src/config.rs

   1 //! Proxmox Backup Server Configuration library
   2 //!
   3 //! This library contains helper to read, parse and write the
   4 //! configuration files.
   5
   6 use failure::*;
   7
   8 use proxmox::tools::try_block;
   9
  10 use crate::buildcfg;
  11
  12 pub mod datastore;
  13
  14 /// Check configuration directory permissions
  15 ///
  16 /// For security reasons, we want to make sure they are set correctly:
  17 /// * owned by 'backup' user/group
  18 /// * nobody else can read (mode 0700)
  19 pub fn check_configdir_permissions() -> Result<(), Error> {
  20     let cfgdir = buildcfg::CONFIGDIR;
  21
  22     let backup_user = crate::backup::backup_user()?;
  23     let backup_uid = backup_user.uid.as_raw();
  24     let backup_gid = backup_user.gid.as_raw();
  25
  26     try_block!({
  27         let stat = nix::sys::stat::stat(cfgdir)?;
  28
  29         if stat.st_uid != backup_uid {
  30             bail!("wrong user ({} != {})", stat.st_uid, backup_uid);
  31         }
  32         if stat.st_gid != backup_gid {
  33             bail!("wrong group ({} != {})", stat.st_gid, backup_gid);
  34         }
  35
  36         let perm = stat.st_mode & 0o777;
  37         if perm != 0o700 {
  38             bail!("wrong permission ({:o} != {:o})", perm, 0o700);
  39         }
  40         Ok(())
  41     })
  42     .map_err(|err| {
  43         format_err!(
  44             "configuration directory '{}' permission problem - {}",
  45             cfgdir,
  46             err
  47         )
  48     })
  49 }
  50
  51 pub fn create_configdir() -> Result<(), Error> {
  52     use nix::sys::stat::Mode;
  53
  54     let cfgdir = buildcfg::CONFIGDIR;
  55
  56     match nix::unistd::mkdir(cfgdir, Mode::from_bits_truncate(0o700)) {
  57         Ok(()) => {}
  58         Err(nix::Error::Sys(nix::errno::Errno::EEXIST)) => {
  59             check_configdir_permissions()?;
  60             return Ok(());
  61         }
  62         Err(err) => bail!(
  63             "unable to create configuration directory '{}' - {}",
  64             cfgdir,
  65             err
  66         ),
  67     }
  68
  69     let backup_user = crate::backup::backup_user()?;
  70
  71     nix::unistd::chown(cfgdir, Some(backup_user.uid), Some(backup_user.gid))
  72         .map_err(|err| {
  73             format_err!(
  74                 "unable to set configuration directory '{}' permissions - {}",
  75                 cfgdir,
  76                 err
  77             )
  78         })
  79 }