ziggi/minilb
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

server, service: added running as effective user

Browse Source
This commit is contained in:
Олег Бородин
2026-03-25 16:53:13 +02:00
parent 1f5b4a71f1
commit 5e7b1f312d
16 changed files with 361 additions and 144 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/config/config.go
+2
View File
@@ -36,6 +36,7 @@ type Config struct {
RunPath string `json:"runfile" yaml:"runfile"`
AsDaemon bool `json:"asDaemon" yaml:"asDaemon"`
LogLimit int64 `json:"logLimit" yaml:logLimit`
RunUser string `json:"runUser" yaml:runUser`
}
func NewConfig() (*Config, error) {
@@ -45,6 +46,7 @@ func NewConfig() (*Config, error) {
},
AsDaemon: false,
LogLimit: 1024 * 1024 * 10, // 10 Mb
RunUser: "daemon",
}
hostname, err := os.Hostname()
if err != nil {
app/config/variant.go
+6 -5
View File
@@ -1,9 +1,10 @@
package config
const (
confdirPath = "/home/ziggi/Projects/minilb/etc/minilb"
rundirPath = "/home/ziggi/Projects/minilb/tmp/run"
logdirPath = "/home/ziggi/Projects/minilb/tmp/log"
datadirPath = "/home/ziggi/Projects/minilb/tmp/data"
packageVersion = "0.0.1"
confdirPath = "/etc/minilb"
rundirPath = "/var/run/minilb"
logdirPath = "/var/log/minilb"
datadirPath = "/var/lib/minilb"
pkgVersion = "0.0.1"
runUser = "daemon"
)
app/config/variant.go.in
+6 -6
View File
@@ -1,10 +1,10 @@
package config
const (
confdirPath = "@srv_confdir@"
rundirPath = "@srv_rundir@"
logdirPath = "@srv_logdir@"
datadirPath = "@srv_datadir@"
packageVersion = "@PACKAGE_VERSION@"
confdirPath = "@srv_confdir@"
rundirPath = "@srv_rundir@"
logdirPath = "@srv_logdir@"
datadirPath = "@srv_datadir@"
pkgVersion = "@PACKAGE_VERSION@"
runUser = "@run_user@"
)
app/server/server.go
+129 -82
View File
@@ -3,6 +3,7 @@ package server
import (
"context"
"fmt"
"net"
"os"
"os/signal"
"os/user"
@@ -17,6 +18,7 @@ import (
"helmet/app/logger"
"helmet/app/operator"
"helmet/app/service"
"helmet/pkg/network"
"helmet/pkg/x509crt"
)
@@ -32,6 +34,7 @@ type Server struct {
ctx context.Context
cancel context.CancelFunc
wg sync.WaitGroup
listen net.Listener
}
func NewServer() (*Server, error) {
@@ -66,23 +69,66 @@ func (srv *Server) Build() error {
var err error
srv.log.Infof("Build server")
// Get effective user uid/guid
usr, err := user.Lookup(srv.conf.RunUser)
if err != nil {
return err
}
uid64, err := strconv.ParseInt(usr.Uid, 10, 64)
if err != nil {
return err
}
gid64, err := strconv.ParseInt(usr.Gid, 10, 64)
if err != nil {
return err
}
uid := int(uid64)
gid := int(gid64)
if srv.conf.AsDaemon {
logDir := filepath.Dir(srv.conf.LogPath)
srv.log.Infof("Create %s dir", logDir)
srv.log.Infof("Create log dir: %s", logDir)
err = os.MkdirAll(logDir, 0750)
if err != nil {
return err
}
err = os.Chown(logDir, uid, gid)
if err != nil {
return err
}
runDir := filepath.Dir(srv.conf.RunPath)
srv.log.Infof("Create %s dir", runDir)
srv.log.Infof("Create run dir: %s", runDir)
err = os.MkdirAll(runDir, 0750)
if err != nil {
return err
}
err = os.Chown(runDir, uid, gid)
if err != nil {
return err
}
}
// Create listener
addrinfo := ":" + strconv.FormatUint(uint64(srv.conf.Service.Port), 10)
listener, err := network.CreateListener(addrinfo)
if err != nil {
return err
}
srv.listen = listener
// Change effective user
err = syscall.Setuid(uid)
if err != nil {
return err
}
uidstr := strconv.FormatInt(int64(syscall.Geteuid()), 10)
usr, err = user.LookupId(uidstr)
if err != nil {
return err
}
srv.log.Warningf("Now run as user: %s", usr.Username)
// Create X509 certs
srv.x509cert, srv.x509key, err = x509crt.CreateX509SelfSignedCert(srv.conf.Hostname)
srv.x509cert, srv.x509key, err = x509crt.CreateCertKey(srv.conf.Hostname)
if err != nil {
return err
}
@@ -103,8 +149,7 @@ func (srv *Server) Build() error {
// Create service
serviceConfig := &service.ServiceConfig{
PortNum: srv.conf.Service.Port,
Hostname: srv.conf.Hostname,
Listener: srv.listen,
Handler: srv.hand,
Operator: srv.oper,
X509Cert: srv.x509cert,
@@ -123,86 +168,21 @@ func (srv *Server) Run() error {
return err
}
srv.log.Debugf("Server configuration:\n%s\n", yamlConfig)
srv.ctx, srv.cancel = context.WithCancel(context.Background())
currUser, err := user.Current()
if err != nil {
return err
}
srv.log.Infof("Running server as user %s", currUser.Username)
sigs := make(chan os.Signal, 1)
done := make(chan error, 1)
// Run service
startService := func(svc *service.Service, done chan error) {
err = svc.Run()
if err != nil {
srv.log.Errorf("Service error: %v", err)
done <- err
}
srv.log.Infof("Start server as user %s", currUser.Username)
uidstr := strconv.FormatInt(int64(syscall.Geteuid()), 10)
usr, err := user.LookupId(uidstr)
if err != nil {
return err
}
go startService(srv.svc, done)
srv.log.Infof("Run server as user %s", usr.Username)
signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
var signal os.Signal
select {
case signal = <-sigs:
srv.log.Infof("Services stopped by signal: %v", signal)
srv.cancel()
srv.svc.Stop()
srv.wg.Wait()
}
return err
}
func (srv *Server) PseudoFork() error {
const successExit int = 0
var keyEnv string = "IMX0LTSELMRF8K"
var err error
_, isChild := os.LookupEnv(keyEnv)
switch {
case !isChild:
os.Setenv(keyEnv, "TRUE")
procAttr := syscall.ProcAttr{}
cwd, err := os.Getwd()
if err != nil {
return err
}
var sysFiles = make([]uintptr, 3)
sysFiles[0] = uintptr(syscall.Stdin)
sysFiles[1] = uintptr(syscall.Stdout)
sysFiles[2] = uintptr(syscall.Stderr)
procAttr.Files = sysFiles
procAttr.Env = os.Environ()
procAttr.Dir = cwd
_, err = syscall.ForkExec(os.Args[0], os.Args, &procAttr)
if err != nil {
return err
}
os.Exit(successExit)
case isChild:
_, err = syscall.Setsid()
if err != nil {
return err
}
}
os.Unsetenv(keyEnv)
return err
}
func (srv *Server) Daemonize() error {
var err error
if srv.conf.AsDaemon {
// Restart process process
err = srv.PseudoFork()
if err != nil {
return err
}
// Redirect stdin
nullFile, err := os.OpenFile("/dev/null", os.O_RDWR, 0)
if err != nil {
@@ -232,11 +212,6 @@ func (srv *Server) Daemonize() error {
}
srv.logf = logFile
// Write process ID
rundir := filepath.Dir(srv.conf.RunPath)
err = os.MkdirAll(rundir, 0750)
if err != nil {
return err
}
pidFile, err := os.OpenFile(srv.conf.RunPath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0640)
if err != nil {
return err
@@ -248,10 +223,46 @@ func (srv *Server) Daemonize() error {
return err
}
}
sigs := make(chan os.Signal, 1)
done := make(chan error, 1)
// Run service
startService := func(svc *service.Service, done chan error) {
err = svc.Run()
if err != nil {
srv.log.Errorf("Service error: %v", err)
done <- err
}
}
go startService(srv.svc, done)
signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
var signal os.Signal
select {
case signal = <-sigs:
srv.log.Infof("Services stopped by signal: %v", signal)
srv.cancel()
srv.svc.Stop()
srv.wg.Wait()
}
return err
}
func (srv *Server) Rotator() {
func (srv *Server) Daemonize() error {
var err error
if srv.conf.AsDaemon {
// Restart process process
err = srv.pseudoFork()
if err != nil {
return err
}
}
return err
}
func (srv *Server) logRotator() {
// TODO: integrate into logger
srv.wg.Add(1)
var counter uint64
logFunc := func() {
@@ -289,3 +300,39 @@ func (srv *Server) Rotator() {
}
go logFunc()
}
func (srv *Server) pseudoFork() error {
const successExit int = 0
var keyEnv string = "IMX0LTSELMRF8K"
var err error
_, isChild := os.LookupEnv(keyEnv)
switch {
case !isChild:
os.Setenv(keyEnv, "TRUE")
procAttr := syscall.ProcAttr{}
cwd, err := os.Getwd()
if err != nil {
return err
}
var sysFiles = make([]uintptr, 3)
sysFiles[0] = uintptr(syscall.Stdin)
sysFiles[1] = uintptr(syscall.Stdout)
sysFiles[2] = uintptr(syscall.Stderr)
procAttr.Files = sysFiles
procAttr.Env = os.Environ()
procAttr.Dir = cwd
_, err = syscall.ForkExec(os.Args[0], os.Args, &procAttr)
if err != nil {
return err
}
os.Exit(successExit)
case isChild:
_, err = syscall.Setsid()
if err != nil {
return err
}
}
os.Unsetenv(keyEnv)
return err
}
app/service/service.go
+6 -22
View File
@@ -4,12 +4,10 @@ import (
"context"
"crypto/tls"
"encoding/json"
"fmt"
"net"
"helmet/app/logger"
"helmet/app/handler"
"helmet/app/logger"
"helmet/app/operator"
"google.golang.org/grpc"
@@ -22,8 +20,7 @@ import (
type ServiceConfig struct {
Handler *handler.Handler
Operator *operator.Operator
PortNum uint32
Hostname string
Listener net.Listener
X509Cert []byte
X509Key []byte
}
@@ -33,11 +30,7 @@ type Service struct {
hand *handler.Handler
oper *operator.Operator
log *logger.Logger
portnum uint32
hostname string
username string
password string
listen net.Listener
x509Cert []byte
x509Key []byte
}
@@ -46,8 +39,7 @@ func NewService(conf *ServiceConfig) *Service {
svc := Service{
hand: conf.Handler,
oper: conf.Operator,
portnum: conf.PortNum,
hostname: conf.Hostname,
listen: conf.Listener,
x509Cert: conf.X509Cert,
x509Key: conf.X509Key,
}
@@ -60,12 +52,6 @@ func (svc *Service) Run() error {
var err error
svc.log.Infof("Service run")
listenSpec := fmt.Sprintf(":%d", svc.portnum)
listener, err := net.Listen("tcp", listenSpec)
if err != nil {
return err
}
tlsCert, err := tls.X509KeyPair(svc.x509Cert, svc.x509Key)
if err != nil {
return err
@@ -75,7 +61,6 @@ func (svc *Service) Run() error {
ClientAuth: tls.NoClientCert,
InsecureSkipVerify: true,
}
tlsCredentials := credentials.NewTLS(&tlsConfig)
if err != nil {
return err
@@ -87,14 +72,13 @@ func (svc *Service) Run() error {
gsrvOpts := []grpc.ServerOption{
grpc.Creds(tlsCredentials),
grpc.ChainUnaryInterceptor(interceptors...),
//grpc.UnaryInterceptor(svc.authInterceptor),
}
svc.gsrv = grpc.NewServer(gsrvOpts...)
svc.hand.Register(svc.gsrv)
svc.log.Infof("Service listening at %v", listener.Addr())
err = svc.gsrv.Serve(listener)
svc.log.Infof("Service listening at %v", svc.listen.Addr())
err = svc.gsrv.Serve(svc.listen)
if err != nil {
return err
}