| | 1 | --- agent/gpg-agent.c.old 2014-07-07 22:50:11.000000000 +0200 |
| | 2 | +++ agent/gpg-agent.c 2014-07-07 23:02:55.000000000 +0200 |
| | 3 | @@ -47,6 +47,78 @@ |
| | 4 | #include <unistd.h> |
| | 5 | #include <signal.h> |
| | 6 | #include <pth.h> |
| | 7 | +#ifdef __APPLE_LAUNCHD__ |
| | 8 | +# include <launch.h> |
| | 9 | + |
| | 10 | +extern char **environ; |
| | 11 | + |
| | 12 | +# define GPG_ENV_SOCKET_AGENT "GPG_AGENT_INTERNAL1" |
| | 13 | +# define GPG_ENV_SOCKET_SSH "GPG_AGENT_INTERNAL2" |
| | 14 | +# define GPG_SOCKET_NAME_AGENT "Listeners_agent" |
| | 15 | +# define GPG_SOCKET_NAME_SSH "Listeners_ssh" |
| | 16 | + |
| | 17 | +# define PASS_ENV_VAR_TO_LAUNCHD(KEY, VALUE) \ |
| | 18 | +do \ |
| | 19 | + { \ |
| | 20 | + launch_data_t resp, msg, tmp, tmp_value; \ |
| | 21 | + msg = launch_data_alloc (LAUNCH_DATA_DICTIONARY); \ |
| | 22 | + tmp = launch_data_alloc (LAUNCH_DATA_DICTIONARY); \ |
| | 23 | + \ |
| | 24 | + if (!VALUE || !KEY || (strlen (KEY) == 0)) { \ |
| | 25 | + log_error ("invalid key or value given: `" #KEY "', `" #VALUE "'.\n"); \ |
| | 26 | + exit (1); \ |
| | 27 | + } \ |
| | 28 | + \ |
| | 29 | + char *value_start = strchr (VALUE, '='); \ |
| | 30 | + if (!value_start) \ |
| | 31 | + value_start = VALUE; \ |
| | 32 | + else \ |
| | 33 | + ++value_start; \ |
| | 34 | + \ |
| | 35 | + tmp_value = launch_data_new_string (value_start); /* Skip variable name \ |
| | 36 | + * and equal sign */ \ |
| | 37 | + launch_data_dict_insert (tmp, tmp_value, KEY); \ |
| | 38 | + launch_data_dict_insert (msg, tmp, "SetUserEnvironment"); \ |
| | 39 | + \ |
| | 40 | + resp = launch_msg (msg); \ |
| | 41 | + \ |
| | 42 | + if (!resp) { \ |
| | 43 | + log_error ("failed to pass environment variable `" KEY "' to launchd: %s\n", \ |
| | 44 | + strerror (errno)); \ |
| | 45 | + exit (1); \ |
| | 46 | + } \ |
| | 47 | + launch_data_free (resp); \ |
| | 48 | + launch_data_free (msg); /* Do NOT launch_data_free() neither on tmp, nor tmp_value */ \ |
| | 49 | + } \ |
| | 50 | +while (0) |
| | 51 | + |
| | 52 | +# define REMOVE_ENV_VAR_FROM_LAUNCHD(ENV_VAR_NAME) \ |
| | 53 | +do \ |
| | 54 | + { \ |
| | 55 | + launch_data_t resp, msg, tmp; \ |
| | 56 | + msg = launch_data_alloc (LAUNCH_DATA_DICTIONARY); \ |
| | 57 | + \ |
| | 58 | + if (!ENV_VAR_NAME || (strlen (ENV_VAR_NAME) == 0)) { \ |
| | 59 | + log_error ("invalid environment variable name given: `" #ENV_VAR_NAME "'.\n"); \ |
| | 60 | + exit (1); \ |
| | 61 | + } \ |
| | 62 | + \ |
| | 63 | + tmp = launch_data_new_string (ENV_VAR_NAME); \ |
| | 64 | + launch_data_dict_insert (msg, tmp, "UnsetUserEnvironment"); \ |
| | 65 | + \ |
| | 66 | + resp = launch_msg (msg); \ |
| | 67 | + \ |
| | 68 | + if (!resp) { \ |
| | 69 | + log_error ("failed to remove environment variable `" ENV_VAR_NAME "' from launchd: %s\n", \ |
| | 70 | + strerror (errno)); \ |
| | 71 | + } \ |
| | 72 | + launch_data_free (resp); \ |
| | 73 | + launch_data_free (msg); /* Do NOT launch_data_free() on tmp */ \ |
| | 74 | + } \ |
| | 75 | +while (0) |
| | 76 | + |
| | 77 | + |
| | 78 | +#endif // __APPLE_LAUNCHD__ |
| | 79 | |
| | 80 | #define JNLIB_NEED_LOG_LOGV |
| | 81 | #define JNLIB_NEED_AFLOCAL |
| | 82 | @@ -85,6 +157,9 @@ |
| | 83 | oLogFile, |
| | 84 | oServer, |
| | 85 | oDaemon, |
| | 86 | +#ifdef __APPLE_LAUNCHD__ |
| | 87 | + oLaunchd, |
| | 88 | +#endif |
| | 89 | oBatch, |
| | 90 | |
| | 91 | oPinentryProgram, |
| | 92 | @@ -133,6 +208,9 @@ |
| | 93 | { 301, NULL, 0, N_("@Options:\n ") }, |
| | 94 | |
| | 95 | { oDaemon, "daemon", 0, N_("run in daemon mode (background)") }, |
| | 96 | +#ifdef __APPLE_LAUNCHD__ |
| | 97 | + { oLaunchd, "launchd", 0, N_("run controlled by launchd (foreground)") }, |
| | 98 | +#endif |
| | 99 | { oServer, "server", 0, N_("run in server mode (foreground)") }, |
| | 100 | { oVerbose, "verbose", 0, N_("verbose") }, |
| | 101 | { oQuiet, "quiet", 0, N_("be somewhat more quiet") }, |
| | 102 | @@ -473,6 +551,16 @@ |
| | 103 | { |
| | 104 | remove_socket (socket_name); |
| | 105 | remove_socket (socket_name_ssh); |
| | 106 | + |
| | 107 | +#ifdef __APPLE_LAUNCHD__ |
| | 108 | + /* Remove environment variables from launchd. */ |
| | 109 | + REMOVE_ENV_VAR_FROM_LAUNCHD ("GPG_AGENT_INFO"); |
| | 110 | + |
| | 111 | + if (opt.ssh_support) { |
| | 112 | + REMOVE_ENV_VAR_FROM_LAUNCHD ("SSH_AUTH_SOCK"); |
| | 113 | + REMOVE_ENV_VAR_FROM_LAUNCHD ("SSH_AGENT_PID"); |
| | 114 | + } |
| | 115 | +#endif // __APPLE_LAUNCHD__ |
| | 116 | } |
| | 117 | |
| | 118 | |
| | 119 | @@ -594,6 +682,9 @@ |
| | 120 | int nogreeting = 0; |
| | 121 | int pipe_server = 0; |
| | 122 | int is_daemon = 0; |
| | 123 | +#ifdef __APPLE_LAUNCHD__ |
| | 124 | + int launchd_child = 0; |
| | 125 | +#endif |
| | 126 | int nodetach = 0; |
| | 127 | int csh_style = 0; |
| | 128 | char *logfile = NULL; |
| | 129 | @@ -812,6 +903,9 @@ |
| | 130 | case oSh: csh_style = 0; break; |
| | 131 | case oServer: pipe_server = 1; break; |
| | 132 | case oDaemon: is_daemon = 1; break; |
| | 133 | +#ifdef __APPLE_LAUNCHD__ |
| | 134 | + case oLaunchd: launchd_child = 1; break; |
| | 135 | +#endif |
| | 136 | |
| | 137 | case oDisplay: default_display = xstrdup (pargs.r.ret_str); break; |
| | 138 | case oTTYname: default_ttyname = xstrdup (pargs.r.ret_str); break; |
| | 139 | @@ -854,6 +948,19 @@ |
| | 140 | default : pargs.err = configfp? 1:2; break; |
| | 141 | } |
| | 142 | } |
| | 143 | + |
| | 144 | + /* When running under launchd control, only start for real users ie UID >= 500 |
| | 145 | + * |
| | 146 | + * Do this check early to avoid filling logs */ |
| | 147 | + |
| | 148 | +#ifdef __APPLE_LAUNCHD__ |
| | 149 | + if (launchd_child && geteuid() < 500) |
| | 150 | + { |
| | 151 | + log_error ("launchd only supported for real users - i.e., UID >= 500\n"); |
| | 152 | + exit (1); |
| | 153 | + } |
| | 154 | +#endif |
| | 155 | + |
| | 156 | if (configfp) |
| | 157 | { |
| | 158 | fclose( configfp ); |
| | 159 | @@ -979,7 +1086,11 @@ |
| | 160 | /* If this has been called without any options, we merely check |
| | 161 | whether an agent is already running. We do this here so that we |
| | 162 | don't clobber a logfile but print it directly to stderr. */ |
| | 163 | +#ifdef __APPLE_LAUNCHD__ |
| | 164 | + if (!pipe_server && !is_daemon && !launchd_child) |
| | 165 | +#else |
| | 166 | if (!pipe_server && !is_daemon) |
| | 167 | +#endif |
| | 168 | { |
| | 169 | log_set_prefix (NULL, JNLIB_LOG_WITH_PREFIX); |
| | 170 | check_for_running_agent (0, 0); |
| | 171 | @@ -1041,6 +1152,209 @@ |
| | 172 | agent_deinit_default_ctrl (ctrl); |
| | 173 | xfree (ctrl); |
| | 174 | } |
| | 175 | +#ifdef __APPLE_LAUNCHD__ |
| | 176 | + else if (launchd_child) |
| | 177 | + { /* launchd-compatible mode */ |
| | 178 | + gnupg_fd_t fd, fd_ssh = GNUPG_INVALID_FD; |
| | 179 | + pid_t pid; |
| | 180 | + |
| | 181 | + /* Remove the DISPLAY variable so that a pinentry does not |
| | 182 | + * default to a specific display. There is still a default |
| | 183 | + * display when gpg-agent was started using --display or a |
| | 184 | + * client requested this using an OPTION command. Note, that we |
| | 185 | + * don't do this when running in reverse daemon mode (i.e. when |
| | 186 | + * exec the program given as arguments). */ |
| | 187 | + |
| | 188 | + if (!opt.keep_display && !argc) |
| | 189 | + unsetenv ("DISPLAY"); |
| | 190 | + |
| | 191 | + fflush (NULL); |
| | 192 | + pid = getpid (); |
| | 193 | + |
| | 194 | + /* Quick-check to see if SSH support was requested but another application is |
| | 195 | + * providing an SSH auth socket via launchd. */ |
| | 196 | + if (opt.ssh_support) { |
| | 197 | + REMOVE_ENV_VAR_FROM_LAUNCHD ("SSH_AUTH_SOCK"); |
| | 198 | + |
| | 199 | + if (getenv ("SSH_AUTH_SOCK") != NULL) { |
| | 200 | + log_error ("another program is already providing SSH agent support via launchd. " |
| | 201 | + "disabling SSH agent support in gpg-agent.\n"); |
| | 202 | + opt.ssh_support = 0; |
| | 203 | + } |
| | 204 | + } |
| | 205 | + |
| | 206 | + /* Fetch socket from launchd. */ |
| | 207 | + launch_data_t checkin_request, checkin_response; |
| | 208 | + |
| | 209 | + /* EHLO launchd */ |
| | 210 | + if ((checkin_request = launch_data_new_string (LAUNCH_KEY_CHECKIN)) == NULL) { |
| | 211 | + log_error ("unable to create launchd checkin string.\n"); |
| | 212 | + exit (1); |
| | 213 | + } |
| | 214 | + |
| | 215 | + /* any answer */ |
| | 216 | + if ((checkin_response = launch_msg (checkin_request)) == NULL) { |
| | 217 | + log_error ("unable to obtain launchd checkin answer.\n"); |
| | 218 | + exit (1); |
| | 219 | + } |
| | 220 | + |
| | 221 | + /* not 250 :( */ |
| | 222 | + if (LAUNCH_DATA_ERRNO == launch_data_get_type (checkin_response)) { |
| | 223 | + int cur_errno = errno; |
| | 224 | + log_error ("launchd checkin failed: %s\n", strerror (cur_errno)); |
| | 225 | + exit (1); |
| | 226 | + } |
| | 227 | + |
| | 228 | + /* 250 */ |
| | 229 | + launch_data_t socket_dict = launch_data_dict_lookup (checkin_response, LAUNCH_JOBKEY_SOCKETS); |
| | 230 | + if (socket_dict == NULL) { |
| | 231 | + log_error ("no sockets returned by launchd.\n"); |
| | 232 | + exit (1); |
| | 233 | + } |
| | 234 | + |
| | 235 | + { |
| | 236 | + size_t need_sockets = 1; |
| | 237 | + |
| | 238 | + if (opt.ssh_support) |
| | 239 | + ++need_sockets; |
| | 240 | + |
| | 241 | + size_t got_sockets = launch_data_dict_get_count (socket_dict); |
| | 242 | + |
| | 243 | + if (got_sockets < need_sockets) { |
| | 244 | + log_error ("launchd returned less seconds than necessary. " |
| | 245 | + "needed: %zu, given: %zu.\n", need_sockets, got_sockets); |
| | 246 | + exit (1); |
| | 247 | + } |
| | 248 | + |
| | 249 | + if (got_sockets > need_sockets) |
| | 250 | + log_info ("launchd returned more sockets than needed - ignoring extraneous ones.\n"); |
| | 251 | + |
| | 252 | + /* Fetch FD array. */ |
| | 253 | + launch_data_t data_array_agent, data_array_ssh; |
| | 254 | + if ((data_array_agent = launch_data_dict_lookup (socket_dict, GPG_SOCKET_NAME_AGENT)) == NULL) { |
| | 255 | + log_error ("no agent socket defined in launchd plist file.\n"); |
| | 256 | + exit (1); |
| | 257 | + } |
| | 258 | + |
| | 259 | + if (opt.ssh_support && |
| | 260 | + ((data_array_ssh = launch_data_dict_lookup (socket_dict, GPG_SOCKET_NAME_SSH)) == NULL)) { |
| | 261 | + log_error ("no ssh socket defined in launchd plist file.\n"); |
| | 262 | + exit (1); |
| | 263 | + } |
| | 264 | + |
| | 265 | + size_t fd_count_agent, fd_count_ssh; |
| | 266 | + if ((fd_count_agent = launch_data_array_get_count (data_array_agent)) > 1) |
| | 267 | + log_info ("launchd returned more than one file descriptor for the agent socket - ignoring extraneous ones.\n"); |
| | 268 | + else if (fd_count_agent == 0) { |
| | 269 | + log_error ("no file descriptor returned for the agent socket.\n"); |
| | 270 | + exit (1); |
| | 271 | + } |
| | 272 | + else { |
| | 273 | + launch_data_t cur = launch_data_array_get_index (data_array_agent, 0); |
| | 274 | + fd = launch_data_get_fd (cur); |
| | 275 | + } |
| | 276 | + |
| | 277 | + if (opt.ssh_support && ((fd_count_ssh = launch_data_array_get_count (data_array_ssh)) > 1)) |
| | 278 | + log_info ("launchd returned more than one file descriptor for the ssh socket - ignoring extraneous ones.\n"); |
| | 279 | + else if (opt.ssh_support && (fd_count_ssh == 0)) { |
| | 280 | + log_error ("no file descriptor returned for the ssh socket.\n"); |
| | 281 | + exit (1); |
| | 282 | + } |
| | 283 | + else if (opt.ssh_support) { |
| | 284 | + launch_data_t cur = launch_data_array_get_index (data_array_ssh, 0); |
| | 285 | + fd_ssh = launch_data_get_fd (cur); |
| | 286 | + } |
| | 287 | + } |
| | 288 | + |
| | 289 | + char *gpg_socket = getenv (GPG_ENV_SOCKET_AGENT); |
| | 290 | + if (!gpg_socket) { |
| | 291 | + log_error ("no agent socket environment variable defined by launchd.\n"); |
| | 292 | + exit (1); |
| | 293 | + } |
| | 294 | + |
| | 295 | + char *ssh_socket = getenv (GPG_ENV_SOCKET_SSH); |
| | 296 | + if (opt.ssh_support && !ssh_socket) { |
| | 297 | + log_error ("no ssh socket environment variable defined by launchd.\n"); |
| | 298 | + exit (1); |
| | 299 | + } |
| | 300 | + |
| | 301 | + socket_name = strndup (gpg_socket, strlen (gpg_socket)); |
| | 302 | + if (opt.ssh_support) |
| | 303 | + socket_name_ssh = strndup (ssh_socket, strlen (ssh_socket)); |
| | 304 | + |
| | 305 | + /* Remove internal environment variables from launchd. */ |
| | 306 | + REMOVE_ENV_VAR_FROM_LAUNCHD (GPG_ENV_SOCKET_AGENT); |
| | 307 | + if (opt.ssh_support) |
| | 308 | + REMOVE_ENV_VAR_FROM_LAUNCHD (GPG_ENV_SOCKET_SSH); |
| | 309 | + |
| | 310 | + launch_data_free (checkin_response); |
| | 311 | + launch_data_free (checkin_request); |
| | 312 | + |
| | 313 | + char *infostr, *infostr_ssh_sock, *infostr_ssh_pid; |
| | 314 | + |
| | 315 | + /* Create the info string: <name>:<pid>:<protocol_version> */ |
| | 316 | + if (asprintf (&infostr, "GPG_AGENT_INFO=%s:%lu:1", |
| | 317 | + socket_name, (ulong)pid ) < 0) { |
| | 318 | + log_error ("out of core\n"); |
| | 319 | + kill (pid, SIGTERM); |
| | 320 | + exit (1); |
| | 321 | + } |
| | 322 | + |
| | 323 | + if (opt.ssh_support) { |
| | 324 | + if (asprintf (&infostr_ssh_sock, "SSH_AUTH_SOCK=%s", |
| | 325 | + socket_name_ssh) < 0) { |
| | 326 | + log_error ("out of core\n"); |
| | 327 | + exit (1); |
| | 328 | + } |
| | 329 | + if (asprintf (&infostr_ssh_pid, "SSH_AGENT_PID=%u", |
| | 330 | + pid) < 0) { |
| | 331 | + log_error ("out of core\n"); |
| | 332 | + exit (1); |
| | 333 | + } |
| | 334 | + } |
| | 335 | + |
| | 336 | + if (env_file_name) { |
| | 337 | + FILE *fp; |
| | 338 | + |
| | 339 | + fp = fopen (env_file_name, "w"); |
| | 340 | + if (!fp) |
| | 341 | + log_error (_("error creating `%s': %s\n"), |
| | 342 | + env_file_name, strerror (errno)); |
| | 343 | + else { |
| | 344 | + fputs (infostr, fp); |
| | 345 | + putc ('\n', fp); |
| | 346 | + |
| | 347 | + if (opt.ssh_support) { |
| | 348 | + fputs (infostr_ssh_sock, fp); |
| | 349 | + putc ('\n', fp); |
| | 350 | + fputs (infostr_ssh_pid, fp); |
| | 351 | + putc ('\n', fp); |
| | 352 | + } |
| | 353 | + |
| | 354 | + fclose (fp); |
| | 355 | + } |
| | 356 | + } |
| | 357 | + |
| | 358 | + /* Pass environment variables back to launchd. */ |
| | 359 | + PASS_ENV_VAR_TO_LAUNCHD ("GPG_AGENT_INFO", infostr); |
| | 360 | + |
| | 361 | + if (opt.ssh_support) { |
| | 362 | + PASS_ENV_VAR_TO_LAUNCHD ("SSH_AUTH_SOCK", infostr_ssh_sock); |
| | 363 | + PASS_ENV_VAR_TO_LAUNCHD ("SSH_AGENT_PID", infostr_ssh_pid); |
| | 364 | + } |
| | 365 | + |
| | 366 | + { |
| | 367 | + struct sigaction sa; |
| | 368 | + |
| | 369 | + sa.sa_handler = SIG_IGN; |
| | 370 | + sigemptyset (&sa.sa_mask); |
| | 371 | + sa.sa_flags = 0; |
| | 372 | + sigaction (SIGPIPE, &sa, NULL); |
| | 373 | + } |
| | 374 | + |
| | 375 | + handle_connections (fd, fd_ssh); |
| | 376 | + } |
| | 377 | +#endif // __APPLE_LAUNCHD__ |
| | 378 | else if (!is_daemon) |
| | 379 | ; /* NOTREACHED */ |
| | 380 | else |
