much shorter timeouts

Make /var/cache/debuginfo and its contents owned by dgbinfo. Create
the directories as this user, and switch to run as this user.

Signed-off-by: Icarus Sparry <icarus.w.sparry@intel.com>

clr_debug_daemon.service

@@ -1,5 +1,6 @@
 [Unit]
 Description=Clear Linux debuginfo daemon
+DefaultDependencies=no
 
 [Service]
 Type=simple

clr_debug_fuse.service

@@ -1,6 +1,7 @@
 [Unit]
 Description=Clear Linux debuginfo fuse monitor
 After=clr_debug_daemon.service
+DefaultDependencies=no
 
 [Service]
 Type=simple

configure.ac

@@ -2,7 +2,7 @@
 # Process this file with autoconf to produce a configure script.
 
 AC_PREREQ([2.66])
-AC_INIT(clr-debug-info, 38, arjan@linux.intel.com)
+AC_INIT(clr-debug-info, 43, arjan@linux.intel.com)
 AM_INIT_AUTOMAKE([foreign -Wall -W subdir-objects])
 AM_SILENT_RULES([yes])
 AC_PROG_CC

debuginfo.conf

@@ -8,5 +8,7 @@
 # See tmpfiles.d(5) for details
 
 # Clear tmp directories separately, to make them easier to override
-d /var/cache/debuginfo/lib 755 root root 10d
-d /var/cache/debuginfo/src 755 root root 1d
+# Unfortunatly tmpfiles doesn't change the ownership for things if they
+# are not listed.
+d /var/cache/debuginfo/lib 755 dbginfo dbginfo 10d
+d /var/cache/debuginfo/src 755 dbginfo dbginfo 1d

src/client.c

@@ -37,8 +37,8 @@
 #include <unistd.h>
 
 /* 0.75 seconds timeout */
-#define TIMEOUT 750000
-#define TIMEOUT2 15000
+#define TIMEOUT 75000
+#define TIMEOUT2 1500
 #define TIMEOUT3 500
 
 char *prefix = "src";

src/server.c

@@ -27,9 +27,11 @@
 #define _GNU_SOURCE
 
 #include <errno.h>
+#include <grp.h>
 #include <linux/capability.h>
 #include <malloc.h>
 #include <pthread.h>
+#include <pwd.h>
 #include <signal.h>
 #include <stddef.h>
 #include <stdio.h>
@@ -162,6 +164,7 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
 {
         CURLcode code;
         long ret;
+        long changed;
         int fd;
         char filename[PATH_MAX];
         CURL *curl = NULL;
@@ -203,6 +206,9 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
         curl_easy_setopt(curl, CURLOPT_LOW_SPEED_TIME, 30);
         curl_easy_setopt(curl, CURLOPT_LOW_SPEED_LIMIT, 1024);
 
+        /* request timestamp of files from server */
+        curl_easy_setopt(curl, CURLOPT_FILETIME, 1);
+
         if (timestamp) {
                 curl_easy_setopt(curl, CURLOPT_TIMECONDITION, CURL_TIMECOND_IFMODSINCE);
                 curl_easy_setopt(curl, CURLOPT_TIMEVALUE, timestamp);
@@ -230,6 +236,17 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
         }
 
         if (ret == 200) {
+                /* get timestamp, if any */
+                curl_easy_getinfo(curl, CURLINFO_FILETIME, &changed);
+                if (changed >= 0) {
+                        struct timespec times[2];
+                        times[0].tv_sec = (time_t)changed;
+                        times[0].tv_nsec = 0;
+                        times[1].tv_sec = (time_t)changed;
+                        times[1].tv_nsec = 0;
+                        futimens(fd, times);
+                }
+
                 autofree(char) *command = NULL;
                 //		printf("Filename is %s\n", filename);
 
@@ -237,7 +254,8 @@ static int curl_get_file(const char *url, const char *prefix, time_t timestamp)
                 stat(filename, &statbuf);
                 if (statbuf.st_size > 0 &&
                     asprintf(&command,
-                             "tar -C /var/cache/debuginfo/%s --no-same-owner  --no-same-permissions  -xf %s",
+                             "tar -C /var/cache/debuginfo/%s --no-same-owner "
+                             "--no-same-permissions  -xf %s",
                              prefix,
                              filename) >= 0) {
                         if (system(command) != 0) {
@@ -360,8 +378,19 @@ int main(__nc_unused__ int argc, __nc_unused__ char **argv)
         struct sockaddr_un sun;
         int ret;
         int curl_done = 0;
+        uid_t dbg_user = 0;
+        gid_t dbg_group = 0;
+        struct passwd *passwdentry;
         const char *required_paths[] = { "/var/cache/debuginfo/lib", "/var/cache/debuginfo/src" };
 
+        umask(0);
+        passwdentry = getpwnam("dbginfo");
+        if (passwdentry) {
+                dbg_user = passwdentry->pw_uid;
+                dbg_group = passwdentry->pw_gid;
+        }
+        endpwent();
+
         if (prctl(PR_SET_DUMPABLE, 0) != 0) {
                 fprintf(stderr,
                         "Failed to disable PR_SET_DUMPABLE. Do NOT gdb attach this process: %s\n",
@@ -376,13 +405,26 @@ int main(__nc_unused__ int argc, __nc_unused__ char **argv)
 
         for (size_t i = 0; i < ARRAY_SIZE(required_paths); i++) {
                 const char *req_path = required_paths[i];
-                if (nc_file_exists(req_path)) {
-                        continue;
+                struct stat st = { .st_ino = 0 };
+                if (lstat(req_path, &st) == 0) {
+                        /* If the file already exists, check ownership
+                         * and delete tree if incorrect. Essentially a
+                         * one-off operation to transition from root owned to
+                         * dbginfo owned */
+                        if (st.st_uid == dbg_user) {
+                                continue;
+                        }
+                        fprintf(stderr, "Removing old debug information %s\n", req_path);
+                        nc_rm_rf(req_path);
                 }
                 if (!nc_mkdir_p(req_path, 00755)) {
                         fprintf(stderr, "Failed to mkdir: %s %s\n", strerror(errno), req_path);
                         return EXIT_FAILURE;
                 }
+                if (chown(req_path, dbg_user, dbg_group) != 0) {
+                        fprintf(stderr, "Failed to chown: %s %s\n", strerror(errno), req_path);
+                        return EXIT_FAILURE;
+                }
         }
 
         signal(SIGPIPE, SIG_IGN);
@@ -409,6 +451,19 @@ int main(__nc_unused__ int argc, __nc_unused__ char **argv)
                 return EXIT_FAILURE;
         }
 
+        if (setgid(dbg_group)) {
+                fprintf(stderr, "Unable to drop privileges setgid %s\n", strerror(errno));
+                return EXIT_FAILURE;
+        }
+        if (setgroups(1, &dbg_group)) {
+                fprintf(stderr, "Unable to drop privileges setgroups %s\n", strerror(errno));
+                return EXIT_FAILURE;
+        }
+        if (setuid(dbg_user)) {
+                fprintf(stderr, "Unable to drop privileges setuid  %s\n", strerror(errno));
+                return EXIT_FAILURE;
+        }
+
         while (1) {
                 int clientsock;
                 pthread_t thread;