/**
* @brief
* Secures all the files' permissions in home_path to full control
* for administrators group and to read for everyone group.
*
* @return void
*/
void
secure_misc_files()
{
char path[MAXPATHLEN+1];
HANDLE hfile;
char logb[LOG_BUF_SIZE] = {'\0' } ;
if (pbs_conf.pbs_home_path == NULL) {
sprintf(logb,"no home_path!");
log_err(-1, "secure_misc_files", logb);
return;
}
secure_file2(pbs_conf.pbs_home_path,
"Administrators", READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"\\Everyone", READS_MASK | READ_CONTROL);
sprintf(logb,"securing %s for read access by Everyone",
pbs_conf.pbs_home_path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
sprintf(path, "%s/spool", pbs_conf.pbs_home_path);
create_dir_everyone_readwrite(path);
/* Only admin can run the launch.bat script */
sprintf(path, "%s/launch.bat", path);
secure_file2(path,
"Administrators", READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"\\Everyone", READS_MASK|READ_CONTROL);
sprintf(path, "%s/undelivered", pbs_conf.pbs_home_path);
create_dir_everyone_readwrite(path);
sprintf(path, "%s/pbs_environment", pbs_conf.pbs_home_path);
hfile = CreateFile(path, GENERIC_WRITE, FILE_SHARE_WRITE, 0,
OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if (hfile != INVALID_HANDLE_VALUE) {
sprintf(logb,"created file %s", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG,PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
CloseHandle(hfile);
}
sprintf(logb,"securing file %s: full access to admin and read to Everyone",
path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
secure_file2(path,
"Administrators", READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"\\Everyone", READS_MASK|READ_CONTROL);
sprintf(path, "%s/auxiliary", pbs_conf.pbs_home_path);
create_dir_everyone_read(path);
sprintf(path, "%s/checkpoint", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
}
/**
*
* @brief Recursively change permissions to everyone read in a directory tree.
*
* @param[in] path - the target file/directory
*
* @return void
*
*/
static void
make_dir_files_everyone_read(char *path)
{
char logb[LOG_BUF_SIZE] = {'\0' } ;
DIR *dir;
struct dirent *pdirent;
char dirfile[MAXPATHLEN+1];
struct stat sb;
int isdir = 1;
if (path == NULL || *path == '\0')
return;
/* Secure the item that path refers to. */
secure_file2(path, "Administrators", READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"\\Everyone", READS_MASK|READ_CONTROL);
sprintf(logb,"securing %s for read access by Everyone", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
/* If the item is not a directory, we are done. */
if (stat(path, &sb) == -1) {
sprintf(logb, "\"%s\" does not exist", path);
log_err(-1, "make_dir_files_everyone_read", logb);
return;
}
if (!S_ISDIR(sb.st_mode)) {
return;
}
dir = opendir(path);
if (dir == NULL) {
sprintf(logb,"readdir error; %s", path);
log_err(-1, "make_dir_files_everyone_read", logb);
return;
}
/* Recurse into the directory. */
while (errno = 0, (pdirent = readdir(dir)) != NULL) {
/* Ignore the "." and ".." entries. */
if (pdirent->d_name[0] == '.') {
if (pdirent->d_name[1] == '\0')
continue;
if (pdirent->d_name[1] == '.' && pdirent->d_name[2] == '\0')
continue;
}
/* If we will exceed the maximum path length, skip this item. */
if (strlen(path) + strlen(pdirent->d_name) + 1 >= MAXPATHLEN)
continue;
sprintf(dirfile, "%s/%s", path, pdirent->d_name);
make_dir_files_everyone_read(dirfile);
}
if (errno != 0 && errno != ENOENT) {
sprintf(logb,"readdir error; %s", path);
log_err(-1, "make_dir_files_everyone_read", logb);
}
(void)closedir(dir);
}
/**
*
* @brief Recursively change permissions for administrators group
* and Service account in a directory tree.
*
* @param[in] path - the target file/directory
*
* @return void
*
*/
void
make_dir_files_service_account_read(char *path)
{
DIR *dir;
struct dirent *pdirent;
char dirfile[MAXPATHLEN+1];
char *username = NULL;
username = getlogin_full();
secure_file2(path, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
username, READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED);
dir = opendir(path);
if (dir == NULL) {
return;
}
while (errno = 0, (pdirent = readdir(dir)) != NULL) {
if (strcmp(pdirent->d_name, ".") == 0 ||
strcmp(pdirent->d_name, "..") == 0)
continue;
sprintf(dirfile, "%s/%s", path, pdirent->d_name);
secure_file2(dirfile, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
username, READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED);
#ifdef DEBUG
printf("securing file %s: full access to admin and %s \n", dirfile, username);
#endif
}
#ifdef DEBUG
if (errno != 0 && errno != ENOENT)
printf("readdir error; %s\n", path);
#endif
(void)closedir(dir);
}
/**
*
* @brief Secures all the files' permissions (and recreate directories) that are related
* to pbs_sched service to full control for administrators group and to read
* for everyone group
*
*
* @return void
*/
void
secure_sched_files()
{
DIR *dir;
struct stat sbuf;
char path[MAXPATHLEN+1];
char logb[LOG_BUF_SIZE] = {'\0' } ;
if (pbs_conf.pbs_home_path == NULL) {
sprintf(logb,"no home_path!");
log_err(-1, "secure_sched_files", logb);
return;
}
sprintf(path, "%s/sched_priv", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
dir = opendir(path);
if (dir != NULL) {
struct dirent *pdirent;
char fpath[MAXPATHLEN+1];
while (errno = 0,
(pdirent = readdir(dir)) != NULL) {
if( (strcmp(pdirent->d_name, ".") != 0) && \
(strcmp(pdirent->d_name, "..") != 0) ) {
sprintf(fpath, "%s/%s", path, pdirent->d_name);
if( (lstat(fpath, &sbuf) == 0) && \
S_ISREG(sbuf.st_mode) ) {
sprintf(logb,"securing file %s", fpath);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
secure_file2(fpath, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"\\Everyone", READS_MASK|READ_CONTROL);
} else {
sprintf(logb,"file %s not reg", fpath);
log_err(-1, "secure_sched_files", logb);
}
}
}
if (errno != 0 && errno != ENOENT) {
sprintf(logb,"readdir error; %s", path);
log_err(-1, "secure_sched_files", logb);
}
(void)closedir(dir);
}
sprintf(path, "%s/sched_logs", pbs_conf.pbs_home_path);
create_dir_everyone_read(path);
}
/**
* @brief
* create read/write directory in given path,
*
* @param[in] path - path where directory to be created
*/
static void
create_dir_everyone_readwrite(char *path)
{
char logb[LOG_BUF_SIZE] = {'\0' } ;
if (CreateDirectory(path, 0) != 0) {
sprintf(logb,"created %s for everyone to read/write", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
}
sprintf(logb,"securing %s for read/write access by Everyone", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
secure_file2(path,
"Administrators", READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"\\Everyone", READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED);
}
/**
*
* @brief
* Secures all the files' permissions (and recreate directories)
* that are related to pbs_mom service.
*
*/
void
secure_mom_files(void)
{
DIR *dir;
char path[MAXPATHLEN+1];
HANDLE hfile;
char *username = NULL;
char logb[LOG_BUF_SIZE] = {'\0' } ;
if (pbs_conf.pbs_home_path == NULL) {
sprintf(logb,"no home_path!");
log_err(-1, "secure_mom_files", logb);
return;
}
username = getlogin_full();
sprintf(path, "%s/mom_priv", pbs_conf.pbs_home_path);
create_dir_everyone_read(path);
dir = opendir(path);
if (dir != NULL) {
struct dirent *pdirent;
char fpath[MAXPATHLEN+1];
while (errno = 0,
(pdirent = readdir(dir)) != NULL) {
char *p;
if (p = strrchr(pdirent->d_name, '.')) {
int baselen = strlen(p)-4;
if (baselen < 0)
continue;
if (strcmpi(p+baselen, ".bat") == 0) {
sprintf(fpath, "%s/%s", path, pdirent->d_name);
sprintf(logb,"securing file %s", fpath);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
secure_file2(fpath, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"\\Everyone", READS_MASK|READ_CONTROL);
}
}
}
if (errno != 0 && errno != ENOENT) {
sprintf(logb,"readdir error; %s", path);
log_err(-1, "secure_mom_files", logb);
}
(void)closedir(dir);
}
sprintf(path, "%s/mom_priv/config", pbs_conf.pbs_home_path);
hfile = CreateFile(path, GENERIC_WRITE, FILE_SHARE_WRITE, 0,
OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if (hfile != INVALID_HANDLE_VALUE) {
sprintf(logb,"created file %s", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
CloseHandle(hfile);
}
sprintf(logb,"securing %s for admin-only access", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
secure_file2(path, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
username, READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED);
sprintf(path, "%s/mom_logs", pbs_conf.pbs_home_path);
create_dir_everyone_read(path);
sprintf(path, "%s/mom_priv/jobs", pbs_conf.pbs_home_path);
create_dir_everyone_read(path);
sprintf(path, "%s/mom_priv/hooks", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
sprintf(path, "%s/mom_priv/hooks/tmp", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
}
/**
*
* @brief Secures all the files' permissions (and recreate directories) that are
* related to pbs_server service to full control for administrators group
* and to read for everyone group.
*
* @return void
*
*/
void
secure_server_files()
{
char path[MAXPATHLEN+1];
HANDLE hfile;
char *username = NULL;
char logb[LOG_BUF_SIZE] = {'\0' } ;
if (pbs_conf.pbs_home_path == NULL) {
sprintf(logb,"no home_path!");
log_err(-1, "secure_server_files", logb);
return;
}
username = getlogin_full();
sprintf(path, "%s/server_priv", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
sprintf(path, "%s/server_priv/jobs", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
sprintf(path, "%s/server_priv/users", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
sprintf(path, "%s/server_priv/hooks", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
sprintf(path, "%s/server_priv/hooks/tmp", pbs_conf.pbs_home_path);
create_dir_admin_service_account_full_access(path);
sprintf(path, "%s/server_priv/license_file",
pbs_conf.pbs_home_path);
secure_file2(path, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
username, READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED);
sprintf(path, "%s/server_priv/resourcedef",
pbs_conf.pbs_home_path);
hfile = CreateFile(path, GENERIC_WRITE, FILE_SHARE_WRITE, 0,
OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if (hfile != INVALID_HANDLE_VALUE) {
sprintf(logb,"created file %s", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
CloseHandle(hfile);
}
sprintf(logb,"securing %s for admin-only access", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
secure_file2(path, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
username, READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED);
sprintf(path, "%s/server_logs", pbs_conf.pbs_home_path);
create_dir_everyone_read(path);
sprintf(path, "%s/server_priv/accounting",
pbs_conf.pbs_home_path);
create_dir_everyone_read(path);
sprintf(path, "%s/lib/python", pbs_conf.pbs_exec_path);
make_dir_files_everyone_read(path);
/*
* Permissions of the file $PBS_HOME/server_priv/svrlive, on creation, is set to
* read/write for administrator group. However, on Windows Vista, a combination of a
* reboot after installation and permission setting on server_priv (earlier in this
* function) changes the permission of the svrlive file, thus disallowing server
* database saves (resulting in cascading failures, e.g., job submission). Thus we
* "reset" the permissions on the svrlive file here to what it is supposed to be.
*/
sprintf(path, "%s/server_priv/svrlive", pbs_conf.pbs_home_path);
sprintf(logb,"securing %s for admin-only access", path);
log_event(PBSEVENT_SYSTEM | PBSEVENT_ADMIN | PBSEVENT_FORCE| PBSEVENT_DEBUG, PBS_EVENTCLASS_FILE, LOG_DEBUG, "", logb);
secure_file2(path, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
username, READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED);
secure_server_datastore_files();
}
/**
*
* @brief
* Open the log file for append.
*
* @par
* Opens a (new) log file.
* If a log file is already open, and the new file is successfully opened,
* the old file is closed. Otherwise the old file is left open.
* @param[in] filename - if non-NULL or non-empty string, then this must be
* an absolute pathname, which is opened and made as
* the log file.
* - if NULL or empty string, then calls mk_log_name()
* to create a log file named after the current date
* yymmdd, which is made into the log file.
* @param[in] log_directory - The directory used by mk_log_name()
* as the log directory for the generated
* log filename.
* @param[in] silent - if set to 1, then extra messages such as
* "Log opened", "pbs_version=", "pbs_build="
* are not printed out on the log file.
*
* @return int
* @retval 0 for success
* @retval != 0 for failure
*/
int
log_open_main(char *filename, char *directory, int silent)
{
char buf[_POSIX_PATH_MAX];
int fds;
/*providing temporary buffer, tbuf, for forming pbs_version
*and pbs_build messages that get written on logfile open.
*Using the usual buffer, log_buffer, that one sees in calls
*to log_event() will result in clobbering the first message
*after midnight: log_event(), calls log_record(), calls
*log_close() followed by log_open() - so a write into "log_buffer"
*inside log_open() obliterates the message that would have been
*placed in the newly opened, after mignight, server logfile.
*/
char tbuf[LOG_BUF_SIZE];
pthread_once(&log_once_ctl, log_init); /* initialize mutex once */
if (log_opened > 0)
return (-1); /* already open */
if (pbs_conf.locallog != 0 || pbs_conf.syslogfac == 0) {
/* open PBS local logging */
if (strcmp(log_directory, directory) != 0)
(void)strncpy(log_directory, directory, _POSIX_PATH_MAX/2-1);
if ((filename == (char *)0) || (*filename == '\0')) {
filename = mk_log_name(buf, _POSIX_PATH_MAX);
log_auto_switch = 1;
}
#ifdef WIN32
else if (*filename != '\\' && (strlen(filename) > 1 && \
*(filename+1) != ':') ) {
return (-1); /* must be absolute path */
}
#else
else if (*filename != '/') {
return (-1); /* must be absolute path */
}
#endif
#ifdef WIN32
if ((fds = open(filename, O_CREAT|O_WRONLY|O_APPEND, S_IREAD | S_IWRITE)) < 0)
#elif defined (O_LARGEFILE )
if ((fds = open(filename, O_CREAT|O_WRONLY|O_APPEND|O_LARGEFILE, 0644)) < 0)
#else
if ((fds = open(filename, O_CREAT|O_WRONLY|O_APPEND, 0644)) < 0)
#endif
{
log_opened = -1; /* note that open failed */
return (-1);
}
#ifdef WIN32
secure_file2(filename, "Administrators",
READS_MASK|WRITES_MASK|STANDARD_RIGHTS_REQUIRED,
"Everyone", READS_MASK | READ_CONTROL);
#endif
DBPRT(("Opened log file %s\n", filename))
if (fds < 3) {
log_opened = fcntl(fds, F_DUPFD, 3); /* overload variable */
if (log_opened < 0)
return (-1);
(void)close(fds);
fds = log_opened;
}
logfile = fdopen(fds, "a");
#ifdef WIN32
(void)setvbuf(logfile, NULL, _IONBF, 0); /* no buffering to get instant log */
#else
(void)setvbuf(logfile, NULL, _IOLBF, 0); /* set line buffering */
#endif
log_opened = 1; /* note that file is open */
if (!silent) {
log_record(PBSEVENT_SYSTEM, PBS_EVENTCLASS_SERVER, LOG_INFO, "Log", "Log opened");
snprintf(tbuf, LOG_BUF_SIZE, "pbs_version=%s", pbs_version);
log_record(PBSEVENT_SYSTEM, PBS_EVENTCLASS_SERVER, LOG_INFO, msg_daemonname, tbuf);
snprintf(tbuf, LOG_BUF_SIZE, "pbs_build=%s", pbs_build);
log_record(PBSEVENT_SYSTEM, PBS_EVENTCLASS_SERVER, LOG_INFO, msg_daemonname, tbuf);
}
}
#if SYSLOG
if (syslogopen == 0 && pbs_conf.syslogfac > 0 && pbs_conf.syslogfac < 10) {
/*
* We do not assume that the log facilities are defined sequentially.
* That is why we reference them each by name.
*/
switch (pbs_conf.syslogfac) {
case 2:
syslogopen = LOG_LOCAL0;
break;
case 3:
syslogopen = LOG_LOCAL1;
break;
case 4:
syslogopen = LOG_LOCAL2;
break;
case 5:
syslogopen = LOG_LOCAL3;
break;
case 6:
syslogopen = LOG_LOCAL4;
break;
case 7:
syslogopen = LOG_LOCAL5;
break;
case 8:
syslogopen = LOG_LOCAL6;
break;
case 9:
syslogopen = LOG_LOCAL7;
break;
case 1:
default:
syslogopen = LOG_DAEMON;
break;
}
openlog(msg_daemonname, LOG_NOWAIT, syslogopen);
DBPRT(("Syslog enabled, facility = %d\n", syslogopen))
if (pbs_conf.syslogsvr != 0) {
/* set min priority of what gets logged via syslog */
setlogmask(LOG_UPTO(pbs_conf.syslogsvr));
DBPRT(("Syslog mask set to 0x%x\n", pbs_conf.syslogsvr))
}
}
