0;
@@ -85,6 +94,10 @@ static int avoid_dupes(const char *url)
         return retval;
 }
 
+#ifdef HAVE_ATOMIC_SUPPORT
+
+static atomic_int current_connection_count = 0;
+
 /**
  * Get the current connection count atomically
  */
@@ -108,11 +121,52 @@ __nc_inline__ static inline void dec_connection_count(void)
 {
         atomic_fetch_sub(&current_connection_count, 1);
 }
+#else /* HAVE_ATOMIC_SUPPORT */
+
+static int current_connection_count = 0;
+
+/* No stdatomic compiler support, fallback to pthread mutex (slower) */
+pthread_mutex_t con_count_mutex = PTHREAD_MUTEX_INITIALIZER;
+
+/**
+ * Get the current connection count via mutex
+ */
+__nc_inline__ static inline int get_current_connection_count(void)
+{
+        int r;
+        pthread_mutex_lock(&con_count_mutex);
+        r = current_connection_count;
+        pthread_mutex_unlock(&con_count_mutex);
+        return r;
+}
+
+/**
+ * Increment the connection counter via mutex
+ */
+__nc_inline__ static inline void inc_connection_count(void)
+{
+        pthread_mutex_lock(&con_count_mutex);
+        current_connection_count++;
+        pthread_mutex_unlock(&con_count_mutex);
+}
+
+/**
+ * Decrement the connection counter via mutex
+ */
+__nc_inline__ static inline void dec_connection_count(void)
+{
+        pthread_mutex_lock(&con_count_mutex);
+        current_connection_count--;
+        pthread_mutex_unlock(&con_count_mutex);
+}
+
+#endif /* !(HAVE_ATOMIC_SUPPORT) */
 
 static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
 {
         CURLcode code;
         long ret;
+        long changed;
         int fd;
         char filename[PATH_MAX];
         CURL *curl = NULL;
@@ -140,6 +194,22 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
 
         curl_easy_setopt(curl, CURLOPT_URL, url);
         curl_easy_setopt(curl, CURLOPT_WRITEDATA, file);
+        curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, CURL_HTTP_VERSION_2_0);
+
+        /*
+         * Some sane timeout values to prevent stalls
+         *
+         * Connect timeout is for first connection to the server.
+         * The low speed timeout is for slow downloads. Since many
+         * files are several mB large, we want to prevent them from
+         * taking forever. (1kB/sec avg over 30secs).
+         */
+        curl_easy_setopt(curl, CURLOPT_CONNECTTIMEOUT, 30);
+        curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 30);
+        curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 1024);
+
+        /* request timestamp of files from server */
+        curl_easy_setopt(curl, CURLOPT_FILETIME, 1);
 
         if (timestamp) {
                 curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
@@ -168,6 +238,17 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
         }
 
         if (ret == 200) {
+                /* get timestamp, if any */
+                curl_easy_getinfo(curl, CURLINFO_FILETIME, &changed);
+                if (changed >= 0) {
+                        struct timespec times[2];
+                        times[0].tv_sec = (time_t)changed;
+                        times[0].tv_nsec = 0;
+                        times[1].tv_sec = (time_t)changed;
+                        times[1].tv_nsec = 0;
+                        futimens(fd, times);
+                }
+
                 autofree(char) *command = NULL;
                 //		printf("Filename is %s\n", filename);
 
@@ -175,7 +256,8 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
                 stat(filename, &statbuf);
                 if (statbuf.st_size > 0 &&
                     asprintf(&command,
-                             "tar -C /var/cache/debuginfo/%s --no-same-owner  -xf %s",
+                             "tar -C /var/cache/debuginfo/%s --no-same-owner "
+                             "--no-same-permissions  -xf %s",
                              prefix,
                              filename) >= 0) {
                         if (system(command) != 0) {
@@ -220,7 +302,6 @@ static void *server_thread(void *arg)
         if (ret < 0) {
                 goto thread_end;
         }
-        prefix = buf;
         c = strchr(buf, ':');
         if (!c) {
                 goto thread_end;
@@ -273,6 +354,7 @@ static void *server_thread(void *arg)
         }
 
         gettimeofday(&after, NULL);
+#if 0
         if (timedelta(before, after) > 0.6)
                 printf("Request for %s took %5.2f seconds (%i - %i)\n",
                        url,
@@ -280,7 +362,7 @@ static void *server_thread(void *arg)
                            (1.0 * after.tv_usec - before.tv_usec) / 1000000.0,
                        ret,
                        (int)timestamp);
-
+#endif
         /* tell the other side we're done with the download */
         wr = write(fd, "ok", 3);
 
@@ -298,40 +380,97 @@ int main(__nc_unused__ int argc, __nc_unused__ char **argv)
         struct sockaddr_un sun;
         int ret;
         int curl_done = 0;
+        uid_t dbg_user = 0;
+        gid_t dbg_group = 0;
+        struct passwd *passwdentry;
         const char *required_paths[] = { "/var/cache/debuginfo/lib", "/var/cache/debuginfo/src" };
 
+        umask(0);
+        passwdentry = getpwnam("dbginfo");
+        if (passwdentry) {
+                dbg_user = passwdentry->pw_uid;
+                dbg_group = passwdentry->pw_gid;
+        }
+        endpwent();
+
+        if (prctl(PR_SET_DUMPABLE, 0) != 0) {
+                fprintf(stderr,
+                        "Failed to disable PR_SET_DUMPABLE. Do NOT gdb attach this process: %s\n",
+                        strerror(errno));
+        }
+
+        if (geteuid() == 0) {
+                if (prctl(PR_CAPBSET_DROP, CAP_SYS_ADMIN) != 0) {
+                        fprintf(stderr, "Failed to drop caps: %s\n", strerror(errno));
+                }
+        }
+
         for (size_t i = 0; i < ARRAY_SIZE(required_paths); i++) {
                 const char *req_path = required_paths[i];
-                if (nc_file_exists(req_path)) {
+                struct stat st = { .st_ino = 0 };
-                        continue;
+                if (lstat(req_path, &st) == 0) {
+                        /* If the file already exists, check ownership
+                         * and delete tree if incorrect. Essentially a
+                         * one-off operation to transition from root owned to
+                         * dbginfo owned */
+                        if (st.st_uid == dbg_user) {
+                                continue;
+                        }
+                        fprintf(stderr, "Removing old debug information %s\n", req_path);
+                        nc_rm_rf(req_path);
                 }
                 if (!nc_mkdir_p(req_path, 00755)) {
                         fprintf(stderr, "Failed to mkdir: %s %s\n", strerror(errno), req_path);
                         return EXIT_FAILURE;
                 }
+                if (chown(req_path, dbg_user, dbg_group) != 0) {
+                        fprintf(stderr, "Failed to chown: %s %s\n", strerror(errno), req_path);
+                        return EXIT_FAILURE;
+                }
         }
 
         signal(SIGPIPE, SIG_IGN);
 
-        sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+	if (sd_listen_fds(0) == 1) {
-        if (sockfd < 0) {
+		/* systemd socket activation */
+		printf("Received socket from systemd socket activation\n");
+		sockfd = SD_LISTEN_FDS_START + 0;
+	} else if (sd_listen_fds(0) > 1) {
+		printf("Too many file descriptors received.\n");
+		exit(1);
+	} else {
+		sockfd = socket(AF_UNIX, SOCK_STREAM, 0);
+		if (sockfd < 0) {
+			return EXIT_FAILURE;
+		}
+
+		sun.sun_family = AF_UNIX;
+		strcpy(sun.sun_path, "/run/clr-debug-info");
+
+		ret = bind(sockfd,
+			(struct sockaddr *)&sun,
+			offsetof(struct sockaddr_un, sun_path) + strlen("/run/clr-debug-info") + 1);
+		if (ret < 0) {
+			printf("Failed to bind:%s \n", strerror(errno));
+			return EXIT_FAILURE;
+		}
+
+		if (listen(sockfd, 16) < 0) {
+			printf("Failed to listen:%s \n", strerror(errno));
+			return EXIT_FAILURE;
+		}
+	}
+
+        if (setgid(dbg_group)) {
+                fprintf(stderr, "Unable to drop privileges setgid %s\n", strerror(errno));
                 return EXIT_FAILURE;
         }
-
+        if (setgroups(1, &dbg_group)) {
-        sun.sun_family = AF_UNIX;
+                fprintf(stderr, "Unable to drop privileges setgroups %s\n", strerror(errno));
-        strcpy(sun.sun_path, ":clr-debug-info");
-        sun.sun_path[0] = 0; /* anonymous unix socket */
-
-        ret = bind(sockfd,
-                   (struct sockaddr *)&sun,
-                   offsetof(struct sockaddr_un, sun_path) + strlen(":clr-debug-info") + 1);
-        if (ret < 0) {
-                printf("Failed to bind:%s \n", strerror(errno));
                 return EXIT_FAILURE;
         }
-
+        if (setuid(dbg_user)) {
-        if (listen(sockfd, 16) < 0) {
+                fprintf(stderr, "Unable to drop privileges setuid  %s\n", strerror(errno));
-                printf("Failed to listen:%s \n", strerror(errno));
                 return EXIT_FAILURE;
         }