X-Git-Url: https://tinc-vpn.org/git/browse?a=blobdiff_plain;f=src%2Ftincctl.c;h=46073b3aaad7db9651c077a7dbc5734caaa47d9d;hb=c6a15e27d934e90a1f3a26438dddb395bdc9de19;hp=b2d98f62fe4d95724fbce78edf0327d7bb6a1dc7;hpb=d93d4f9dbd09bc5e53a9b5eeb1cc94939fee32bc;p=tinc

diff --git a/src/tincctl.c b/src/tincctl.c
index b2d98f62..46073b3a 100644
--- a/src/tincctl.c
+++ b/src/tincctl.c
@@ -41,6 +41,7 @@
 #include "subnet.h"
 #include "keys.h"
 #include "random.h"
+#include "sandbox.h"
 #include "pidfile.h"
 #include "console.h"
 
@@ -108,7 +109,7 @@ static struct option const long_options[] = {
 };
 
 static void version(void) {
-	static const char *message =
+	fprintf(stdout,
 	        "%s version %s (built %s %s, protocol %d.%d)\n"
 	        "Features:"
 #ifdef HAVE_READLINE
@@ -119,6 +120,9 @@ static void version(void) {
 #endif
 #ifndef DISABLE_LEGACY
 	        " legacy_protocol"
+#endif
+#ifdef HAVE_SANDBOX
+	        " sandbox"
 #endif
 	        "\n\n"
 	        "Copyright (C) 1998-2018 Ivo Timmermans, Guus Sliepen and others.\n"
@@ -126,16 +130,15 @@ static void version(void) {
 	        "\n"
 	        "tinc comes with ABSOLUTELY NO WARRANTY.  This is free software,\n"
 	        "and you are welcome to redistribute it under certain conditions;\n"
-	        "see the file COPYING for details.\n";
-
-	printf(message, PACKAGE, BUILD_VERSION, BUILD_DATE, BUILD_TIME, PROT_MAJOR, PROT_MINOR);
+	        "see the file COPYING for details.\n",
+	        PACKAGE, BUILD_VERSION, BUILD_DATE, BUILD_TIME, PROT_MAJOR, PROT_MINOR);
 }
 
 static void usage(bool status) {
 	if(status) {
 		fprintf(stderr, "Try `%s --help\' for more information.\n", program_name);
 	} else {
-		static const char *message =
+		fprintf(stdout,
 		        "Usage: %s [options] command\n"
 		        "\n"
 		        "Valid options are:\n"
@@ -194,9 +197,8 @@ static void usage(bool status) {
 		        "  sign [FILE]                Generate a signed version of a file.\n"
 		        "  verify NODE [FILE]         Verify that a file was signed by the given NODE.\n"
 		        "\n"
-		        "Report bugs to tinc@tinc-vpn.org.\n";
-
-		printf(message, program_name);
+		        "Report bugs to tinc@tinc-vpn.org.\n",
+		        program_name);
 	}
 }
 
@@ -1517,7 +1519,10 @@ static int cmd_pcap(int argc, char *argv[]) {
 static void sigint_handler(int sig) {
 	(void)sig;
 
-	fprintf(stderr, "\n");
+	if(write(2, "\n", 1) < 0) {
+		// nothing we can do
+	}
+
 	shutdown(fd, SHUT_RDWR);
 }
 #endif
@@ -1697,6 +1702,7 @@ const var_t variables[] = {
 	{"ProcessPriority", VAR_SERVER},
 	{"Proxy", VAR_SERVER},
 	{"ReplayWindow", VAR_SERVER | VAR_SAFE},
+	{"Sandbox", VAR_SERVER},
 	{"ScriptsExtension", VAR_SERVER},
 	{"ScriptsInterpreter", VAR_SERVER},
 	{"StrictSubnets", VAR_SERVER | VAR_SAFE},
@@ -1928,16 +1934,18 @@ static int cmd_config(int argc, char *argv[]) {
 	char filename[PATH_MAX];
 
 	if(node) {
-		if((size_t)snprintf(filename, sizeof(filename), "%s" SLASH "%s", hosts_dir, node) >= sizeof(filename)) {
-			fprintf(stderr, "Filename too long: %s" SLASH "%s\n", hosts_dir, node);
-			free(node);
-			return 1;
-		}
+		size_t wrote = (size_t)snprintf(filename, sizeof(filename), "%s" SLASH "%s", hosts_dir, node);
 
 		if(node != line) {
 			free(node);
 			node = NULL;
 		}
+
+		if(wrote >= sizeof(filename)) {
+			fprintf(stderr, "Filename too long: %s" SLASH "%s\n", hosts_dir, node);
+			return 1;
+		}
+
 	} else {
 		snprintf(filename, sizeof(filename), "%s", tinc_conf);
 	}
@@ -2181,6 +2189,49 @@ int check_port(const char *name) {
 	return 0;
 }
 
+static bool makedir(const char *path, mode_t mode) {
+	if(mkdir(path, mode) && errno != EEXIST) {
+		fprintf(stderr, "Could not create directory %s: %s\n", path, strerror(errno));
+		return false;
+	}
+
+	return true;
+}
+
+bool makedirs(tincd_dir_t dirs) {
+	if(dirs & DIR_CONFBASE && !makedir(confbase, 0777)) {
+		return false;
+	}
+
+	if(dirs & DIR_CONFDIR && !confbase_given && !makedir(confdir, 0755)) {
+		return false;
+	}
+
+	if(dirs & DIR_HOSTS && !makedir(hosts_dir, 0777)) {
+		return false;
+	}
+
+	char path[PATH_MAX];
+
+	if(dirs & DIR_INVITATIONS) {
+		snprintf(path, sizeof(path), "%s" SLASH "invitations", confbase);
+
+		if(!makedir(path, 0700)) {
+			return false;
+		}
+	}
+
+	if(dirs & DIR_CACHE) {
+		snprintf(path, sizeof(path), "%s" SLASH "%s", confbase, "cache");
+
+		if(!makedir(path, 0755)) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
 static int cmd_init(int argc, char *argv[]) {
 	if(!access(tinc_conf, F_OK)) {
 		fprintf(stderr, "Configuration file %s already exists!\n", tinc_conf);
@@ -2226,19 +2277,8 @@ static int cmd_init(int argc, char *argv[]) {
 		return 1;
 	}
 
-	if(!confbase_given && mkdir(confdir, 0755) && errno != EEXIST) {
-		fprintf(stderr, "Could not create directory %s: %s\n", confdir, strerror(errno));
-		return 1;
-	}
-
-	if(mkdir(confbase, 0777) && errno != EEXIST) {
-		fprintf(stderr, "Could not create directory %s: %s\n", confbase, strerror(errno));
-		return 1;
-	}
-
-	if(mkdir(hosts_dir, 0777) && errno != EEXIST) {
-		fprintf(stderr, "Could not create directory %s: %s\n", hosts_dir, strerror(errno));
-		return 1;
+	if(!makedirs(DIR_HOSTS | DIR_CONFBASE | DIR_CONFDIR | DIR_CACHE)) {
+		return false;
 	}
 
 	FILE *f = fopen(tinc_conf, "w");
@@ -2537,7 +2577,7 @@ static int cmd_export_all(int argc, char *argv[]) {
 		if(first) {
 			first = false;
 		} else {
-			printf("#---------------------------------------------------------------#\n");
+			printf("\n#---------------------------------------------------------------#\n");
 		}
 
 		result |= export(ent->d_name, stdout);
@@ -3352,6 +3392,9 @@ int main(int argc, char *argv[]) {
 	crypto_init();
 	prng_init();
 
+	sandbox_set_level(SANDBOX_NORMAL);
+	sandbox_enter();
+
 	int result = run_command(argc, argv);
 
 	random_exit();