qnetd: Check existence of NSS DB dir before fork

Previously, when user tried start corosync-qnetd without
initialized NSS database then generic (not very helpful
and misleading) NSS error was logged
"NSS error (-8015): The certificate/key database is in an old,
unsupported format.".

Solution is to check if it's possible to open NSS DB directory and
display (usually much more informative) result of strerror function.

Such check is called before fork, so init system can return error code
during start.

Signed-off-by: Jan Friesse <jfriesse@redhat.com>
Reviewed-by: Christine Caulfield <ccaulfie@redhat.com>

diff --git a/qdevices/corosync-qnetd.c b/qdevices/corosync-qnetd.c
index 59917c8dd8715680083d558a8a72a6fff8951dd0..9ba19754f891fd658a62a9deb8ec41e682e314cf 100644 (file)
--- a/qdevices/corosync-qnetd.c
+++ b/qdevices/corosync-qnetd.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 Red Hat, Inc.
+ * Copyright (c) 2015-2019 Red Hat, Inc.
  *
  * All rights reserved.
  *
@@ -546,6 +546,16 @@ main(int argc, char * const argv[])
        qnetd_log_set_debug(debug_log);
        qnetd_log_set_priority_bump(bump_log_priority);
 
+       /*
+        * Check that it's possible to open NSS dir if needed
+        */
+       if (nss_sock_check_db_dir((tls_supported != TLV_TLS_UNSUPPORTED ?
+           advanced_settings.nss_db_dir : NULL)) != 0) {
+               qnetd_log_err(LOG_ERR, "Can't open NSS DB directory");
+
+               exit (1);
+       }
+
        /*
         * Daemonize
         */

diff --git a/qdevices/nss-sock.c b/qdevices/nss-sock.c
index 3c63927055cf9eb5e4183473b2650db36ff26456..483d417ec3e2a539f63176b9bb0137e41347ede7 100644 (file)
--- a/qdevices/nss-sock.c
+++ b/qdevices/nss-sock.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 Red Hat, Inc.
+ * Copyright (c) 2015-2019 Red Hat, Inc.
  *
  * All rights reserved.
  *
@@ -32,6 +32,9 @@
  * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
+#include <sys/types.h>
+
+#include <dirent.h>
 #include <limits.h>
 
 #include "nss-sock.h"
@@ -56,6 +59,24 @@ nss_sock_init_nss(char *config_dir)
        return (0);
 }
 
+int
+nss_sock_check_db_dir(const char *config_dir)
+{
+       DIR *dirp;
+
+       if (config_dir == NULL) {
+               return (0);
+       }
+
+       if ((dirp = opendir(config_dir)) == NULL) {
+               return (-1);
+       }
+
+       (void)closedir(dirp);
+
+       return (0);
+}
+
 /*
  * Set NSS socket non-blocking
  */

diff --git a/qdevices/nss-sock.h b/qdevices/nss-sock.h
index cc16d96ed2e6d3f92044e97b765bbe2c4e134956..4f82e0a957e3e6e10ae9a58cb3fbe6f4cdeff90e 100644 (file)
--- a/qdevices/nss-sock.h
+++ b/qdevices/nss-sock.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2015-2016 Red Hat, Inc.
+ * Copyright (c) 2015-2019 Red Hat, Inc.
  *
  * All rights reserved.
  *
@@ -56,6 +56,8 @@ struct nss_sock_non_blocking_client {
 
 extern int             nss_sock_init_nss(char *config_dir);
 
+extern int             nss_sock_check_db_dir(const char *config_dir);
+
 extern PRFileDesc      *nss_sock_create_listen_socket(const char *hostname, uint16_t port,
     PRIntn af);