Game of Trees Repos

Blob

Date:: Mon Jul 10 19:47:10 2023 UTC
Message:: make gitwrapper ignore 'permission denied' for repository paths We recommend that gotsh users should not have direct filesystem access to repositories served by gotd. Which means admins will be setting things up as follows if public read-access should be denied: chown _gotd /git chmod 700 /git su -m _gotd -c 'gotadmin init /git/repo.git" However, gitwrapper would error out when repositories listed in gotd.conf were inaccessible to the user invoking gitwrapper: git-upload-pack: /etc/gotd.conf:2: realpath /git/repo.git: Permission denied Make gitwrapper ignore such errors as they are expected in this situation. While here, add a PROC_GITWRAPPER process ID for use as a global variable parse.y can check while special-casing any specific behaviour required by gitwrapper. (The worse alternative would have been adding a new global variable to parse.y just to control the behaviour on realpath errors.) ok op@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/time.h>
19 #include <sys/types.h>
20 #include <sys/stat.h>
21 #include <sys/socket.h>
22 #include <sys/un.h>
23 #include <sys/wait.h>
24 
25 #include <fcntl.h>
26 #include <err.h>
27 #include <errno.h>
28 #include <event.h>
29 #include <limits.h>
30 #include <pwd.h>
31 #include <imsg.h>
32 #include <signal.h>
33 #include <siphash.h>
34 #include <stdarg.h>
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <syslog.h>
39 #include <unistd.h>
40 
41 #include "got_error.h"
42 #include "got_opentemp.h"
43 #include "got_path.h"
44 #include "got_repository.h"
45 #include "got_object.h"
46 #include "got_reference.h"
47 
48 #include "got_lib_delta.h"
49 #include "got_lib_object.h"
50 #include "got_lib_object_cache.h"
51 #include "got_lib_hash.h"
52 #include "got_lib_gitproto.h"
53 #include "got_lib_pack.h"
54 #include "got_lib_repository.h"
55 
56 #include "gotd.h"
57 #include "log.h"
58 #include "listen.h"
59 #include "auth.h"
60 #include "session.h"
61 #include "repo_read.h"
62 #include "repo_write.h"
63 
64 #ifndef nitems
65 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
66 #endif
67 
68 enum gotd_client_state {
69 	GOTD_CLIENT_STATE_NEW,
70 	GOTD_CLIENT_STATE_ACCESS_GRANTED,
71 };
72 
73 struct gotd_child_proc {
74 	pid_t				 pid;
75 	enum gotd_procid		 type;
76 	char				 repo_name[NAME_MAX];
77 	char				 repo_path[PATH_MAX];
78 	int				 pipe[2];
79 	struct gotd_imsgev		 iev;
80 	struct event			 tmo;
81 
82 	TAILQ_ENTRY(gotd_child_proc)	 entry;
83 };
84 TAILQ_HEAD(gotd_procs, gotd_child_proc) procs;
85 
86 struct gotd_client {
87 	STAILQ_ENTRY(gotd_client)	 entry;
88 	enum gotd_client_state		 state;
89 	uint32_t			 id;
90 	int				 fd;
91 	struct gotd_imsgev		 iev;
92 	struct event			 tmo;
93 	uid_t				 euid;
94 	gid_t				 egid;
95 	struct gotd_child_proc		*repo;
96 	struct gotd_child_proc		*auth;
97 	struct gotd_child_proc		*session;
98 	int				 required_auth;
99 };
100 STAILQ_HEAD(gotd_clients, gotd_client);
101 
102 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
103 static SIPHASH_KEY clients_hash_key;
104 volatile int client_cnt;
105 static struct timeval auth_timeout = { 5, 0 };
106 static struct gotd gotd;
107 
108 void gotd_sighdlr(int sig, short event, void *arg);
109 static void gotd_shutdown(void);
110 static const struct got_error *start_session_child(struct gotd_client *,
111     struct gotd_repo *, char *, const char *, int, int);
112 static const struct got_error *start_repo_child(struct gotd_client *,
113     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
114 static const struct got_error *start_auth_child(struct gotd_client *, int,
115     struct gotd_repo *, char *, const char *, int, int);
116 static void kill_proc(struct gotd_child_proc *, int);
117 static void disconnect(struct gotd_client *);
118 
119 __dead static void
120 usage(void)
121 {
122 	fprintf(stderr, "usage: %s [-dnv] [-f config-file]\n", getprogname());
123 	exit(1);
124 }
125 
126 static int
127 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
128 {
129 	struct sockaddr_un sun;
130 	int fd = -1;
131 	mode_t old_umask, mode;
132 
133 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
134 	if (fd == -1) {
135 		log_warn("socket");
136 		return -1;
137 	}
138 
139 	sun.sun_family = AF_UNIX;
140 	if (strlcpy(sun.sun_path, unix_socket_path,
141 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
142 		log_warnx("%s: name too long", unix_socket_path);
143 		close(fd);
144 		return -1;
145 	}
146 
147 	if (unlink(unix_socket_path) == -1) {
148 		if (errno != ENOENT) {
149 			log_warn("unlink %s", unix_socket_path);
150 			close(fd);
151 			return -1;
152 		}
153 	}
154 
155 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
156 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
157 
158 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
159 		log_warn("bind: %s", unix_socket_path);
160 		close(fd);
161 		umask(old_umask);
162 		return -1;
163 	}
164 
165 	umask(old_umask);
166 
167 	if (chmod(unix_socket_path, mode) == -1) {
168 		log_warn("chmod %o %s", mode, unix_socket_path);
169 		close(fd);
170 		unlink(unix_socket_path);
171 		return -1;
172 	}
173 
174 	if (chown(unix_socket_path, uid, gid) == -1) {
175 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
176 		close(fd);
177 		unlink(unix_socket_path);
178 		return -1;
179 	}
180 
181 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
182 		log_warn("listen");
183 		close(fd);
184 		unlink(unix_socket_path);
185 		return -1;
186 	}
187 
188 	return fd;
189 }
190 
191 static uint64_t
192 client_hash(uint32_t client_id)
193 {
194 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
195 }
196 
197 static void
198 add_client(struct gotd_client *client)
199 {
200 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
201 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
202 	client_cnt++;
203 }
204 
205 static struct gotd_client *
206 find_client(uint32_t client_id)
207 {
208 	uint64_t slot;
209 	struct gotd_client *c;
210 
211 	slot = client_hash(client_id) % nitems(gotd_clients);
212 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
213 		if (c->id == client_id)
214 			return c;
215 	}
216 
217 	return NULL;
218 }
219 
220 static struct gotd_client *
221 find_client_by_proc_fd(int fd)
222 {
223 	uint64_t slot;
224 
225 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
226 		struct gotd_client *c;
227 
228 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
229 			if (c->repo && c->repo->iev.ibuf.fd == fd)
230 				return c;
231 			if (c->auth && c->auth->iev.ibuf.fd == fd)
232 				return c;
233 			if (c->session && c->session->iev.ibuf.fd == fd)
234 				return c;
235 		}
236 	}
237 
238 	return NULL;
239 }
240 
241 static int
242 client_is_reading(struct gotd_client *client)
243 {
244 	return (client->required_auth &
245 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) == GOTD_AUTH_READ;
246 }
247 
248 static int
249 client_is_writing(struct gotd_client *client)
250 {
251 	return (client->required_auth &
252 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE)) ==
253 	    (GOTD_AUTH_READ | GOTD_AUTH_WRITE);
254 }
255 
256 static const struct got_error *
257 ensure_client_is_not_writing(struct gotd_client *client)
258 {
259 	if (client_is_writing(client)) {
260 		return got_error_fmt(GOT_ERR_BAD_PACKET,
261 		    "uid %d made a read-request but is writing to "
262 		    "a repository", client->euid);
263 	}
264 
265 	return NULL;
266 }
267 
268 static const struct got_error *
269 ensure_client_is_not_reading(struct gotd_client *client)
270 {
271 	if (client_is_reading(client)) {
272 		return got_error_fmt(GOT_ERR_BAD_PACKET,
273 		    "uid %d made a write-request but is reading from "
274 		    "a repository", client->euid);
275 	}
276 
277 	return NULL;
278 }
279 
280 static void
281 proc_done(struct gotd_child_proc *proc)
282 {
283 	struct gotd_client *client;
284 
285 	TAILQ_REMOVE(&procs, proc, entry);
286 
287 	client = find_client_by_proc_fd(proc->iev.ibuf.fd);
288 	if (client != NULL) {
289 		if (proc == client->repo)
290 			client->repo = NULL;
291 		if (proc == client->auth)
292 			client->auth = NULL;
293 		if (proc == client->session)
294 			client->session = NULL;
295 		disconnect(client);
296 	}
297 
298 	evtimer_del(&proc->tmo);
299 
300 	if (proc->iev.ibuf.fd != -1) {
301 		event_del(&proc->iev.ev);
302 		msgbuf_clear(&proc->iev.ibuf.w);
303 		close(proc->iev.ibuf.fd);
304 	}
305 
306 	free(proc);
307 }
308 
309 static void
310 kill_repo_proc(struct gotd_client *client)
311 {
312 	if (client->repo == NULL)
313 		return;
314 
315 	kill_proc(client->repo, 0);
316 	client->repo = NULL;
317 }
318 
319 static void
320 kill_auth_proc(struct gotd_client *client)
321 {
322 	if (client->auth == NULL)
323 		return;
324 
325 	kill_proc(client->auth, 0);
326 	client->auth = NULL;
327 }
328 
329 static void
330 kill_session_proc(struct gotd_client *client)
331 {
332 	if (client->session == NULL)
333 		return;
334 
335 	kill_proc(client->session, 0);
336 	client->session = NULL;
337 }
338 
339 static void
340 disconnect(struct gotd_client *client)
341 {
342 	struct gotd_imsg_disconnect idisconnect;
343 	struct gotd_child_proc *listen_proc = gotd.listen_proc;
344 	uint64_t slot;
345 
346 	log_debug("uid %d: disconnecting", client->euid);
347 
348 	kill_auth_proc(client);
349 	kill_session_proc(client);
350 	kill_repo_proc(client);
351 
352 	idisconnect.client_id = client->id;
353 	if (gotd_imsg_compose_event(&listen_proc->iev,
354 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
355 	    &idisconnect, sizeof(idisconnect)) == -1)
356 		log_warn("imsg compose DISCONNECT");
357 
358 	slot = client_hash(client->id) % nitems(gotd_clients);
359 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
360 	imsg_clear(&client->iev.ibuf);
361 	event_del(&client->iev.ev);
362 	evtimer_del(&client->tmo);
363 	if (client->fd != -1)
364 		close(client->fd);
365 	else if (client->iev.ibuf.fd != -1)
366 		close(client->iev.ibuf.fd);
367 	free(client);
368 	client_cnt--;
369 }
370 
371 static void
372 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
373 {
374 	struct imsgbuf ibuf;
375 
376 	log_warnx("uid %d: %s", client->euid, err->msg);
377 	if (err->code != GOT_ERR_EOF && client->fd != -1) {
378 		imsg_init(&ibuf, client->fd);
379 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
380 		imsg_clear(&ibuf);
381 	}
382 	disconnect(client);
383 }
384 
385 static const struct got_error *
386 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
387 {
388 	const struct got_error *err = NULL;
389 	struct gotd_imsg_info_repo irepo;
390 
391 	memset(&irepo, 0, sizeof(irepo));
392 
393 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
394 	    >= sizeof(irepo.repo_name))
395 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
396 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
397 	    >= sizeof(irepo.repo_path))
398 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
399 
400 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
401 	    &irepo, sizeof(irepo)) == -1) {
402 		err = got_error_from_errno("imsg compose INFO_REPO");
403 		if (err)
404 			return err;
405 	}
406 
407 	return NULL;
408 }
409 
410 static const struct got_error *
411 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
412 {
413 	const struct got_error *err = NULL;
414 	struct gotd_imsg_info_client iclient;
415 	struct gotd_child_proc *proc;
416 
417 	memset(&iclient, 0, sizeof(iclient));
418 	iclient.euid = client->euid;
419 	iclient.egid = client->egid;
420 
421 	proc = client->repo;
422 	if (proc) {
423 		if (strlcpy(iclient.repo_name, proc->repo_path,
424 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
425 			return got_error_msg(GOT_ERR_NO_SPACE,
426 			    "repo name too long");
427 		}
428 		if (client_is_writing(client))
429 			iclient.is_writing = 1;
430 
431 		iclient.repo_child_pid = proc->pid;
432 	}
433 
434 	if (client->session)
435 		iclient.session_child_pid = client->session->pid;
436 
437 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
438 	    &iclient, sizeof(iclient)) == -1) {
439 		err = got_error_from_errno("imsg compose INFO_CLIENT");
440 		if (err)
441 			return err;
442 	}
443 
444 	return NULL;
445 }
446 
447 static const struct got_error *
448 send_info(struct gotd_client *client)
449 {
450 	const struct got_error *err = NULL;
451 	struct gotd_imsg_info info;
452 	uint64_t slot;
453 	struct gotd_repo *repo;
454 
455 	if (client->euid != 0)
456 		return got_error_set_errno(EPERM, "info");
457 
458 	info.pid = gotd.pid;
459 	info.verbosity = gotd.verbosity;
460 	info.nrepos = gotd.nrepos;
461 	info.nclients = client_cnt - 1;
462 
463 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
464 	    &info, sizeof(info)) == -1) {
465 		err = got_error_from_errno("imsg compose INFO");
466 		if (err)
467 			return err;
468 	}
469 
470 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
471 		err = send_repo_info(&client->iev, repo);
472 		if (err)
473 			return err;
474 	}
475 
476 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
477 		struct gotd_client *c;
478 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
479 			if (c->id == client->id)
480 				continue;
481 			err = send_client_info(&client->iev, c);
482 			if (err)
483 				return err;
484 		}
485 	}
486 
487 	return NULL;
488 }
489 
490 static const struct got_error *
491 stop_gotd(struct gotd_client *client)
492 {
493 
494 	if (client->euid != 0)
495 		return got_error_set_errno(EPERM, "stop");
496 
497 	gotd_shutdown();
498 	/* NOTREACHED */
499 	return NULL;
500 }
501 
502 static const struct got_error *
503 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
504 {
505 	const struct got_error *err;
506 	struct gotd_imsg_list_refs ireq;
507 	struct gotd_repo *repo = NULL;
508 	size_t datalen;
509 
510 	log_debug("list-refs request from uid %d", client->euid);
511 
512 	if (client->state != GOTD_CLIENT_STATE_NEW)
513 		return got_error_msg(GOT_ERR_BAD_REQUEST,
514 		    "unexpected list-refs request received");
515 
516 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
517 	if (datalen != sizeof(ireq))
518 		return got_error(GOT_ERR_PRIVSEP_LEN);
519 
520 	memcpy(&ireq, imsg->data, datalen);
521 
522 	if (ireq.client_is_reading) {
523 		err = ensure_client_is_not_writing(client);
524 		if (err)
525 			return err;
526 		repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
527 		if (repo == NULL)
528 			return got_error(GOT_ERR_NOT_GIT_REPO);
529 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
530 		    gotd.argv0, gotd.confpath, gotd.daemonize,
531 		    gotd.verbosity);
532 		if (err)
533 			return err;
534 	} else {
535 		err = ensure_client_is_not_reading(client);
536 		if (err)
537 			return err;
538 		repo = gotd_find_repo_by_name(ireq.repo_name, &gotd);
539 		if (repo == NULL)
540 			return got_error(GOT_ERR_NOT_GIT_REPO);
541 		err = start_auth_child(client,
542 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
543 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
544 		    gotd.verbosity);
545 		if (err)
546 			return err;
547 	}
548 
549 	evtimer_add(&client->tmo, &auth_timeout);
550 
551 	/* Flow continues upon authentication successs/failure or timeout. */
552 	return NULL;
553 }
554 
555 static void
556 gotd_request(int fd, short events, void *arg)
557 {
558 	struct gotd_imsgev *iev = arg;
559 	struct imsgbuf *ibuf = &iev->ibuf;
560 	struct gotd_client *client = iev->handler_arg;
561 	const struct got_error *err = NULL;
562 	struct imsg imsg;
563 	ssize_t n;
564 
565 	if (events & EV_WRITE) {
566 		while (ibuf->w.queued) {
567 			n = msgbuf_write(&ibuf->w);
568 			if (n == -1 && errno == EPIPE) {
569 				/*
570 				 * The client has closed its socket.
571 				 * This can happen when Git clients are
572 				 * done sending pack file data.
573 				 */
574 				msgbuf_clear(&ibuf->w);
575 				continue;
576 			} else if (n == -1 && errno != EAGAIN) {
577 				err = got_error_from_errno("imsg_flush");
578 				disconnect_on_error(client, err);
579 				return;
580 			}
581 			if (n == 0) {
582 				/* Connection closed. */
583 				err = got_error(GOT_ERR_EOF);
584 				disconnect_on_error(client, err);
585 				return;
586 			}
587 		}
588 
589 		/* Disconnect gotctl(8) now that messages have been sent. */
590 		if (!client_is_reading(client) && !client_is_writing(client)) {
591 			disconnect(client);
592 			return;
593 		}
594 	}
595 
596 	if ((events & EV_READ) == 0)
597 		return;
598 
599 	memset(&imsg, 0, sizeof(imsg));
600 
601 	while (err == NULL) {
602 		err = gotd_imsg_recv(&imsg, ibuf, 0);
603 		if (err) {
604 			if (err->code == GOT_ERR_PRIVSEP_READ)
605 				err = NULL;
606 			break;
607 		}
608 
609 		evtimer_del(&client->tmo);
610 
611 		switch (imsg.hdr.type) {
612 		case GOTD_IMSG_INFO:
613 			err = send_info(client);
614 			break;
615 		case GOTD_IMSG_STOP:
616 			err = stop_gotd(client);
617 			break;
618 		case GOTD_IMSG_LIST_REFS:
619 			err = start_client_authentication(client, &imsg);
620 			break;
621 		default:
622 			log_debug("unexpected imsg %d", imsg.hdr.type);
623 			err = got_error(GOT_ERR_PRIVSEP_MSG);
624 			break;
625 		}
626 
627 		imsg_free(&imsg);
628 	}
629 
630 	if (err) {
631 		disconnect_on_error(client, err);
632 	} else {
633 		gotd_imsg_event_add(&client->iev);
634 	}
635 }
636 
637 static void
638 gotd_auth_timeout(int fd, short events, void *arg)
639 {
640 	struct gotd_client *client = arg;
641 
642 	log_debug("disconnecting uid %d due to authentication timeout",
643 	    client->euid);
644 	disconnect(client);
645 }
646 
647 static const struct got_error *
648 recv_connect(uint32_t *client_id, struct imsg *imsg)
649 {
650 	const struct got_error *err = NULL;
651 	struct gotd_imsg_connect iconnect;
652 	size_t datalen;
653 	int s = -1;
654 	struct gotd_client *client = NULL;
655 
656 	*client_id = 0;
657 
658 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
659 	if (datalen != sizeof(iconnect))
660 		return got_error(GOT_ERR_PRIVSEP_LEN);
661 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
662 
663 	s = imsg->fd;
664 	if (s == -1) {
665 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
666 		goto done;
667 	}
668 
669 	if (find_client(iconnect.client_id)) {
670 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
671 		goto done;
672 	}
673 
674 	client = calloc(1, sizeof(*client));
675 	if (client == NULL) {
676 		err = got_error_from_errno("calloc");
677 		goto done;
678 	}
679 
680 	*client_id = iconnect.client_id;
681 
682 	client->state = GOTD_CLIENT_STATE_NEW;
683 	client->id = iconnect.client_id;
684 	client->fd = s;
685 	s = -1;
686 	/* The auth process will verify UID/GID for us. */
687 	client->euid = iconnect.euid;
688 	client->egid = iconnect.egid;
689 
690 	imsg_init(&client->iev.ibuf, client->fd);
691 	client->iev.handler = gotd_request;
692 	client->iev.events = EV_READ;
693 	client->iev.handler_arg = client;
694 
695 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
696 	    &client->iev);
697 	gotd_imsg_event_add(&client->iev);
698 
699 	evtimer_set(&client->tmo, gotd_auth_timeout, client);
700 
701 	add_client(client);
702 	log_debug("%s: new client uid %d connected on fd %d", __func__,
703 	    client->euid, client->fd);
704 done:
705 	if (err) {
706 		struct gotd_child_proc *listen_proc = gotd.listen_proc;
707 		struct gotd_imsg_disconnect idisconnect;
708 
709 		idisconnect.client_id = client->id;
710 		if (gotd_imsg_compose_event(&listen_proc->iev,
711 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
712 		    &idisconnect, sizeof(idisconnect)) == -1)
713 			log_warn("imsg compose DISCONNECT");
714 
715 		if (s != -1)
716 			close(s);
717 	}
718 
719 	return err;
720 }
721 
722 static const char *gotd_proc_names[PROC_MAX] = {
723 	"parent",
724 	"listen",
725 	"auth",
726 	"session_read",
727 	"session_write",
728 	"repo_read",
729 	"repo_write",
730 	"gitwrapper"
731 };
732 
733 static void
734 kill_proc(struct gotd_child_proc *proc, int fatal)
735 {
736 	struct timeval tv = { 5, 0 };
737 
738 	log_debug("kill -%d %d", fatal ? SIGKILL : SIGTERM, proc->pid);
739 
740 	if (proc->iev.ibuf.fd != -1) {
741 		event_del(&proc->iev.ev);
742 		msgbuf_clear(&proc->iev.ibuf.w);
743 		close(proc->iev.ibuf.fd);
744 		proc->iev.ibuf.fd = -1;
745 	}
746 
747 	if (!evtimer_pending(&proc->tmo, NULL) && !fatal)
748 		evtimer_add(&proc->tmo, &tv);
749 
750 	if (fatal) {
751 		log_warnx("sending SIGKILL to PID %d", proc->pid);
752 		kill(proc->pid, SIGKILL);
753 	} else
754 		kill(proc->pid, SIGTERM);
755 }
756 
757 static void
758 kill_proc_timeout(int fd, short ev, void *d)
759 {
760 	struct gotd_child_proc *proc = d;
761 
762 	log_warnx("timeout waiting for PID %d to terminate;"
763 	    " retrying with force", proc->pid);
764 	kill_proc(proc, 1);
765 }
766 
767 static void
768 gotd_shutdown(void)
769 {
770 	uint64_t slot;
771 
772 	log_debug("shutting down");
773 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
774 		struct gotd_client *c, *tmp;
775 
776 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
777 			disconnect(c);
778 	}
779 
780 	kill_proc(gotd.listen_proc, 0);
781 
782 	log_info("terminating");
783 	exit(0);
784 }
785 
786 static struct gotd_child_proc *
787 find_proc_by_pid(pid_t pid)
788 {
789 	struct gotd_child_proc *proc = NULL;
790 
791 	TAILQ_FOREACH(proc, &procs, entry)
792 		if (proc->pid == pid)
793 			break;
794 
795 	return proc;
796 }
797 
798 void
799 gotd_sighdlr(int sig, short event, void *arg)
800 {
801 	struct gotd_child_proc *proc;
802 	pid_t pid;
803 	int status;
804 
805 	/*
806 	 * Normal signal handler rules don't apply because libevent
807 	 * decouples for us.
808 	 */
809 
810 	switch (sig) {
811 	case SIGHUP:
812 		log_info("%s: ignoring SIGHUP", __func__);
813 		break;
814 	case SIGUSR1:
815 		log_info("%s: ignoring SIGUSR1", __func__);
816 		break;
817 	case SIGTERM:
818 	case SIGINT:
819 		gotd_shutdown();
820 		break;
821 	case SIGCHLD:
822 		for (;;) {
823 			pid = waitpid(WAIT_ANY, &status, WNOHANG);
824 			if (pid == -1) {
825 				if (errno == EINTR)
826 					continue;
827 				if (errno == ECHILD)
828 					break;
829 				fatal("waitpid");
830 			}
831 			if (pid == 0)
832 				break;
833 
834 			log_debug("reaped pid %d", pid);
835 			proc = find_proc_by_pid(pid);
836 			if (proc == NULL) {
837 				log_info("caught exit of unknown child %d",
838 				    pid);
839 				continue;
840 			}
841 
842 			if (WIFSIGNALED(status)) {
843 				log_warnx("child PID %d terminated with"
844 				    " signal %d", pid, WTERMSIG(status));
845 			}
846 
847 			proc_done(proc);
848 		}
849 		break;
850 	default:
851 		fatalx("unexpected signal");
852 	}
853 }
854 
855 static const struct got_error *
856 ensure_proc_is_reading(struct gotd_client *client,
857     struct gotd_child_proc *proc)
858 {
859 	if (!client_is_reading(client)) {
860 		kill_proc(proc, 1);
861 		return got_error_fmt(GOT_ERR_BAD_PACKET,
862 		    "PID %d handled a read-request for uid %d but this "
863 		    "user is not reading from a repository", proc->pid,
864 		    client->euid);
865 	}
866 
867 	return NULL;
868 }
869 
870 static const struct got_error *
871 ensure_proc_is_writing(struct gotd_client *client,
872     struct gotd_child_proc *proc)
873 {
874 	if (!client_is_writing(client)) {
875 		kill_proc(proc, 1);
876 		return got_error_fmt(GOT_ERR_BAD_PACKET,
877 		    "PID %d handled a write-request for uid %d but this "
878 		    "user is not writing to a repository", proc->pid,
879 		    client->euid);
880 	}
881 
882 	return NULL;
883 }
884 
885 static int
886 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
887     struct imsg *imsg)
888 {
889 	const struct got_error *err;
890 	int ret = 0;
891 
892 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
893 		if (client->repo == NULL)
894 			fatalx("no process found for uid %d", client->euid);
895 		if (proc->pid != client->repo->pid) {
896 			kill_proc(proc, 1);
897 			log_warnx("received message from PID %d for uid %d, "
898 			    "while PID %d is the process serving this user",
899 			    proc->pid, client->euid, client->repo->pid);
900 			return 0;
901 		}
902 	}
903 	if (proc->type == PROC_SESSION_READ ||
904 	    proc->type == PROC_SESSION_WRITE) {
905 		if (client->session == NULL) {
906 			log_warnx("no session found for uid %d", client->euid);
907 			return 0;
908 		}
909 		if (proc->pid != client->session->pid) {
910 			kill_proc(proc, 1);
911 			log_warnx("received message from PID %d for uid %d, "
912 			    "while PID %d is the process serving this user",
913 			    proc->pid, client->euid, client->session->pid);
914 			return 0;
915 		}
916 	}
917 
918 	switch (imsg->hdr.type) {
919 	case GOTD_IMSG_ERROR:
920 		ret = 1;
921 		break;
922 	case GOTD_IMSG_CONNECT:
923 		if (proc->type != PROC_LISTEN) {
924 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
925 			    "new connection for uid %d from PID %d "
926 			    "which is not the listen process",
927 			    proc->pid, client->euid);
928 		} else
929 			ret = 1;
930 		break;
931 	case GOTD_IMSG_ACCESS_GRANTED:
932 		if (proc->type != PROC_AUTH) {
933 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
934 			    "authentication of uid %d from PID %d "
935 			    "which is not the auth process",
936 			    proc->pid, client->euid);
937 		} else
938 			ret = 1;
939 		break;
940 	case GOTD_IMSG_CLIENT_SESSION_READY:
941 		if (proc->type != PROC_SESSION_READ &&
942 		    proc->type != PROC_SESSION_WRITE) {
943 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
944 			    "unexpected \"ready\" signal from PID %d",
945 			    proc->pid);
946 		} else
947 			ret = 1;
948 		break;
949 	case GOTD_IMSG_REPO_CHILD_READY:
950 		if (proc->type != PROC_REPO_READ &&
951 		    proc->type != PROC_REPO_WRITE) {
952 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
953 			    "unexpected \"ready\" signal from PID %d",
954 			    proc->pid);
955 		} else
956 			ret = 1;
957 		break;
958 	case GOTD_IMSG_PACKFILE_DONE:
959 		err = ensure_proc_is_reading(client, proc);
960 		if (err)
961 			log_warnx("uid %d: %s", client->euid, err->msg);
962 		else
963 			ret = 1;
964 		break;
965 	case GOTD_IMSG_PACKFILE_INSTALL:
966 	case GOTD_IMSG_REF_UPDATES_START:
967 	case GOTD_IMSG_REF_UPDATE:
968 		err = ensure_proc_is_writing(client, proc);
969 		if (err)
970 			log_warnx("uid %d: %s", client->euid, err->msg);
971 		else
972 			ret = 1;
973 		break;
974 	default:
975 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
976 		break;
977 	}
978 
979 	return ret;
980 }
981 
982 static const struct got_error *
983 connect_repo_child(struct gotd_client *client,
984     struct gotd_child_proc *repo_proc)
985 {
986 	static const struct got_error *err;
987 	struct gotd_imsgev *session_iev = &client->session->iev;
988 	struct gotd_imsg_connect_repo_child ireq;
989 	int pipe[2];
990 
991 	if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED)
992 		return got_error_msg(GOT_ERR_BAD_REQUEST,
993 		    "unexpected repo child ready signal received");
994 
995 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
996 	    PF_UNSPEC, pipe) == -1)
997 		fatal("socketpair");
998 
999 	memset(&ireq, 0, sizeof(ireq));
1000 	ireq.client_id = client->id;
1001 	ireq.proc_id = repo_proc->type;
1002 
1003 	/* Pass repo child pipe to session child process. */
1004 	if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
1005 	    PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
1006 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
1007 		close(pipe[0]);
1008 		close(pipe[1]);
1009 		return err;
1010 	}
1011 
1012 	/* Pass session child pipe to repo child process. */
1013 	if (gotd_imsg_compose_event(&repo_proc->iev,
1014 	    GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
1015 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
1016 		close(pipe[1]);
1017 		return err;
1018 	}
1019 
1020 	return NULL;
1021 }
1022 
1023 static void
1024 gotd_dispatch_listener(int fd, short event, void *arg)
1025 {
1026 	struct gotd_imsgev *iev = arg;
1027 	struct imsgbuf *ibuf = &iev->ibuf;
1028 	struct gotd_child_proc *proc = gotd.listen_proc;
1029 	ssize_t n;
1030 	int shut = 0;
1031 	struct imsg imsg;
1032 
1033 	if (proc->iev.ibuf.fd != fd)
1034 		fatalx("%s: unexpected fd %d", __func__, fd);
1035 
1036 	if (event & EV_READ) {
1037 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1038 			fatal("imsg_read error");
1039 		if (n == 0) {
1040 			/* Connection closed. */
1041 			shut = 1;
1042 			goto done;
1043 		}
1044 	}
1045 
1046 	if (event & EV_WRITE) {
1047 		n = msgbuf_write(&ibuf->w);
1048 		if (n == -1 && errno != EAGAIN)
1049 			fatal("msgbuf_write");
1050 		if (n == 0) {
1051 			/* Connection closed. */
1052 			shut = 1;
1053 			goto done;
1054 		}
1055 	}
1056 
1057 	for (;;) {
1058 		const struct got_error *err = NULL;
1059 		struct gotd_client *client = NULL;
1060 		uint32_t client_id = 0;
1061 		int do_disconnect = 0;
1062 
1063 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1064 			fatal("%s: imsg_get error", __func__);
1065 		if (n == 0)	/* No more messages. */
1066 			break;
1067 
1068 		switch (imsg.hdr.type) {
1069 		case GOTD_IMSG_ERROR:
1070 			do_disconnect = 1;
1071 			err = gotd_imsg_recv_error(&client_id, &imsg);
1072 			break;
1073 		case GOTD_IMSG_CONNECT:
1074 			err = recv_connect(&client_id, &imsg);
1075 			break;
1076 		default:
1077 			log_debug("unexpected imsg %d", imsg.hdr.type);
1078 			break;
1079 		}
1080 
1081 		client = find_client(client_id);
1082 		if (client == NULL) {
1083 			log_warnx("%s: client not found", __func__);
1084 			imsg_free(&imsg);
1085 			continue;
1086 		}
1087 
1088 		if (err)
1089 			log_warnx("uid %d: %s", client->euid, err->msg);
1090 
1091 		if (do_disconnect) {
1092 			if (err)
1093 				disconnect_on_error(client, err);
1094 			else
1095 				disconnect(client);
1096 		}
1097 
1098 		imsg_free(&imsg);
1099 	}
1100 done:
1101 	if (!shut) {
1102 		gotd_imsg_event_add(iev);
1103 	} else {
1104 		/* This pipe is dead. Remove its event handler */
1105 		event_del(&iev->ev);
1106 		event_loopexit(NULL);
1107 	}
1108 }
1109 
1110 static void
1111 gotd_dispatch_auth_child(int fd, short event, void *arg)
1112 {
1113 	const struct got_error *err = NULL;
1114 	struct gotd_imsgev *iev = arg;
1115 	struct imsgbuf *ibuf = &iev->ibuf;
1116 	struct gotd_client *client;
1117 	struct gotd_repo *repo = NULL;
1118 	ssize_t n;
1119 	int shut = 0;
1120 	struct imsg imsg;
1121 	uint32_t client_id = 0;
1122 	int do_disconnect = 0;
1123 
1124 	client = find_client_by_proc_fd(fd);
1125 	if (client == NULL) {
1126 		/* Can happen during process teardown. */
1127 		warnx("cannot find client for fd %d", fd);
1128 		shut = 1;
1129 		goto done;
1130 	}
1131 
1132 	if (client->auth == NULL)
1133 		fatalx("cannot find auth child process for fd %d", fd);
1134 
1135 	if (event & EV_READ) {
1136 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1137 			fatal("imsg_read error");
1138 		if (n == 0) {
1139 			/* Connection closed. */
1140 			shut = 1;
1141 			goto done;
1142 		}
1143 	}
1144 
1145 	if (event & EV_WRITE) {
1146 		n = msgbuf_write(&ibuf->w);
1147 		if (n == -1 && errno != EAGAIN)
1148 			fatal("msgbuf_write");
1149 		if (n == 0) {
1150 			/* Connection closed. */
1151 			shut = 1;
1152 		}
1153 		goto done;
1154 	}
1155 
1156 	if (client->auth->iev.ibuf.fd != fd)
1157 		fatalx("%s: unexpected fd %d", __func__, fd);
1158 
1159 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1160 		fatal("%s: imsg_get error", __func__);
1161 	if (n == 0)	/* No more messages. */
1162 		return;
1163 
1164 	evtimer_del(&client->tmo);
1165 
1166 	switch (imsg.hdr.type) {
1167 	case GOTD_IMSG_ERROR:
1168 		do_disconnect = 1;
1169 		err = gotd_imsg_recv_error(&client_id, &imsg);
1170 		break;
1171 	case GOTD_IMSG_ACCESS_GRANTED:
1172 		client->state = GOTD_CLIENT_STATE_ACCESS_GRANTED;
1173 		break;
1174 	default:
1175 		do_disconnect = 1;
1176 		log_debug("unexpected imsg %d", imsg.hdr.type);
1177 		break;
1178 	}
1179 
1180 	if (!verify_imsg_src(client, client->auth, &imsg)) {
1181 		do_disconnect = 1;
1182 		log_debug("dropping imsg type %d from PID %d",
1183 		    imsg.hdr.type, client->auth->pid);
1184 	}
1185 	imsg_free(&imsg);
1186 
1187 	if (do_disconnect) {
1188 		if (err)
1189 			disconnect_on_error(client, err);
1190 		else
1191 			disconnect(client);
1192 		return;
1193 	}
1194 
1195 	repo = gotd_find_repo_by_name(client->auth->repo_name, &gotd);
1196 	if (repo == NULL) {
1197 		err = got_error(GOT_ERR_NOT_GIT_REPO);
1198 		goto done;
1199 	}
1200 	kill_auth_proc(client);
1201 
1202 	log_info("authenticated uid %d for repository %s",
1203 	    client->euid, repo->name);
1204 
1205 	err = start_session_child(client, repo, gotd.argv0,
1206 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
1207 	if (err)
1208 		goto done;
1209 done:
1210 	if (err)
1211 		log_warnx("uid %d: %s", client->euid, err->msg);
1212 
1213 	/* We might have killed the auth process by now. */
1214 	if (client->auth != NULL) {
1215 		if (!shut) {
1216 			gotd_imsg_event_add(iev);
1217 		} else {
1218 			/* This pipe is dead. Remove its event handler */
1219 			event_del(&iev->ev);
1220 		}
1221 	}
1222 }
1223 
1224 static const struct got_error *
1225 connect_session(struct gotd_client *client)
1226 {
1227 	const struct got_error *err = NULL;
1228 	struct gotd_imsg_connect iconnect;
1229 	int s;
1230 
1231 	memset(&iconnect, 0, sizeof(iconnect));
1232 
1233 	s = dup(client->fd);
1234 	if (s == -1)
1235 		return got_error_from_errno("dup");
1236 
1237 	iconnect.client_id = client->id;
1238 	iconnect.euid = client->euid;
1239 	iconnect.egid = client->egid;
1240 
1241 	if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1242 	    PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1243 		err = got_error_from_errno("imsg compose CONNECT");
1244 		close(s);
1245 		return err;
1246 	}
1247 
1248 	/*
1249 	 * We are no longer interested in messages from this client.
1250 	 * Further client requests will be handled by the session process.
1251 	 */
1252 	msgbuf_clear(&client->iev.ibuf.w);
1253 	imsg_clear(&client->iev.ibuf);
1254 	event_del(&client->iev.ev);
1255 	client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1256 
1257 	return NULL;
1258 }
1259 
1260 static void
1261 gotd_dispatch_client_session(int fd, short event, void *arg)
1262 {
1263 	struct gotd_imsgev *iev = arg;
1264 	struct imsgbuf *ibuf = &iev->ibuf;
1265 	struct gotd_child_proc *proc = NULL;
1266 	struct gotd_client *client = NULL;
1267 	ssize_t n;
1268 	int shut = 0;
1269 	struct imsg imsg;
1270 
1271 	client = find_client_by_proc_fd(fd);
1272 	if (client == NULL) {
1273 		/* Can happen during process teardown. */
1274 		warnx("cannot find client for fd %d", fd);
1275 		shut = 1;
1276 		goto done;
1277 	}
1278 
1279 	if (event & EV_READ) {
1280 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1281 			fatal("imsg_read error");
1282 		if (n == 0) {
1283 			/* Connection closed. */
1284 			shut = 1;
1285 			goto done;
1286 		}
1287 	}
1288 
1289 	if (event & EV_WRITE) {
1290 		n = msgbuf_write(&ibuf->w);
1291 		if (n == -1 && errno != EAGAIN)
1292 			fatal("msgbuf_write");
1293 		if (n == 0) {
1294 			/* Connection closed. */
1295 			shut = 1;
1296 			goto done;
1297 		}
1298 	}
1299 
1300 	proc = client->session;
1301 	if (proc == NULL)
1302 		fatalx("cannot find session child process for fd %d", fd);
1303 
1304 	for (;;) {
1305 		const struct got_error *err = NULL;
1306 		uint32_t client_id = 0;
1307 		int do_disconnect = 0, do_start_repo_child = 0;
1308 
1309 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1310 			fatal("%s: imsg_get error", __func__);
1311 		if (n == 0)	/* No more messages. */
1312 			break;
1313 
1314 		switch (imsg.hdr.type) {
1315 		case GOTD_IMSG_ERROR:
1316 			do_disconnect = 1;
1317 			err = gotd_imsg_recv_error(&client_id, &imsg);
1318 			break;
1319 		case GOTD_IMSG_CLIENT_SESSION_READY:
1320 			if (client->state != GOTD_CLIENT_STATE_ACCESS_GRANTED) {
1321 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1322 				break;
1323 			}
1324 			do_start_repo_child = 1;
1325 			break;
1326 		case GOTD_IMSG_DISCONNECT:
1327 			do_disconnect = 1;
1328 			break;
1329 		default:
1330 			log_debug("unexpected imsg %d", imsg.hdr.type);
1331 			break;
1332 		}
1333 
1334 		if (!verify_imsg_src(client, proc, &imsg)) {
1335 			log_debug("dropping imsg type %d from PID %d",
1336 			    imsg.hdr.type, proc->pid);
1337 			imsg_free(&imsg);
1338 			continue;
1339 		}
1340 		if (err)
1341 			log_warnx("uid %d: %s", client->euid, err->msg);
1342 
1343 		if (do_start_repo_child) {
1344 			struct gotd_repo *repo;
1345 			const char *name = client->session->repo_name;
1346 
1347 			repo = gotd_find_repo_by_name(name, &gotd);
1348 			if (repo != NULL) {
1349 				enum gotd_procid proc_type;
1350 
1351 				if (client->required_auth & GOTD_AUTH_WRITE)
1352 					proc_type = PROC_REPO_WRITE;
1353 				else
1354 					proc_type = PROC_REPO_READ;
1355 
1356 				err = start_repo_child(client, proc_type, repo,
1357 				    gotd.argv0, gotd.confpath, gotd.daemonize,
1358 				    gotd.verbosity);
1359 			} else
1360 				err = got_error(GOT_ERR_NOT_GIT_REPO);
1361 
1362 			if (err) {
1363 				log_warnx("uid %d: %s", client->euid, err->msg);
1364 				do_disconnect = 1;
1365 			}
1366 		}
1367 
1368 		if (do_disconnect) {
1369 			if (err)
1370 				disconnect_on_error(client, err);
1371 			else
1372 				disconnect(client);
1373 		}
1374 
1375 		imsg_free(&imsg);
1376 	}
1377 done:
1378 	if (!shut) {
1379 		gotd_imsg_event_add(iev);
1380 	} else {
1381 		/* This pipe is dead. Remove its event handler */
1382 		event_del(&iev->ev);
1383 		disconnect(client);
1384 	}
1385 }
1386 
1387 static void
1388 gotd_dispatch_repo_child(int fd, short event, void *arg)
1389 {
1390 	struct gotd_imsgev *iev = arg;
1391 	struct imsgbuf *ibuf = &iev->ibuf;
1392 	struct gotd_child_proc *proc = NULL;
1393 	struct gotd_client *client;
1394 	ssize_t n;
1395 	int shut = 0;
1396 	struct imsg imsg;
1397 
1398 	client = find_client_by_proc_fd(fd);
1399 	if (client == NULL) {
1400 		/* Can happen during process teardown. */
1401 		warnx("cannot find client for fd %d", fd);
1402 		shut = 1;
1403 		goto done;
1404 	}
1405 
1406 	if (event & EV_READ) {
1407 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1408 			fatal("imsg_read error");
1409 		if (n == 0) {
1410 			/* Connection closed. */
1411 			shut = 1;
1412 			goto done;
1413 		}
1414 	}
1415 
1416 	if (event & EV_WRITE) {
1417 		n = msgbuf_write(&ibuf->w);
1418 		if (n == -1 && errno != EAGAIN)
1419 			fatal("msgbuf_write");
1420 		if (n == 0) {
1421 			/* Connection closed. */
1422 			shut = 1;
1423 			goto done;
1424 		}
1425 	}
1426 
1427 	proc = client->repo;
1428 	if (proc == NULL)
1429 		fatalx("cannot find child process for fd %d", fd);
1430 
1431 	for (;;) {
1432 		const struct got_error *err = NULL;
1433 		uint32_t client_id = 0;
1434 		int do_disconnect = 0;
1435 
1436 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1437 			fatal("%s: imsg_get error", __func__);
1438 		if (n == 0)	/* No more messages. */
1439 			break;
1440 
1441 		switch (imsg.hdr.type) {
1442 		case GOTD_IMSG_ERROR:
1443 			do_disconnect = 1;
1444 			err = gotd_imsg_recv_error(&client_id, &imsg);
1445 			break;
1446 		case GOTD_IMSG_REPO_CHILD_READY:
1447 			err = connect_session(client);
1448 			if (err)
1449 				break;
1450 			err = connect_repo_child(client, proc);
1451 			break;
1452 		default:
1453 			log_debug("unexpected imsg %d", imsg.hdr.type);
1454 			break;
1455 		}
1456 
1457 		if (!verify_imsg_src(client, proc, &imsg)) {
1458 			log_debug("dropping imsg type %d from PID %d",
1459 			    imsg.hdr.type, proc->pid);
1460 			imsg_free(&imsg);
1461 			continue;
1462 		}
1463 		if (err)
1464 			log_warnx("uid %d: %s", client->euid, err->msg);
1465 
1466 		if (do_disconnect) {
1467 			if (err)
1468 				disconnect_on_error(client, err);
1469 			else
1470 				disconnect(client);
1471 		}
1472 
1473 		imsg_free(&imsg);
1474 	}
1475 done:
1476 	if (!shut) {
1477 		gotd_imsg_event_add(iev);
1478 	} else {
1479 		/* This pipe is dead. Remove its event handler */
1480 		event_del(&iev->ev);
1481 		disconnect(client);
1482 	}
1483 }
1484 
1485 static pid_t
1486 start_child(enum gotd_procid proc_id, const char *repo_path,
1487     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1488 {
1489 	char	*argv[11];
1490 	int	 argc = 0;
1491 	pid_t	 pid;
1492 
1493 	switch (pid = fork()) {
1494 	case -1:
1495 		fatal("cannot fork");
1496 	case 0:
1497 		break;
1498 	default:
1499 		close(fd);
1500 		return pid;
1501 	}
1502 
1503 	if (fd != GOTD_FILENO_MSG_PIPE) {
1504 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1505 			fatal("cannot setup imsg fd");
1506 	} else if (fcntl(fd, F_SETFD, 0) == -1)
1507 		fatal("cannot setup imsg fd");
1508 
1509 	argv[argc++] = argv0;
1510 	switch (proc_id) {
1511 	case PROC_LISTEN:
1512 		argv[argc++] = (char *)"-L";
1513 		break;
1514 	case PROC_AUTH:
1515 		argv[argc++] = (char *)"-A";
1516 		break;
1517 	case PROC_SESSION_READ:
1518 		argv[argc++] = (char *)"-s";
1519 		break;
1520 	case PROC_SESSION_WRITE:
1521 		argv[argc++] = (char *)"-S";
1522 		break;
1523 	case PROC_REPO_READ:
1524 		argv[argc++] = (char *)"-R";
1525 		break;
1526 	case PROC_REPO_WRITE:
1527 		argv[argc++] = (char *)"-W";
1528 		break;
1529 	default:
1530 		fatalx("invalid process id %d", proc_id);
1531 	}
1532 
1533 	argv[argc++] = (char *)"-f";
1534 	argv[argc++] = (char *)confpath;
1535 
1536 	if (repo_path) {
1537 		argv[argc++] = (char *)"-P";
1538 		argv[argc++] = (char *)repo_path;
1539 	}
1540 
1541 	if (!daemonize)
1542 		argv[argc++] = (char *)"-d";
1543 	if (verbosity > 0)
1544 		argv[argc++] = (char *)"-v";
1545 	if (verbosity > 1)
1546 		argv[argc++] = (char *)"-v";
1547 	argv[argc++] = NULL;
1548 
1549 	execvp(argv0, argv);
1550 	fatal("execvp");
1551 }
1552 
1553 static void
1554 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1555 {
1556 	struct gotd_child_proc *proc;
1557 
1558 	proc = calloc(1, sizeof(*proc));
1559 	if (proc == NULL)
1560 		fatal("calloc");
1561 
1562 	TAILQ_INSERT_HEAD(&procs, proc, entry);
1563 
1564 	/* proc->tmo is initialized in main() after event_init() */
1565 
1566 	proc->type = PROC_LISTEN;
1567 
1568 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1569 	    PF_UNSPEC, proc->pipe) == -1)
1570 		fatal("socketpair");
1571 
1572 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
1573 	    proc->pipe[1], daemonize, verbosity);
1574 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1575 	proc->iev.handler = gotd_dispatch_listener;
1576 	proc->iev.events = EV_READ;
1577 	proc->iev.handler_arg = NULL;
1578 
1579 	gotd.listen_proc = proc;
1580 }
1581 
1582 static const struct got_error *
1583 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1584     char *argv0, const char *confpath, int daemonize, int verbosity)
1585 {
1586 	struct gotd_child_proc *proc;
1587 
1588 	proc = calloc(1, sizeof(*proc));
1589 	if (proc == NULL)
1590 		return got_error_from_errno("calloc");
1591 
1592 	TAILQ_INSERT_HEAD(&procs, proc, entry);
1593 	evtimer_set(&proc->tmo, kill_proc_timeout, proc);
1594 
1595 	if (client_is_reading(client))
1596 		proc->type = PROC_SESSION_READ;
1597 	else
1598 		proc->type = PROC_SESSION_WRITE;
1599 	if (strlcpy(proc->repo_name, repo->name,
1600 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1601 		fatalx("repository name too long: %s", repo->name);
1602 	log_debug("starting client uid %d session for repository %s",
1603 	    client->euid, repo->name);
1604 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1605 	    sizeof(proc->repo_path))
1606 		fatalx("repository path too long: %s", repo->path);
1607 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1608 	    PF_UNSPEC, proc->pipe) == -1)
1609 		fatal("socketpair");
1610 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1611 	    confpath, proc->pipe[1], daemonize, verbosity);
1612 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1613 	log_debug("proc %s %s is on fd %d",
1614 	    gotd_proc_names[proc->type], proc->repo_path,
1615 	    proc->pipe[0]);
1616 	proc->iev.handler = gotd_dispatch_client_session;
1617 	proc->iev.events = EV_READ;
1618 	proc->iev.handler_arg = NULL;
1619 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1620 	    gotd_dispatch_client_session, &proc->iev);
1621 	gotd_imsg_event_add(&proc->iev);
1622 
1623 	client->session = proc;
1624 	return NULL;
1625 }
1626 
1627 static const struct got_error *
1628 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1629     struct gotd_repo *repo, char *argv0, const char *confpath,
1630     int daemonize, int verbosity)
1631 {
1632 	struct gotd_child_proc *proc;
1633 
1634 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1635 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1636 
1637 	proc = calloc(1, sizeof(*proc));
1638 	if (proc == NULL)
1639 		return got_error_from_errno("calloc");
1640 
1641 	TAILQ_INSERT_HEAD(&procs, proc, entry);
1642 	evtimer_set(&proc->tmo, kill_proc_timeout, proc);
1643 
1644 	proc->type = proc_type;
1645 	if (strlcpy(proc->repo_name, repo->name,
1646 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1647 		fatalx("repository name too long: %s", repo->name);
1648 	log_debug("starting %s for repository %s",
1649 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1650 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1651 	    sizeof(proc->repo_path))
1652 		fatalx("repository path too long: %s", repo->path);
1653 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1654 	    PF_UNSPEC, proc->pipe) == -1)
1655 		fatal("socketpair");
1656 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1657 	    confpath, proc->pipe[1], daemonize, verbosity);
1658 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1659 	log_debug("proc %s %s is on fd %d",
1660 	    gotd_proc_names[proc->type], proc->repo_path,
1661 	    proc->pipe[0]);
1662 	proc->iev.handler = gotd_dispatch_repo_child;
1663 	proc->iev.events = EV_READ;
1664 	proc->iev.handler_arg = NULL;
1665 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1666 	    gotd_dispatch_repo_child, &proc->iev);
1667 	gotd_imsg_event_add(&proc->iev);
1668 
1669 	client->repo = proc;
1670 	return NULL;
1671 }
1672 
1673 static const struct got_error *
1674 start_auth_child(struct gotd_client *client, int required_auth,
1675     struct gotd_repo *repo, char *argv0, const char *confpath,
1676     int daemonize, int verbosity)
1677 {
1678 	const struct got_error *err = NULL;
1679 	struct gotd_child_proc *proc;
1680 	struct gotd_imsg_auth iauth;
1681 	int fd;
1682 
1683 	memset(&iauth, 0, sizeof(iauth));
1684 
1685 	fd = dup(client->fd);
1686 	if (fd == -1)
1687 		return got_error_from_errno("dup");
1688 
1689 	proc = calloc(1, sizeof(*proc));
1690 	if (proc == NULL) {
1691 		err = got_error_from_errno("calloc");
1692 		close(fd);
1693 		return err;
1694 	}
1695 
1696 	TAILQ_INSERT_HEAD(&procs, proc, entry);
1697 	evtimer_set(&proc->tmo, kill_proc_timeout, proc);
1698 
1699 	proc->type = PROC_AUTH;
1700 	if (strlcpy(proc->repo_name, repo->name,
1701 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1702 		fatalx("repository name too long: %s", repo->name);
1703 	log_debug("starting auth for uid %d repository %s",
1704 	    client->euid, repo->name);
1705 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1706 	    sizeof(proc->repo_path))
1707 		fatalx("repository path too long: %s", repo->path);
1708 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1709 	    PF_UNSPEC, proc->pipe) == -1)
1710 		fatal("socketpair");
1711 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1712 	    confpath, proc->pipe[1], daemonize, verbosity);
1713 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1714 	log_debug("proc %s %s is on fd %d",
1715 	    gotd_proc_names[proc->type], proc->repo_path,
1716 	    proc->pipe[0]);
1717 	proc->iev.handler = gotd_dispatch_auth_child;
1718 	proc->iev.events = EV_READ;
1719 	proc->iev.handler_arg = NULL;
1720 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1721 	    gotd_dispatch_auth_child, &proc->iev);
1722 	gotd_imsg_event_add(&proc->iev);
1723 
1724 	iauth.euid = client->euid;
1725 	iauth.egid = client->egid;
1726 	iauth.required_auth = required_auth;
1727 	iauth.client_id = client->id;
1728 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1729 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1730 		log_warn("imsg compose AUTHENTICATE");
1731 		close(fd);
1732 		/* Let the auth_timeout handler tidy up. */
1733 	}
1734 
1735 	client->auth = proc;
1736 	client->required_auth = required_auth;
1737 	return NULL;
1738 }
1739 
1740 static void
1741 apply_unveil_repo_readonly(const char *repo_path, int need_tmpdir)
1742 {
1743 	if (need_tmpdir) {
1744 		if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1745 			fatal("unveil %s", GOT_TMPDIR_STR);
1746 	}
1747 
1748 	if (unveil(repo_path, "r") == -1)
1749 		fatal("unveil %s", repo_path);
1750 
1751 	if (unveil(NULL, NULL) == -1)
1752 		fatal("unveil");
1753 }
1754 
1755 static void
1756 apply_unveil_repo_readwrite(const char *repo_path)
1757 {
1758 	if (unveil(repo_path, "rwc") == -1)
1759 		fatal("unveil %s", repo_path);
1760 
1761 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1762 		fatal("unveil %s", GOT_TMPDIR_STR);
1763 
1764 	if (unveil(NULL, NULL) == -1)
1765 		fatal("unveil");
1766 }
1767 
1768 static void
1769 apply_unveil_none(void)
1770 {
1771 	if (unveil("/", "") == -1)
1772 		fatal("unveil");
1773 
1774 	if (unveil(NULL, NULL) == -1)
1775 		fatal("unveil");
1776 }
1777 
1778 static void
1779 apply_unveil_selfexec(void)
1780 {
1781 	if (unveil(gotd.argv0, "x") == -1)
1782 		fatal("unveil %s", gotd.argv0);
1783 
1784 	if (unveil(NULL, NULL) == -1)
1785 		fatal("unveil");
1786 }
1787 
1788 int
1789 main(int argc, char **argv)
1790 {
1791 	const struct got_error *error = NULL;
1792 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1793 	const char *confpath = GOTD_CONF_PATH;
1794 	char *argv0 = argv[0];
1795 	char title[2048];
1796 	struct passwd *pw = NULL;
1797 	char *repo_path = NULL;
1798 	enum gotd_procid proc_id = PROC_GOTD;
1799 	struct event evsigint, evsigterm, evsighup, evsigusr1, evsigchld;
1800 	int *pack_fds = NULL, *temp_fds = NULL;
1801 	struct gotd_repo *repo = NULL;
1802 
1803 	TAILQ_INIT(&procs);
1804 
1805 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1806 
1807 	while ((ch = getopt(argc, argv, "Adf:LnP:RsSvW")) != -1) {
1808 		switch (ch) {
1809 		case 'A':
1810 			proc_id = PROC_AUTH;
1811 			break;
1812 		case 'd':
1813 			daemonize = 0;
1814 			break;
1815 		case 'f':
1816 			confpath = optarg;
1817 			break;
1818 		case 'L':
1819 			proc_id = PROC_LISTEN;
1820 			break;
1821 		case 'n':
1822 			noaction = 1;
1823 			break;
1824 		case 'P':
1825 			repo_path = realpath(optarg, NULL);
1826 			if (repo_path == NULL)
1827 				fatal("realpath '%s'", optarg);
1828 			break;
1829 		case 'R':
1830 			proc_id = PROC_REPO_READ;
1831 			break;
1832 		case 's':
1833 			proc_id = PROC_SESSION_READ;
1834 			break;
1835 		case 'S':
1836 			proc_id = PROC_SESSION_WRITE;
1837 			break;
1838 		case 'v':
1839 			if (verbosity < 3)
1840 				verbosity++;
1841 			break;
1842 		case 'W':
1843 			proc_id = PROC_REPO_WRITE;
1844 			break;
1845 		default:
1846 			usage();
1847 		}
1848 	}
1849 
1850 	argc -= optind;
1851 	argv += optind;
1852 
1853 	if (argc != 0)
1854 		usage();
1855 
1856 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1857 		fatalx("need root privileges");
1858 
1859 	if (parse_config(confpath, proc_id, &gotd) != 0)
1860 		return 1;
1861 
1862 	pw = getpwnam(gotd.user_name);
1863 	if (pw == NULL)
1864 		fatalx("user %s not found", gotd.user_name);
1865 
1866 	if (pw->pw_uid == 0)
1867 		fatalx("cannot run %s as the superuser", getprogname());
1868 
1869 	if (noaction) {
1870 		fprintf(stderr, "configuration OK\n");
1871 		return 0;
1872 	}
1873 
1874 	gotd.argv0 = argv0;
1875 	gotd.daemonize = daemonize;
1876 	gotd.verbosity = verbosity;
1877 	gotd.confpath = confpath;
1878 
1879 	/* Require an absolute path in argv[0] for reliable re-exec. */
1880 	if (!got_path_is_absolute(argv0))
1881 		fatalx("bad path \"%s\": must be an absolute path", argv0);
1882 
1883 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
1884 	log_setverbose(verbosity);
1885 
1886 	if (proc_id == PROC_GOTD) {
1887 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1888 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1889 		if (daemonize && daemon(1, 0) == -1)
1890 			fatal("daemon");
1891 		gotd.pid = getpid();
1892 		start_listener(argv0, confpath, daemonize, verbosity);
1893 	} else if (proc_id == PROC_LISTEN) {
1894 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1895 		if (verbosity) {
1896 			log_info("socket: %s", gotd.unix_socket_path);
1897 			log_info("user: %s", pw->pw_name);
1898 		}
1899 
1900 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1901 		    pw->pw_gid);
1902 		if (fd == -1) {
1903 			fatal("cannot listen on unix socket %s",
1904 			    gotd.unix_socket_path);
1905 		}
1906 	} else if (proc_id == PROC_AUTH) {
1907 		snprintf(title, sizeof(title), "%s %s",
1908 		    gotd_proc_names[proc_id], repo_path);
1909 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1910 	    proc_id == PROC_SESSION_READ || proc_id == PROC_SESSION_WRITE) {
1911 		error = got_repo_pack_fds_open(&pack_fds);
1912 		if (error != NULL)
1913 			fatalx("cannot open pack tempfiles: %s", error->msg);
1914 		error = got_repo_temp_fds_open(&temp_fds);
1915 		if (error != NULL)
1916 			fatalx("cannot open pack tempfiles: %s", error->msg);
1917 		if (repo_path == NULL)
1918 			fatalx("repository path not specified");
1919 		snprintf(title, sizeof(title), "%s %s",
1920 		    gotd_proc_names[proc_id], repo_path);
1921 	} else
1922 		fatal("invalid process id %d", proc_id);
1923 
1924 	setproctitle("%s", title);
1925 	log_procinit(title);
1926 
1927 	/* Drop root privileges. */
1928 	if (setgid(pw->pw_gid) == -1)
1929 		fatal("setgid %d failed", pw->pw_gid);
1930 	if (setuid(pw->pw_uid) == -1)
1931 		fatal("setuid %d failed", pw->pw_uid);
1932 
1933 	event_init();
1934 
1935 	switch (proc_id) {
1936 	case PROC_GOTD:
1937 #ifndef PROFILE
1938 		/* "exec" promise will be limited to argv[0] via unveil(2). */
1939 		if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
1940 			err(1, "pledge");
1941 #endif
1942 		break;
1943 	case PROC_LISTEN:
1944 #ifndef PROFILE
1945 		if (pledge("stdio sendfd unix unveil", NULL) == -1)
1946 			err(1, "pledge");
1947 #endif
1948 		/*
1949 		 * Ensure that AF_UNIX bind(2) cannot be used with any other
1950 		 * sockets by revoking all filesystem access via unveil(2).
1951 		 */
1952 		apply_unveil_none();
1953 
1954 		listen_main(title, fd, gotd.connection_limits,
1955 		    gotd.nconnection_limits);
1956 		/* NOTREACHED */
1957 		break;
1958 	case PROC_AUTH:
1959 #ifndef PROFILE
1960 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
1961 			err(1, "pledge");
1962 #endif
1963 		/*
1964 		 * We need the "unix" pledge promise for getpeername(2) only.
1965 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
1966 		 * filesystem access via unveil(2). Access to password database
1967 		 * files will still work since "getpw" bypasses unveil(2).
1968 		 */
1969 		apply_unveil_none();
1970 
1971 		auth_main(title, &gotd.repos, repo_path);
1972 		/* NOTREACHED */
1973 		break;
1974 	case PROC_SESSION_READ:
1975 	case PROC_SESSION_WRITE:
1976 #ifndef PROFILE
1977 		/*
1978 		 * The "recvfd" promise is only needed during setup and
1979 		 * will be removed in a later pledge(2) call.
1980 		 */
1981 		if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
1982 		    "unveil", NULL) == -1)
1983 			err(1, "pledge");
1984 #endif
1985 		if (proc_id == PROC_SESSION_READ)
1986 			apply_unveil_repo_readonly(repo_path, 1);
1987 		else
1988 			apply_unveil_repo_readwrite(repo_path);
1989 		session_main(title, repo_path, pack_fds, temp_fds,
1990 		    &gotd.request_timeout, proc_id);
1991 		/* NOTREACHED */
1992 		break;
1993 	case PROC_REPO_READ:
1994 #ifndef PROFILE
1995 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
1996 			err(1, "pledge");
1997 #endif
1998 		apply_unveil_repo_readonly(repo_path, 0);
1999 		repo_read_main(title, repo_path, pack_fds, temp_fds);
2000 		/* NOTREACHED */
2001 		exit(0);
2002 	case PROC_REPO_WRITE:
2003 #ifndef PROFILE
2004 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2005 			err(1, "pledge");
2006 #endif
2007 		apply_unveil_repo_readonly(repo_path, 0);
2008 		repo = gotd_find_repo_by_path(repo_path, &gotd);
2009 		if (repo == NULL)
2010 			fatalx("no repository for path %s", repo_path);
2011 		repo_write_main(title, repo_path, pack_fds, temp_fds,
2012 		    &repo->protected_tag_namespaces,
2013 		    &repo->protected_branch_namespaces,
2014 		    &repo->protected_branches);
2015 		/* NOTREACHED */
2016 		exit(0);
2017 	default:
2018 		fatal("invalid process id %d", proc_id);
2019 	}
2020 
2021 	if (proc_id != PROC_GOTD)
2022 		fatal("invalid process id %d", proc_id);
2023 
2024 	evtimer_set(&gotd.listen_proc->tmo, kill_proc_timeout,
2025 	    gotd.listen_proc);
2026 
2027 	apply_unveil_selfexec();
2028 
2029 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
2030 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
2031 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
2032 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
2033 	signal_set(&evsigchld, SIGCHLD, gotd_sighdlr, NULL);
2034 	signal(SIGPIPE, SIG_IGN);
2035 
2036 	signal_add(&evsigint, NULL);
2037 	signal_add(&evsigterm, NULL);
2038 	signal_add(&evsighup, NULL);
2039 	signal_add(&evsigusr1, NULL);
2040 	signal_add(&evsigchld, NULL);
2041 
2042 	gotd_imsg_event_add(&gotd.listen_proc->iev);
2043 
2044 	event_dispatch();
2045 
2046 	free(repo_path);
2047 	gotd_shutdown();
2048 
2049 	return 0;
2050 }