Gotweb

Blob

Date:: Tue Jan 10 12:02:48 2023 UTC
Message:: add a gotd session process, split off from the parent process The new session process is able to manipulate files in the repository and keeps track of the read/write client session state. The parent process now restricts its view of the filesystem to the absolute path stored in argv[0], and combines this with unveil "x" on this path. As a result the parent process can only re-exec itself. small tweaks + ok op@
Actions:: History | Blame | Raw File
1 /*
2  * Copyright (c) 2022 Stefan Sperling <stsp@openbsd.org>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <sys/queue.h>
18 #include <sys/tree.h>
19 #include <sys/time.h>
20 #include <sys/types.h>
21 #include <sys/stat.h>
22 #include <sys/socket.h>
23 #include <sys/un.h>
24 #include <sys/wait.h>
25 
26 #include <fcntl.h>
27 #include <err.h>
28 #include <errno.h>
29 #include <event.h>
30 #include <limits.h>
31 #include <pwd.h>
32 #include <imsg.h>
33 #include <sha1.h>
34 #include <signal.h>
35 #include <siphash.h>
36 #include <stdarg.h>
37 #include <stdio.h>
38 #include <stdlib.h>
39 #include <string.h>
40 #include <syslog.h>
41 #include <unistd.h>
42 
43 #include "got_error.h"
44 #include "got_opentemp.h"
45 #include "got_path.h"
46 #include "got_repository.h"
47 #include "got_object.h"
48 #include "got_reference.h"
49 
50 #include "got_lib_delta.h"
51 #include "got_lib_object.h"
52 #include "got_lib_object_cache.h"
53 #include "got_lib_sha1.h"
54 #include "got_lib_gitproto.h"
55 #include "got_lib_pack.h"
56 #include "got_lib_repository.h"
57 
58 #include "gotd.h"
59 #include "log.h"
60 #include "listen.h"
61 #include "auth.h"
62 #include "session.h"
63 #include "repo_read.h"
64 #include "repo_write.h"
65 
66 #ifndef nitems
67 #define nitems(_a)	(sizeof((_a)) / sizeof((_a)[0]))
68 #endif
69 
70 struct gotd_client {
71 	STAILQ_ENTRY(gotd_client)	 entry;
72 	enum gotd_client_state		 state;
73 	struct gotd_client_capability	*capabilities;
74 	size_t				 ncapa_alloc;
75 	size_t				 ncapabilities;
76 	uint32_t			 id;
77 	int				 fd;
78 	int				 delta_cache_fd;
79 	struct gotd_imsgev		 iev;
80 	struct event			 tmo;
81 	uid_t				 euid;
82 	gid_t				 egid;
83 	struct gotd_child_proc		*repo_read;
84 	struct gotd_child_proc		*repo_write;
85 	struct gotd_child_proc		*auth;
86 	struct gotd_child_proc		*session;
87 	int				 required_auth;
88 	char				*packfile_path;
89 	char				*packidx_path;
90 };
91 STAILQ_HEAD(gotd_clients, gotd_client);
92 
93 static struct gotd_clients gotd_clients[GOTD_CLIENT_TABLE_SIZE];
94 static SIPHASH_KEY clients_hash_key;
95 volatile int client_cnt;
96 static struct timeval auth_timeout = { 5, 0 };
97 static struct gotd gotd;
98 
99 void gotd_sighdlr(int sig, short event, void *arg);
100 static void gotd_shutdown(void);
101 static const struct got_error *start_session_child(struct gotd_client *,
102     struct gotd_repo *, char *, const char *, int, int);
103 static const struct got_error *start_repo_child(struct gotd_client *,
104     enum gotd_procid, struct gotd_repo *, char *, const char *, int, int);
105 static const struct got_error *start_auth_child(struct gotd_client *, int,
106     struct gotd_repo *, char *, const char *, int, int);
107 static void kill_proc(struct gotd_child_proc *, int);
108 
109 __dead static void
110 usage()
111 {
112 	fprintf(stderr, "usage: %s [-dv] [-f config-file]\n", getprogname());
113 	exit(1);
114 }
115 
116 static int
117 unix_socket_listen(const char *unix_socket_path, uid_t uid, gid_t gid)
118 {
119 	struct sockaddr_un sun;
120 	int fd = -1;
121 	mode_t old_umask, mode;
122 
123 	fd = socket(AF_UNIX, SOCK_STREAM | SOCK_NONBLOCK| SOCK_CLOEXEC, 0);
124 	if (fd == -1) {
125 		log_warn("socket");
126 		return -1;
127 	}
128 
129 	sun.sun_family = AF_UNIX;
130 	if (strlcpy(sun.sun_path, unix_socket_path,
131 	    sizeof(sun.sun_path)) >= sizeof(sun.sun_path)) {
132 		log_warnx("%s: name too long", unix_socket_path);
133 		close(fd);
134 		return -1;
135 	}
136 
137 	if (unlink(unix_socket_path) == -1) {
138 		if (errno != ENOENT) {
139 			log_warn("unlink %s", unix_socket_path);
140 			close(fd);
141 			return -1;
142 		}
143 	}
144 
145 	old_umask = umask(S_IXUSR|S_IXGRP|S_IWOTH|S_IROTH|S_IXOTH);
146 	mode = S_IRUSR|S_IWUSR|S_IRGRP|S_IWGRP|S_IROTH|S_IWOTH;
147 
148 	if (bind(fd, (struct sockaddr *)&sun, sizeof(sun)) == -1) {
149 		log_warn("bind: %s", unix_socket_path);
150 		close(fd);
151 		umask(old_umask);
152 		return -1;
153 	}
154 
155 	umask(old_umask);
156 
157 	if (chmod(unix_socket_path, mode) == -1) {
158 		log_warn("chmod %o %s", mode, unix_socket_path);
159 		close(fd);
160 		unlink(unix_socket_path);
161 		return -1;
162 	}
163 
164 	if (chown(unix_socket_path, uid, gid) == -1) {
165 		log_warn("chown %s uid=%d gid=%d", unix_socket_path, uid, gid);
166 		close(fd);
167 		unlink(unix_socket_path);
168 		return -1;
169 	}
170 
171 	if (listen(fd, GOTD_UNIX_SOCKET_BACKLOG) == -1) {
172 		log_warn("listen");
173 		close(fd);
174 		unlink(unix_socket_path);
175 		return -1;
176 	}
177 
178 	return fd;
179 }
180 
181 static uint64_t
182 client_hash(uint32_t client_id)
183 {
184 	return SipHash24(&clients_hash_key, &client_id, sizeof(client_id));
185 }
186 
187 static void
188 add_client(struct gotd_client *client)
189 {
190 	uint64_t slot = client_hash(client->id) % nitems(gotd_clients);
191 	STAILQ_INSERT_HEAD(&gotd_clients[slot], client, entry);
192 	client_cnt++;
193 }
194 
195 static struct gotd_client *
196 find_client(uint32_t client_id)
197 {
198 	uint64_t slot;
199 	struct gotd_client *c;
200 
201 	slot = client_hash(client_id) % nitems(gotd_clients);
202 	STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
203 		if (c->id == client_id)
204 			return c;
205 	}
206 
207 	return NULL;
208 }
209 
210 static struct gotd_child_proc *
211 get_client_repo_proc(struct gotd_client *client)
212 {
213 	if (client->repo_read && client->repo_write) {
214 		fatalx("uid %d is reading and writing in the same session",
215 		    client->euid);
216 		/* NOTREACHED */
217 	}
218 
219 	if (client->repo_read)
220 		return client->repo_read;
221 	else if (client->repo_write)
222 		return client->repo_write;
223 
224 	return NULL;
225 }
226 
227 static struct gotd_client *
228 find_client_by_proc_fd(int fd)
229 {
230 	uint64_t slot;
231 
232 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
233 		struct gotd_client *c;
234 
235 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
236 			struct gotd_child_proc *proc = get_client_repo_proc(c);
237 			if (proc && proc->iev.ibuf.fd == fd)
238 				return c;
239 			if (c->auth && c->auth->iev.ibuf.fd == fd)
240 				return c;
241 			if (c->session && c->session->iev.ibuf.fd == fd)
242 				return c;
243 		}
244 	}
245 
246 	return NULL;
247 }
248 
249 static int
250 client_is_reading(struct gotd_client *client)
251 {
252 	return client->repo_read != NULL;
253 }
254 
255 static int
256 client_is_writing(struct gotd_client *client)
257 {
258 	return client->repo_write != NULL;
259 }
260 
261 static const struct got_error *
262 ensure_client_is_not_writing(struct gotd_client *client)
263 {
264 	if (client_is_writing(client)) {
265 		return got_error_fmt(GOT_ERR_BAD_PACKET,
266 		    "uid %d made a read-request but is writing to "
267 		    "a repository", client->euid);
268 	}
269 
270 	return NULL;
271 }
272 
273 static const struct got_error *
274 ensure_client_is_not_reading(struct gotd_client *client)
275 {
276 	if (client_is_reading(client)) {
277 		return got_error_fmt(GOT_ERR_BAD_PACKET,
278 		    "uid %d made a write-request but is reading from "
279 		    "a repository", client->euid);
280 	}
281 
282 	return NULL;
283 }
284 
285 static void
286 wait_for_child(pid_t child_pid)
287 {
288 	pid_t pid;
289 	int status;
290 
291 	log_debug("waiting for child PID %ld to terminate",
292 	    (long)child_pid);
293 
294 	do {
295 		pid = waitpid(child_pid, &status, WNOHANG);
296 		if (pid == -1) {
297 			if (errno != EINTR && errno != ECHILD)
298 				fatal("wait");
299 		} else if (WIFSIGNALED(status)) {
300 			log_warnx("child PID %ld terminated; signal %d",
301 			    (long)pid, WTERMSIG(status));
302 		}
303 	} while (pid != -1 || (pid == -1 && errno == EINTR));
304 }
305 
306 static void
307 proc_done(struct gotd_child_proc *proc)
308 {
309 	event_del(&proc->iev.ev);
310 	msgbuf_clear(&proc->iev.ibuf.w);
311 	close(proc->iev.ibuf.fd);
312 	kill_proc(proc, 0);
313 	wait_for_child(proc->pid);
314 	free(proc);
315 }
316 
317 static void
318 kill_auth_proc(struct gotd_client *client)
319 {
320 	struct gotd_child_proc *proc;
321 
322 	if (client->auth == NULL)
323 		return;
324 
325 	proc = client->auth;
326 	client->auth = NULL;
327 
328 	proc_done(proc);
329 }
330 
331 static void
332 kill_session_proc(struct gotd_client *client)
333 {
334 	struct gotd_child_proc *proc;
335 
336 	if (client->session == NULL)
337 		return;
338 
339 	proc = client->session;
340 	client->session = NULL;
341 
342 	proc_done(proc);
343 }
344 
345 static void
346 disconnect(struct gotd_client *client)
347 {
348 	struct gotd_imsg_disconnect idisconnect;
349 	struct gotd_child_proc *proc = get_client_repo_proc(client);
350 	struct gotd_child_proc *listen_proc = &gotd.listen_proc;
351 	uint64_t slot;
352 
353 	log_debug("uid %d: disconnecting", client->euid);
354 
355 	kill_auth_proc(client);
356 	kill_session_proc(client);
357 
358 	idisconnect.client_id = client->id;
359 	if (proc) {
360 		if (gotd_imsg_compose_event(&proc->iev,
361 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
362 		    &idisconnect, sizeof(idisconnect)) == -1)
363 			log_warn("imsg compose DISCONNECT");
364 
365 		msgbuf_clear(&proc->iev.ibuf.w);
366 		close(proc->iev.ibuf.fd);
367 		kill_proc(proc, 0);
368 		wait_for_child(proc->pid);
369 		free(proc);
370 		proc = NULL;
371 	}
372 
373 	if (gotd_imsg_compose_event(&listen_proc->iev,
374 	    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
375 	    &idisconnect, sizeof(idisconnect)) == -1)
376 		log_warn("imsg compose DISCONNECT");
377 
378 	slot = client_hash(client->id) % nitems(gotd_clients);
379 	STAILQ_REMOVE(&gotd_clients[slot], client, gotd_client, entry);
380 	imsg_clear(&client->iev.ibuf);
381 	event_del(&client->iev.ev);
382 	evtimer_del(&client->tmo);
383 	if (client->fd != -1)
384 		close(client->fd);
385 	else if (client->iev.ibuf.fd != -1)
386 		close(client->iev.ibuf.fd);
387 	if (client->delta_cache_fd != -1)
388 		close(client->delta_cache_fd);
389 	if (client->packfile_path) {
390 		if (unlink(client->packfile_path) == -1 && errno != ENOENT)
391 			log_warn("unlink %s: ", client->packfile_path);
392 		free(client->packfile_path);
393 	}
394 	if (client->packidx_path) {
395 		if (unlink(client->packidx_path) == -1 && errno != ENOENT)
396 			log_warn("unlink %s: ", client->packidx_path);
397 		free(client->packidx_path);
398 	}
399 	free(client->capabilities);
400 	free(client);
401 	client_cnt--;
402 }
403 
404 static void
405 disconnect_on_error(struct gotd_client *client, const struct got_error *err)
406 {
407 	struct imsgbuf ibuf;
408 
409 	log_warnx("uid %d: %s", client->euid, err->msg);
410 	if (err->code != GOT_ERR_EOF && client->fd != -1) {
411 		imsg_init(&ibuf, client->fd);
412 		gotd_imsg_send_error(&ibuf, 0, PROC_GOTD, err);
413 		imsg_clear(&ibuf);
414 	}
415 	disconnect(client);
416 }
417 
418 static const struct got_error *
419 send_repo_info(struct gotd_imsgev *iev, struct gotd_repo *repo)
420 {
421 	const struct got_error *err = NULL;
422 	struct gotd_imsg_info_repo irepo;
423 
424 	memset(&irepo, 0, sizeof(irepo));
425 
426 	if (strlcpy(irepo.repo_name, repo->name, sizeof(irepo.repo_name))
427 	    >= sizeof(irepo.repo_name))
428 		return got_error_msg(GOT_ERR_NO_SPACE, "repo name too long");
429 	if (strlcpy(irepo.repo_path, repo->path, sizeof(irepo.repo_path))
430 	    >= sizeof(irepo.repo_path))
431 		return got_error_msg(GOT_ERR_NO_SPACE, "repo path too long");
432 
433 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_REPO, PROC_GOTD, -1,
434 	    &irepo, sizeof(irepo)) == -1) {
435 		err = got_error_from_errno("imsg compose INFO_REPO");
436 		if (err)
437 			return err;
438 	}
439 
440 	return NULL;
441 }
442 
443 static const struct got_error *
444 send_capability(struct gotd_client_capability *capa, struct gotd_imsgev* iev)
445 {
446 	const struct got_error *err = NULL;
447 	struct gotd_imsg_capability icapa;
448 	size_t len;
449 	struct ibuf *wbuf;
450 
451 	memset(&icapa, 0, sizeof(icapa));
452 
453 	icapa.key_len = strlen(capa->key);
454 	len = sizeof(icapa) + icapa.key_len;
455 	if (capa->value) {
456 		icapa.value_len = strlen(capa->value);
457 		len += icapa.value_len;
458 	}
459 
460 	wbuf = imsg_create(&iev->ibuf, GOTD_IMSG_CAPABILITY, 0, 0, len);
461 	if (wbuf == NULL) {
462 		err = got_error_from_errno("imsg_create CAPABILITY");
463 		return err;
464 	}
465 
466 	if (imsg_add(wbuf, &icapa, sizeof(icapa)) == -1)
467 		return got_error_from_errno("imsg_add CAPABILITY");
468 	if (imsg_add(wbuf, capa->key, icapa.key_len) == -1)
469 		return got_error_from_errno("imsg_add CAPABILITY");
470 	if (capa->value) {
471 		if (imsg_add(wbuf, capa->value, icapa.value_len) == -1)
472 			return got_error_from_errno("imsg_add CAPABILITY");
473 	}
474 
475 	wbuf->fd = -1;
476 	imsg_close(&iev->ibuf, wbuf);
477 
478 	gotd_imsg_event_add(iev);
479 
480 	return NULL;
481 }
482 
483 static const struct got_error *
484 send_client_info(struct gotd_imsgev *iev, struct gotd_client *client)
485 {
486 	const struct got_error *err = NULL;
487 	struct gotd_imsg_info_client iclient;
488 	struct gotd_child_proc *proc;
489 	size_t i;
490 
491 	memset(&iclient, 0, sizeof(iclient));
492 	iclient.euid = client->euid;
493 	iclient.egid = client->egid;
494 
495 	proc = get_client_repo_proc(client);
496 	if (proc) {
497 		if (strlcpy(iclient.repo_name, proc->repo_path,
498 		    sizeof(iclient.repo_name)) >= sizeof(iclient.repo_name)) {
499 			return got_error_msg(GOT_ERR_NO_SPACE,
500 			    "repo name too long");
501 		}
502 		if (client_is_writing(client))
503 			iclient.is_writing = 1;
504 
505 		iclient.repo_child_pid = proc->pid;
506 	}
507 
508 	iclient.state = client->state;
509 	if (client->session)
510 		iclient.session_child_pid = client->session->pid;
511 	iclient.ncapabilities = client->ncapabilities;
512 
513 	if (gotd_imsg_compose_event(iev, GOTD_IMSG_INFO_CLIENT, PROC_GOTD, -1,
514 	    &iclient, sizeof(iclient)) == -1) {
515 		err = got_error_from_errno("imsg compose INFO_CLIENT");
516 		if (err)
517 			return err;
518 	}
519 
520 	for (i = 0; i < client->ncapabilities; i++) {
521 		struct gotd_client_capability *capa;
522 		capa = &client->capabilities[i];
523 		err = send_capability(capa, iev);
524 		if (err)
525 			return err;
526 	}
527 
528 	return NULL;
529 }
530 
531 static const struct got_error *
532 send_info(struct gotd_client *client)
533 {
534 	const struct got_error *err = NULL;
535 	struct gotd_imsg_info info;
536 	uint64_t slot;
537 	struct gotd_repo *repo;
538 
539 	if (client->euid != 0)
540 		return got_error_set_errno(EPERM, "info");
541 
542 	info.pid = gotd.pid;
543 	info.verbosity = gotd.verbosity;
544 	info.nrepos = gotd.nrepos;
545 	info.nclients = client_cnt - 1;
546 
547 	if (gotd_imsg_compose_event(&client->iev, GOTD_IMSG_INFO, PROC_GOTD, -1,
548 	    &info, sizeof(info)) == -1) {
549 		err = got_error_from_errno("imsg compose INFO");
550 		if (err)
551 			return err;
552 	}
553 
554 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
555 		err = send_repo_info(&client->iev, repo);
556 		if (err)
557 			return err;
558 	}
559 
560 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
561 		struct gotd_client *c;
562 		STAILQ_FOREACH(c, &gotd_clients[slot], entry) {
563 			if (c->id == client->id)
564 				continue;
565 			err = send_client_info(&client->iev, c);
566 			if (err)
567 				return err;
568 		}
569 	}
570 
571 	return NULL;
572 }
573 
574 static const struct got_error *
575 stop_gotd(struct gotd_client *client)
576 {
577 
578 	if (client->euid != 0)
579 		return got_error_set_errno(EPERM, "stop");
580 
581 	gotd_shutdown();
582 	/* NOTREACHED */
583 	return NULL;
584 }
585 
586 static struct gotd_repo *
587 find_repo_by_name(const char *repo_name)
588 {
589 	struct gotd_repo *repo;
590 	size_t namelen;
591 
592 	TAILQ_FOREACH(repo, &gotd.repos, entry) {
593 		namelen = strlen(repo->name);
594 		if (strncmp(repo->name, repo_name, namelen) != 0)
595 			continue;
596 		if (repo_name[namelen] == '\0' ||
597 		    strcmp(&repo_name[namelen], ".git") == 0)
598 			return repo;
599 	}
600 
601 	return NULL;
602 }
603 
604 static const struct got_error *
605 start_client_authentication(struct gotd_client *client, struct imsg *imsg)
606 {
607 	const struct got_error *err;
608 	struct gotd_imsg_list_refs ireq;
609 	struct gotd_repo *repo = NULL;
610 	size_t datalen;
611 
612 	log_debug("list-refs request from uid %d", client->euid);
613 
614 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
615 		return got_error_msg(GOT_ERR_BAD_REQUEST,
616 		    "unexpected list-refs request received");
617 
618 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
619 	if (datalen != sizeof(ireq))
620 		return got_error(GOT_ERR_PRIVSEP_LEN);
621 
622 	memcpy(&ireq, imsg->data, datalen);
623 
624 	if (ireq.client_is_reading) {
625 		err = ensure_client_is_not_writing(client);
626 		if (err)
627 			return err;
628 		repo = find_repo_by_name(ireq.repo_name);
629 		if (repo == NULL)
630 			return got_error(GOT_ERR_NOT_GIT_REPO);
631 		err = start_auth_child(client, GOTD_AUTH_READ, repo,
632 		    gotd.argv0, gotd.confpath, gotd.daemonize,
633 		    gotd.verbosity);
634 		if (err)
635 			return err;
636 	} else {
637 		err = ensure_client_is_not_reading(client);
638 		if (err)
639 			return err;
640 		repo = find_repo_by_name(ireq.repo_name);
641 		if (repo == NULL)
642 			return got_error(GOT_ERR_NOT_GIT_REPO);
643 		err = start_auth_child(client,
644 		    GOTD_AUTH_READ | GOTD_AUTH_WRITE,
645 		    repo, gotd.argv0, gotd.confpath, gotd.daemonize,
646 		    gotd.verbosity);
647 		if (err)
648 			return err;
649 	}
650 
651 	evtimer_add(&client->tmo, &auth_timeout);
652 
653 	/* Flow continues upon authentication successs/failure or timeout. */
654 	return NULL;
655 }
656 
657 static void
658 gotd_request(int fd, short events, void *arg)
659 {
660 	struct gotd_imsgev *iev = arg;
661 	struct imsgbuf *ibuf = &iev->ibuf;
662 	struct gotd_client *client = iev->handler_arg;
663 	const struct got_error *err = NULL;
664 	struct imsg imsg;
665 	ssize_t n;
666 
667 	if (events & EV_WRITE) {
668 		while (ibuf->w.queued) {
669 			n = msgbuf_write(&ibuf->w);
670 			if (n == -1 && errno == EPIPE) {
671 				/*
672 				 * The client has closed its socket.
673 				 * This can happen when Git clients are
674 				 * done sending pack file data.
675 				 */
676 				msgbuf_clear(&ibuf->w);
677 				continue;
678 			} else if (n == -1 && errno != EAGAIN) {
679 				err = got_error_from_errno("imsg_flush");
680 				disconnect_on_error(client, err);
681 				return;
682 			}
683 			if (n == 0) {
684 				/* Connection closed. */
685 				err = got_error(GOT_ERR_EOF);
686 				disconnect_on_error(client, err);
687 				return;
688 			}
689 		}
690 
691 		/* Disconnect gotctl(8) now that messages have been sent. */
692 		if (!client_is_reading(client) && !client_is_writing(client)) {
693 			disconnect(client);
694 			return;
695 		}
696 	}
697 
698 	if ((events & EV_READ) == 0)
699 		return;
700 
701 	memset(&imsg, 0, sizeof(imsg));
702 
703 	while (err == NULL) {
704 		err = gotd_imsg_recv(&imsg, ibuf, 0);
705 		if (err) {
706 			if (err->code == GOT_ERR_PRIVSEP_READ)
707 				err = NULL;
708 			break;
709 		}
710 
711 		evtimer_del(&client->tmo);
712 
713 		switch (imsg.hdr.type) {
714 		case GOTD_IMSG_INFO:
715 			err = send_info(client);
716 			break;
717 		case GOTD_IMSG_STOP:
718 			err = stop_gotd(client);
719 			break;
720 		case GOTD_IMSG_LIST_REFS:
721 			err = start_client_authentication(client, &imsg);
722 			break;
723 		default:
724 			log_debug("unexpected imsg %d", imsg.hdr.type);
725 			err = got_error(GOT_ERR_PRIVSEP_MSG);
726 			break;
727 		}
728 
729 		imsg_free(&imsg);
730 	}
731 
732 	if (err) {
733 		if (err->code != GOT_ERR_EOF ||
734 		    client->state != GOTD_STATE_EXPECT_PACKFILE)
735 			disconnect_on_error(client, err);
736 	} else {
737 		gotd_imsg_event_add(&client->iev);
738 	}
739 }
740 
741 static void
742 gotd_auth_timeout(int fd, short events, void *arg)
743 {
744 	struct gotd_client *client = arg;
745 
746 	log_debug("disconnecting uid %d due to authentication timeout",
747 	    client->euid);
748 	disconnect(client);
749 }
750 
751 static const struct got_error *
752 recv_connect(uint32_t *client_id, struct imsg *imsg)
753 {
754 	const struct got_error *err = NULL;
755 	struct gotd_imsg_connect iconnect;
756 	size_t datalen;
757 	int s = -1;
758 	struct gotd_client *client = NULL;
759 
760 	*client_id = 0;
761 
762 	datalen = imsg->hdr.len - IMSG_HEADER_SIZE;
763 	if (datalen != sizeof(iconnect))
764 		return got_error(GOT_ERR_PRIVSEP_LEN);
765 	memcpy(&iconnect, imsg->data, sizeof(iconnect));
766 
767 	s = imsg->fd;
768 	if (s == -1) {
769 		err = got_error(GOT_ERR_PRIVSEP_NO_FD);
770 		goto done;
771 	}
772 
773 	if (find_client(iconnect.client_id)) {
774 		err = got_error_msg(GOT_ERR_CLIENT_ID, "duplicate client ID");
775 		goto done;
776 	}
777 
778 	client = calloc(1, sizeof(*client));
779 	if (client == NULL) {
780 		err = got_error_from_errno("calloc");
781 		goto done;
782 	}
783 
784 	*client_id = iconnect.client_id;
785 
786 	client->state = GOTD_STATE_EXPECT_LIST_REFS;
787 	client->id = iconnect.client_id;
788 	client->fd = s;
789 	s = -1;
790 	client->delta_cache_fd = -1;
791 	/* The auth process will verify UID/GID for us. */
792 	client->euid = iconnect.euid;
793 	client->egid = iconnect.egid;
794 
795 	imsg_init(&client->iev.ibuf, client->fd);
796 	client->iev.handler = gotd_request;
797 	client->iev.events = EV_READ;
798 	client->iev.handler_arg = client;
799 
800 	event_set(&client->iev.ev, client->fd, EV_READ, gotd_request,
801 	    &client->iev);
802 	gotd_imsg_event_add(&client->iev);
803 
804 	evtimer_set(&client->tmo, gotd_auth_timeout, client);
805 
806 	add_client(client);
807 	log_debug("%s: new client uid %d connected on fd %d", __func__,
808 	    client->euid, client->fd);
809 done:
810 	if (err) {
811 		struct gotd_child_proc *listen_proc = &gotd.listen_proc;
812 		struct gotd_imsg_disconnect idisconnect;
813 
814 		idisconnect.client_id = client->id;
815 		if (gotd_imsg_compose_event(&listen_proc->iev,
816 		    GOTD_IMSG_DISCONNECT, PROC_GOTD, -1,
817 		    &idisconnect, sizeof(idisconnect)) == -1)
818 			log_warn("imsg compose DISCONNECT");
819 
820 		if (s != -1)
821 			close(s);
822 	}
823 
824 	return err;
825 }
826 
827 static const char *gotd_proc_names[PROC_MAX] = {
828 	"parent",
829 	"listen",
830 	"auth",
831 	"session",
832 	"repo_read",
833 	"repo_write"
834 };
835 
836 static void
837 kill_proc(struct gotd_child_proc *proc, int fatal)
838 {
839 	if (fatal) {
840 		log_warnx("sending SIGKILL to PID %d", proc->pid);
841 		kill(proc->pid, SIGKILL);
842 	} else
843 		kill(proc->pid, SIGTERM);
844 }
845 
846 static void
847 gotd_shutdown(void)
848 {
849 	struct gotd_child_proc *proc;
850 	uint64_t slot;
851 
852 	log_debug("shutting down");
853 	for (slot = 0; slot < nitems(gotd_clients); slot++) {
854 		struct gotd_client *c, *tmp;
855 
856 		STAILQ_FOREACH_SAFE(c, &gotd_clients[slot], entry, tmp)
857 			disconnect(c);
858 	}
859 
860 	proc = &gotd.listen_proc;
861 	msgbuf_clear(&proc->iev.ibuf.w);
862 	close(proc->iev.ibuf.fd);
863 	kill_proc(proc, 0);
864 	wait_for_child(proc->pid);
865 
866 	log_info("terminating");
867 	exit(0);
868 }
869 
870 void
871 gotd_sighdlr(int sig, short event, void *arg)
872 {
873 	/*
874 	 * Normal signal handler rules don't apply because libevent
875 	 * decouples for us.
876 	 */
877 
878 	switch (sig) {
879 	case SIGHUP:
880 		log_info("%s: ignoring SIGHUP", __func__);
881 		break;
882 	case SIGUSR1:
883 		log_info("%s: ignoring SIGUSR1", __func__);
884 		break;
885 	case SIGTERM:
886 	case SIGINT:
887 		gotd_shutdown();
888 		break;
889 	default:
890 		fatalx("unexpected signal");
891 	}
892 }
893 
894 static const struct got_error *
895 ensure_proc_is_reading(struct gotd_client *client,
896     struct gotd_child_proc *proc)
897 {
898 	if (!client_is_reading(client)) {
899 		kill_proc(proc, 1);
900 		return got_error_fmt(GOT_ERR_BAD_PACKET,
901 		    "PID %d handled a read-request for uid %d but this "
902 		    "user is not reading from a repository", proc->pid,
903 		    client->euid);
904 	}
905 
906 	return NULL;
907 }
908 
909 static const struct got_error *
910 ensure_proc_is_writing(struct gotd_client *client,
911     struct gotd_child_proc *proc)
912 {
913 	if (!client_is_writing(client)) {
914 		kill_proc(proc, 1);
915 		return got_error_fmt(GOT_ERR_BAD_PACKET,
916 		    "PID %d handled a write-request for uid %d but this "
917 		    "user is not writing to a repository", proc->pid,
918 		    client->euid);
919 	}
920 
921 	return NULL;
922 }
923 
924 static int
925 verify_imsg_src(struct gotd_client *client, struct gotd_child_proc *proc,
926     struct imsg *imsg)
927 {
928 	const struct got_error *err;
929 	struct gotd_child_proc *client_proc;
930 	int ret = 0;
931 
932 	if (proc->type == PROC_REPO_READ || proc->type == PROC_REPO_WRITE) {
933 		client_proc = get_client_repo_proc(client);
934 		if (client_proc == NULL)
935 			fatalx("no process found for uid %d", client->euid);
936 		if (proc->pid != client_proc->pid) {
937 			kill_proc(proc, 1);
938 			log_warnx("received message from PID %d for uid %d, "
939 			    "while PID %d is the process serving this user",
940 			    proc->pid, client->euid, client_proc->pid);
941 			return 0;
942 		}
943 	}
944 	if (proc->type == PROC_SESSION) {
945 		if (client->session == NULL) {
946 			log_warnx("no session found for uid %d", client->euid);
947 			return 0;
948 		}
949 		if (proc->pid != client->session->pid) {
950 			kill_proc(proc, 1);
951 			log_warnx("received message from PID %d for uid %d, "
952 			    "while PID %d is the process serving this user",
953 			    proc->pid, client->euid, client->session->pid);
954 			return 0;
955 		}
956 	}
957 
958 	switch (imsg->hdr.type) {
959 	case GOTD_IMSG_ERROR:
960 		ret = 1;
961 		break;
962 	case GOTD_IMSG_CONNECT:
963 		if (proc->type != PROC_LISTEN) {
964 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
965 			    "new connection for uid %d from PID %d "
966 			    "which is not the listen process",
967 			    proc->pid, client->euid);
968 		} else
969 			ret = 1;
970 		break;
971 	case GOTD_IMSG_ACCESS_GRANTED:
972 		if (proc->type != PROC_AUTH) {
973 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
974 			    "authentication of uid %d from PID %d "
975 			    "which is not the auth process",
976 			    proc->pid, client->euid);
977 		} else
978 			ret = 1;
979 		break;
980 	case GOTD_IMSG_CLIENT_SESSION_READY:
981 		if (proc->type != PROC_SESSION) {
982 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
983 			    "unexpected \"ready\" signal from PID %d",
984 			    proc->pid);
985 		} else
986 			ret = 1;
987 		break;
988 	case GOTD_IMSG_REPO_CHILD_READY:
989 		if (proc->type != PROC_REPO_READ &&
990 		    proc->type != PROC_REPO_WRITE) {
991 			err = got_error_fmt(GOT_ERR_BAD_PACKET,
992 			    "unexpected \"ready\" signal from PID %d",
993 			    proc->pid);
994 		} else
995 			ret = 1;
996 		break;
997 	case GOTD_IMSG_PACKFILE_DONE:
998 		err = ensure_proc_is_reading(client, proc);
999 		if (err)
1000 			log_warnx("uid %d: %s", client->euid, err->msg);
1001 		else
1002 			ret = 1;
1003 		break;
1004 	case GOTD_IMSG_PACKFILE_INSTALL:
1005 	case GOTD_IMSG_REF_UPDATES_START:
1006 	case GOTD_IMSG_REF_UPDATE:
1007 		err = ensure_proc_is_writing(client, proc);
1008 		if (err)
1009 			log_warnx("uid %d: %s", client->euid, err->msg);
1010 		else
1011 			ret = 1;
1012 		break;
1013 	default:
1014 		log_debug("%s: unexpected imsg %d", __func__, imsg->hdr.type);
1015 		break;
1016 	}
1017 
1018 	return ret;
1019 }
1020 
1021 static const struct got_error *
1022 connect_repo_child(struct gotd_client *client,
1023     struct gotd_child_proc *repo_proc)
1024 {
1025 	static const struct got_error *err;
1026 	struct gotd_imsgev *session_iev = &client->session->iev;
1027 	struct gotd_imsg_connect_repo_child ireq;
1028 	int pipe[2];
1029 
1030 	if (client->state != GOTD_STATE_EXPECT_LIST_REFS)
1031 		return got_error_msg(GOT_ERR_BAD_REQUEST,
1032 		    "unexpected repo child ready signal received");
1033 
1034 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1035 	    PF_UNSPEC, pipe) == -1)
1036 		fatal("socketpair");
1037 
1038 	memset(&ireq, 0, sizeof(ireq));
1039 	ireq.client_id = client->id;
1040 	ireq.proc_id = repo_proc->type;
1041 
1042 	/* Pass repo child pipe to session child process. */
1043 	if (gotd_imsg_compose_event(session_iev, GOTD_IMSG_CONNECT_REPO_CHILD,
1044 	    PROC_GOTD, pipe[0], &ireq, sizeof(ireq)) == -1) {
1045 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
1046 		close(pipe[0]);
1047 		close(pipe[1]);
1048 		return err;
1049 	}
1050 
1051 	/* Pass session child pipe to repo child process. */
1052 	if (gotd_imsg_compose_event(&repo_proc->iev,
1053 	    GOTD_IMSG_CONNECT_REPO_CHILD, PROC_GOTD, pipe[1], NULL, 0) == -1) {
1054 		err = got_error_from_errno("imsg compose CONNECT_REPO_CHILD");
1055 		close(pipe[1]);
1056 		return err;
1057 	}
1058 
1059 	return NULL;
1060 }
1061 
1062 static void
1063 gotd_dispatch_listener(int fd, short event, void *arg)
1064 {
1065 	struct gotd_imsgev *iev = arg;
1066 	struct imsgbuf *ibuf = &iev->ibuf;
1067 	struct gotd_child_proc *proc = &gotd.listen_proc;
1068 	ssize_t n;
1069 	int shut = 0;
1070 	struct imsg imsg;
1071 
1072 	if (proc->iev.ibuf.fd != fd)
1073 		fatalx("%s: unexpected fd %d", __func__, fd);
1074 
1075 	if (event & EV_READ) {
1076 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1077 			fatal("imsg_read error");
1078 		if (n == 0) {
1079 			/* Connection closed. */
1080 			shut = 1;
1081 			goto done;
1082 		}
1083 	}
1084 
1085 	if (event & EV_WRITE) {
1086 		n = msgbuf_write(&ibuf->w);
1087 		if (n == -1 && errno != EAGAIN)
1088 			fatal("msgbuf_write");
1089 		if (n == 0) {
1090 			/* Connection closed. */
1091 			shut = 1;
1092 			goto done;
1093 		}
1094 	}
1095 
1096 	for (;;) {
1097 		const struct got_error *err = NULL;
1098 		struct gotd_client *client = NULL;
1099 		uint32_t client_id = 0;
1100 		int do_disconnect = 0;
1101 
1102 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1103 			fatal("%s: imsg_get error", __func__);
1104 		if (n == 0)	/* No more messages. */
1105 			break;
1106 
1107 		switch (imsg.hdr.type) {
1108 		case GOTD_IMSG_ERROR:
1109 			do_disconnect = 1;
1110 			err = gotd_imsg_recv_error(&client_id, &imsg);
1111 			break;
1112 		case GOTD_IMSG_CONNECT:
1113 			err = recv_connect(&client_id, &imsg);
1114 			break;
1115 		default:
1116 			log_debug("unexpected imsg %d", imsg.hdr.type);
1117 			break;
1118 		}
1119 
1120 		client = find_client(client_id);
1121 		if (client == NULL) {
1122 			log_warnx("%s: client not found", __func__);
1123 			imsg_free(&imsg);
1124 			continue;
1125 		}
1126 
1127 		if (err)
1128 			log_warnx("uid %d: %s", client->euid, err->msg);
1129 
1130 		if (do_disconnect) {
1131 			if (err)
1132 				disconnect_on_error(client, err);
1133 			else
1134 				disconnect(client);
1135 		}
1136 
1137 		imsg_free(&imsg);
1138 	}
1139 done:
1140 	if (!shut) {
1141 		gotd_imsg_event_add(iev);
1142 	} else {
1143 		/* This pipe is dead. Remove its event handler */
1144 		event_del(&iev->ev);
1145 		event_loopexit(NULL);
1146 	}
1147 }
1148 
1149 static void
1150 gotd_dispatch_auth_child(int fd, short event, void *arg)
1151 {
1152 	const struct got_error *err = NULL;
1153 	struct gotd_imsgev *iev = arg;
1154 	struct imsgbuf *ibuf = &iev->ibuf;
1155 	struct gotd_client *client;
1156 	struct gotd_repo *repo = NULL;
1157 	ssize_t n;
1158 	int shut = 0;
1159 	struct imsg imsg;
1160 	uint32_t client_id = 0;
1161 	int do_disconnect = 0;
1162 
1163 	client = find_client_by_proc_fd(fd);
1164 	if (client == NULL)
1165 		fatalx("cannot find client for fd %d", fd);
1166 
1167 	if (client->auth == NULL)
1168 		fatalx("cannot find auth child process for fd %d", fd);
1169 
1170 	if (event & EV_READ) {
1171 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1172 			fatal("imsg_read error");
1173 		if (n == 0) {
1174 			/* Connection closed. */
1175 			shut = 1;
1176 			goto done;
1177 		}
1178 	}
1179 
1180 	if (event & EV_WRITE) {
1181 		n = msgbuf_write(&ibuf->w);
1182 		if (n == -1 && errno != EAGAIN)
1183 			fatal("msgbuf_write");
1184 		if (n == 0) {
1185 			/* Connection closed. */
1186 			shut = 1;
1187 		}
1188 		goto done;
1189 	}
1190 
1191 	if (client->auth->iev.ibuf.fd != fd)
1192 		fatalx("%s: unexpected fd %d", __func__, fd);
1193 
1194 	if ((n = imsg_get(ibuf, &imsg)) == -1)
1195 		fatal("%s: imsg_get error", __func__);
1196 	if (n == 0)	/* No more messages. */
1197 		return;
1198 
1199 	evtimer_del(&client->tmo);
1200 
1201 	switch (imsg.hdr.type) {
1202 	case GOTD_IMSG_ERROR:
1203 		do_disconnect = 1;
1204 		err = gotd_imsg_recv_error(&client_id, &imsg);
1205 		break;
1206 	case GOTD_IMSG_ACCESS_GRANTED:
1207 		break;
1208 	default:
1209 		do_disconnect = 1;
1210 		log_debug("unexpected imsg %d", imsg.hdr.type);
1211 		break;
1212 	}
1213 
1214 	if (!verify_imsg_src(client, client->auth, &imsg)) {
1215 		do_disconnect = 1;
1216 		log_debug("dropping imsg type %d from PID %d",
1217 		    imsg.hdr.type, client->auth->pid);
1218 	}
1219 	imsg_free(&imsg);
1220 
1221 	if (do_disconnect) {
1222 		if (err)
1223 			disconnect_on_error(client, err);
1224 		else
1225 			disconnect(client);
1226 		goto done;
1227 	}
1228 
1229 	repo = find_repo_by_name(client->auth->repo_name);
1230 	if (repo == NULL) {
1231 		err = got_error(GOT_ERR_NOT_GIT_REPO);
1232 		goto done;
1233 	}
1234 	kill_auth_proc(client);
1235 
1236 	log_info("authenticated uid %d for repository %s\n",
1237 	    client->euid, repo->name);
1238 
1239 	err = start_session_child(client, repo, gotd.argv0,
1240 	    gotd.confpath, gotd.daemonize, gotd.verbosity);
1241 	if (err)
1242 		goto done;
1243 done:
1244 	if (err)
1245 		log_warnx("uid %d: %s", client->euid, err->msg);
1246 
1247 	/* We might have killed the auth process by now. */
1248 	if (client->auth != NULL) {
1249 		if (!shut) {
1250 			gotd_imsg_event_add(iev);
1251 		} else {
1252 			/* This pipe is dead. Remove its event handler */
1253 			event_del(&iev->ev);
1254 		}
1255 	}
1256 }
1257 
1258 static const struct got_error *
1259 connect_session(struct gotd_client *client)
1260 {
1261 	const struct got_error *err = NULL;
1262 	struct gotd_imsg_connect iconnect;
1263 	int s;
1264 
1265 	memset(&iconnect, 0, sizeof(iconnect));
1266 
1267 	s = dup(client->fd);
1268 	if (s == -1)
1269 		return got_error_from_errno("dup");
1270 
1271 	iconnect.client_id = client->id;
1272 	iconnect.euid = client->euid;
1273 	iconnect.egid = client->egid;
1274 
1275 	if (gotd_imsg_compose_event(&client->session->iev, GOTD_IMSG_CONNECT,
1276 	    PROC_GOTD, s, &iconnect, sizeof(iconnect)) == -1) {
1277 		err = got_error_from_errno("imsg compose CONNECT");
1278 		close(s);
1279 		return err;
1280 	}
1281 
1282 	/*
1283 	 * We are no longer interested in messages from this client.
1284 	 * Further client requests will be handled by the session process.
1285 	 */
1286 	msgbuf_clear(&client->iev.ibuf.w);
1287 	imsg_clear(&client->iev.ibuf);
1288 	event_del(&client->iev.ev);
1289 	client->fd = -1; /* will be closed via copy in client->iev.ibuf.fd */
1290 
1291 	return NULL;
1292 }
1293 
1294 static void
1295 gotd_dispatch_client_session(int fd, short event, void *arg)
1296 {
1297 	struct gotd_imsgev *iev = arg;
1298 	struct imsgbuf *ibuf = &iev->ibuf;
1299 	struct gotd_child_proc *proc = NULL;
1300 	struct gotd_client *client = NULL;
1301 	ssize_t n;
1302 	int shut = 0;
1303 	struct imsg imsg;
1304 
1305 	client = find_client_by_proc_fd(fd);
1306 	if (client == NULL)
1307 		fatalx("cannot find client for fd %d", fd);
1308 
1309 	if (event & EV_READ) {
1310 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1311 			fatal("imsg_read error");
1312 		if (n == 0) {
1313 			/* Connection closed. */
1314 			shut = 1;
1315 			goto done;
1316 		}
1317 	}
1318 
1319 	if (event & EV_WRITE) {
1320 		n = msgbuf_write(&ibuf->w);
1321 		if (n == -1 && errno != EAGAIN)
1322 			fatal("msgbuf_write");
1323 		if (n == 0) {
1324 			/* Connection closed. */
1325 			shut = 1;
1326 			goto done;
1327 		}
1328 	}
1329 
1330 	proc = client->session;
1331 	if (proc == NULL)
1332 		fatalx("cannot find session child process for fd %d", fd);
1333 
1334 	for (;;) {
1335 		const struct got_error *err = NULL;
1336 		uint32_t client_id = 0;
1337 		int do_disconnect = 0, do_start_repo_child = 0;
1338 
1339 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1340 			fatal("%s: imsg_get error", __func__);
1341 		if (n == 0)	/* No more messages. */
1342 			break;
1343 
1344 		switch (imsg.hdr.type) {
1345 		case GOTD_IMSG_ERROR:
1346 			do_disconnect = 1;
1347 			err = gotd_imsg_recv_error(&client_id, &imsg);
1348 			break;
1349 		case GOTD_IMSG_CLIENT_SESSION_READY:
1350 			if (client->state != GOTD_STATE_EXPECT_LIST_REFS) {
1351 				err = got_error(GOT_ERR_PRIVSEP_MSG);
1352 				break;
1353 			}
1354 			do_start_repo_child = 1;
1355 			break;
1356 		case GOTD_IMSG_DISCONNECT:
1357 			do_disconnect = 1;
1358 			break;
1359 		default:
1360 			log_debug("unexpected imsg %d", imsg.hdr.type);
1361 			break;
1362 		}
1363 
1364 		if (!verify_imsg_src(client, proc, &imsg)) {
1365 			log_debug("dropping imsg type %d from PID %d",
1366 			    imsg.hdr.type, proc->pid);
1367 			imsg_free(&imsg);
1368 			continue;
1369 		}
1370 		if (err)
1371 			log_warnx("uid %d: %s", client->euid, err->msg);
1372 
1373 		if (do_start_repo_child) {
1374 			struct gotd_repo *repo;
1375 
1376 			repo = find_repo_by_name(client->session->repo_name);
1377 			if (repo != NULL) {
1378 				enum gotd_procid proc_type;
1379 
1380 				if (client->required_auth & GOTD_AUTH_WRITE)
1381 					proc_type = PROC_REPO_WRITE;
1382 				else
1383 					proc_type = PROC_REPO_READ;
1384 
1385 				err = start_repo_child(client, proc_type, repo,
1386 				    gotd.argv0, gotd.confpath, gotd.daemonize,
1387 				    gotd.verbosity);
1388 			} else
1389 				err = got_error(GOT_ERR_NOT_GIT_REPO);
1390 
1391 			if (err) {
1392 				log_warnx("uid %d: %s", client->euid, err->msg);
1393 				do_disconnect = 1;
1394 			}
1395 		}
1396 
1397 		if (do_disconnect) {
1398 			if (err)
1399 				disconnect_on_error(client, err);
1400 			else
1401 				disconnect(client);
1402 		}
1403 
1404 		imsg_free(&imsg);
1405 	}
1406 done:
1407 	if (!shut) {
1408 		gotd_imsg_event_add(iev);
1409 	} else {
1410 		/* This pipe is dead. Remove its event handler */
1411 		event_del(&iev->ev);
1412 		disconnect(client);
1413 	}
1414 }
1415 
1416 static void
1417 gotd_dispatch_repo_child(int fd, short event, void *arg)
1418 {
1419 	struct gotd_imsgev *iev = arg;
1420 	struct imsgbuf *ibuf = &iev->ibuf;
1421 	struct gotd_child_proc *proc = NULL;
1422 	struct gotd_client *client;
1423 	ssize_t n;
1424 	int shut = 0;
1425 	struct imsg imsg;
1426 
1427 	client = find_client_by_proc_fd(fd);
1428 	if (client == NULL)
1429 		fatalx("cannot find client for fd %d", fd);
1430 
1431 	if (event & EV_READ) {
1432 		if ((n = imsg_read(ibuf)) == -1 && errno != EAGAIN)
1433 			fatal("imsg_read error");
1434 		if (n == 0) {
1435 			/* Connection closed. */
1436 			shut = 1;
1437 			goto done;
1438 		}
1439 	}
1440 
1441 	if (event & EV_WRITE) {
1442 		n = msgbuf_write(&ibuf->w);
1443 		if (n == -1 && errno != EAGAIN)
1444 			fatal("msgbuf_write");
1445 		if (n == 0) {
1446 			/* Connection closed. */
1447 			shut = 1;
1448 			goto done;
1449 		}
1450 	}
1451 
1452 	proc = get_client_repo_proc(client);
1453 	if (proc == NULL)
1454 		fatalx("cannot find child process for fd %d", fd);
1455 
1456 	for (;;) {
1457 		const struct got_error *err = NULL;
1458 		uint32_t client_id = 0;
1459 		int do_disconnect = 0;
1460 
1461 		if ((n = imsg_get(ibuf, &imsg)) == -1)
1462 			fatal("%s: imsg_get error", __func__);
1463 		if (n == 0)	/* No more messages. */
1464 			break;
1465 
1466 		switch (imsg.hdr.type) {
1467 		case GOTD_IMSG_ERROR:
1468 			do_disconnect = 1;
1469 			err = gotd_imsg_recv_error(&client_id, &imsg);
1470 			break;
1471 		case GOTD_IMSG_REPO_CHILD_READY:
1472 			err = connect_session(client);
1473 			if (err)
1474 				break;
1475 			err = connect_repo_child(client, proc);
1476 			break;
1477 		default:
1478 			log_debug("unexpected imsg %d", imsg.hdr.type);
1479 			break;
1480 		}
1481 
1482 		if (!verify_imsg_src(client, proc, &imsg)) {
1483 			log_debug("dropping imsg type %d from PID %d",
1484 			    imsg.hdr.type, proc->pid);
1485 			imsg_free(&imsg);
1486 			continue;
1487 		}
1488 		if (err)
1489 			log_warnx("uid %d: %s", client->euid, err->msg);
1490 
1491 		if (do_disconnect) {
1492 			if (err)
1493 				disconnect_on_error(client, err);
1494 			else
1495 				disconnect(client);
1496 		}
1497 
1498 		imsg_free(&imsg);
1499 	}
1500 done:
1501 	if (!shut) {
1502 		gotd_imsg_event_add(iev);
1503 	} else {
1504 		/* This pipe is dead. Remove its event handler */
1505 		event_del(&iev->ev);
1506 		disconnect(client);
1507 	}
1508 }
1509 
1510 static pid_t
1511 start_child(enum gotd_procid proc_id, const char *repo_path,
1512     char *argv0, const char *confpath, int fd, int daemonize, int verbosity)
1513 {
1514 	char	*argv[11];
1515 	int	 argc = 0;
1516 	pid_t	 pid;
1517 
1518 	switch (pid = fork()) {
1519 	case -1:
1520 		fatal("cannot fork");
1521 	case 0:
1522 		break;
1523 	default:
1524 		close(fd);
1525 		return pid;
1526 	}
1527 
1528 	if (fd != GOTD_FILENO_MSG_PIPE) {
1529 		if (dup2(fd, GOTD_FILENO_MSG_PIPE) == -1)
1530 			fatal("cannot setup imsg fd");
1531 	} else if (fcntl(fd, F_SETFD, 0) == -1)
1532 		fatal("cannot setup imsg fd");
1533 
1534 	argv[argc++] = argv0;
1535 	switch (proc_id) {
1536 	case PROC_LISTEN:
1537 		argv[argc++] = (char *)"-L";
1538 		break;
1539 	case PROC_AUTH:
1540 		argv[argc++] = (char *)"-A";
1541 		break;
1542 	case PROC_SESSION:
1543 		argv[argc++] = (char *)"-S";
1544 		break;
1545 	case PROC_REPO_READ:
1546 		argv[argc++] = (char *)"-R";
1547 		break;
1548 	case PROC_REPO_WRITE:
1549 		argv[argc++] = (char *)"-W";
1550 		break;
1551 	default:
1552 		fatalx("invalid process id %d", proc_id);
1553 	}
1554 
1555 	argv[argc++] = (char *)"-f";
1556 	argv[argc++] = (char *)confpath;
1557 
1558 	if (repo_path) {
1559 		argv[argc++] = (char *)"-P";
1560 		argv[argc++] = (char *)repo_path;
1561 	}
1562 
1563 	if (!daemonize)
1564 		argv[argc++] = (char *)"-d";
1565 	if (verbosity > 0)
1566 		argv[argc++] = (char *)"-v";
1567 	if (verbosity > 1)
1568 		argv[argc++] = (char *)"-v";
1569 	argv[argc++] = NULL;
1570 
1571 	execvp(argv0, argv);
1572 	fatal("execvp");
1573 }
1574 
1575 static void
1576 start_listener(char *argv0, const char *confpath, int daemonize, int verbosity)
1577 {
1578 	struct gotd_child_proc *proc = &gotd.listen_proc;
1579 
1580 	proc->type = PROC_LISTEN;
1581 
1582 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1583 	    PF_UNSPEC, proc->pipe) == -1)
1584 		fatal("socketpair");
1585 
1586 	proc->pid = start_child(proc->type, NULL, argv0, confpath,
1587 	    proc->pipe[1], daemonize, verbosity);
1588 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1589 	proc->iev.handler = gotd_dispatch_listener;
1590 	proc->iev.events = EV_READ;
1591 	proc->iev.handler_arg = NULL;
1592 }
1593 
1594 static const struct got_error *
1595 start_session_child(struct gotd_client *client, struct gotd_repo *repo,
1596     char *argv0, const char *confpath, int daemonize, int verbosity)
1597 {
1598 	struct gotd_child_proc *proc;
1599 
1600 	proc = calloc(1, sizeof(*proc));
1601 	if (proc == NULL)
1602 		return got_error_from_errno("calloc");
1603 
1604 	proc->type = PROC_SESSION;
1605 	if (strlcpy(proc->repo_name, repo->name,
1606 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1607 		fatalx("repository name too long: %s", repo->name);
1608 	log_debug("starting client uid %d session for repository %s",
1609 	    client->euid, repo->name);
1610 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1611 	    sizeof(proc->repo_path))
1612 		fatalx("repository path too long: %s", repo->path);
1613 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1614 	    PF_UNSPEC, proc->pipe) == -1)
1615 		fatal("socketpair");
1616 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1617 	    confpath, proc->pipe[1], daemonize, verbosity);
1618 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1619 	log_debug("proc %s %s is on fd %d",
1620 	    gotd_proc_names[proc->type], proc->repo_path,
1621 	    proc->pipe[0]);
1622 	proc->iev.handler = gotd_dispatch_client_session;
1623 	proc->iev.events = EV_READ;
1624 	proc->iev.handler_arg = NULL;
1625 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1626 	    gotd_dispatch_client_session, &proc->iev);
1627 	gotd_imsg_event_add(&proc->iev);
1628 
1629 	client->session = proc;
1630 	return NULL;
1631 }
1632 
1633 static const struct got_error *
1634 start_repo_child(struct gotd_client *client, enum gotd_procid proc_type,
1635     struct gotd_repo *repo, char *argv0, const char *confpath,
1636     int daemonize, int verbosity)
1637 {
1638 	struct gotd_child_proc *proc;
1639 
1640 	if (proc_type != PROC_REPO_READ && proc_type != PROC_REPO_WRITE)
1641 		return got_error_msg(GOT_ERR_NOT_IMPL, "bad process type");
1642 
1643 	proc = calloc(1, sizeof(*proc));
1644 	if (proc == NULL)
1645 		return got_error_from_errno("calloc");
1646 
1647 	proc->type = proc_type;
1648 	if (strlcpy(proc->repo_name, repo->name,
1649 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1650 		fatalx("repository name too long: %s", repo->name);
1651 	log_debug("starting %s for repository %s",
1652 	    proc->type == PROC_REPO_READ ? "reader" : "writer", repo->name);
1653 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1654 	    sizeof(proc->repo_path))
1655 		fatalx("repository path too long: %s", repo->path);
1656 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1657 	    PF_UNSPEC, proc->pipe) == -1)
1658 		fatal("socketpair");
1659 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1660 	    confpath, proc->pipe[1], daemonize, verbosity);
1661 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1662 	log_debug("proc %s %s is on fd %d",
1663 	    gotd_proc_names[proc->type], proc->repo_path,
1664 	    proc->pipe[0]);
1665 	proc->iev.handler = gotd_dispatch_repo_child;
1666 	proc->iev.events = EV_READ;
1667 	proc->iev.handler_arg = NULL;
1668 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1669 	    gotd_dispatch_repo_child, &proc->iev);
1670 	gotd_imsg_event_add(&proc->iev);
1671 
1672 	if (proc->type == PROC_REPO_READ)
1673 		client->repo_read = proc;
1674 	else
1675 		client->repo_write = proc;
1676 
1677 	return NULL;
1678 }
1679 
1680 static const struct got_error *
1681 start_auth_child(struct gotd_client *client, int required_auth,
1682     struct gotd_repo *repo, char *argv0, const char *confpath,
1683     int daemonize, int verbosity)
1684 {
1685 	const struct got_error *err = NULL;
1686 	struct gotd_child_proc *proc;
1687 	struct gotd_imsg_auth iauth;
1688 	int fd;
1689 
1690 	memset(&iauth, 0, sizeof(iauth));
1691 
1692 	fd = dup(client->fd);
1693 	if (fd == -1)
1694 		return got_error_from_errno("dup");
1695 
1696 	proc = calloc(1, sizeof(*proc));
1697 	if (proc == NULL) {
1698 		err = got_error_from_errno("calloc");
1699 		close(fd);
1700 		return err;
1701 	}
1702 
1703 	proc->type = PROC_AUTH;
1704 	if (strlcpy(proc->repo_name, repo->name,
1705 	    sizeof(proc->repo_name)) >= sizeof(proc->repo_name))
1706 		fatalx("repository name too long: %s", repo->name);
1707 	log_debug("starting auth for uid %d repository %s",
1708 	    client->euid, repo->name);
1709 	if (strlcpy(proc->repo_path, repo->path, sizeof(proc->repo_path)) >=
1710 	    sizeof(proc->repo_path))
1711 		fatalx("repository path too long: %s", repo->path);
1712 	if (socketpair(AF_UNIX, SOCK_STREAM|SOCK_CLOEXEC|SOCK_NONBLOCK,
1713 	    PF_UNSPEC, proc->pipe) == -1)
1714 		fatal("socketpair");
1715 	proc->pid = start_child(proc->type, proc->repo_path, argv0,
1716 	    confpath, proc->pipe[1], daemonize, verbosity);
1717 	imsg_init(&proc->iev.ibuf, proc->pipe[0]);
1718 	log_debug("proc %s %s is on fd %d",
1719 	    gotd_proc_names[proc->type], proc->repo_path,
1720 	    proc->pipe[0]);
1721 	proc->iev.handler = gotd_dispatch_auth_child;
1722 	proc->iev.events = EV_READ;
1723 	proc->iev.handler_arg = NULL;
1724 	event_set(&proc->iev.ev, proc->iev.ibuf.fd, EV_READ,
1725 	    gotd_dispatch_auth_child, &proc->iev);
1726 	gotd_imsg_event_add(&proc->iev);
1727 
1728 	iauth.euid = client->euid;
1729 	iauth.egid = client->egid;
1730 	iauth.required_auth = required_auth;
1731 	iauth.client_id = client->id;
1732 	if (gotd_imsg_compose_event(&proc->iev, GOTD_IMSG_AUTHENTICATE,
1733 	    PROC_GOTD, fd, &iauth, sizeof(iauth)) == -1) {
1734 		log_warn("imsg compose AUTHENTICATE");
1735 		close(fd);
1736 		/* Let the auth_timeout handler tidy up. */
1737 	}
1738 
1739 	client->auth = proc;
1740 	client->required_auth = required_auth;
1741 	return NULL;
1742 }
1743 
1744 static void
1745 apply_unveil_repo_readonly(const char *repo_path)
1746 {
1747 	if (unveil(repo_path, "r") == -1)
1748 		fatal("unveil %s", repo_path);
1749 
1750 	if (unveil(NULL, NULL) == -1)
1751 		fatal("unveil");
1752 }
1753 
1754 static void
1755 apply_unveil_repo_readwrite(const char *repo_path)
1756 {
1757 	if (unveil(repo_path, "rwc") == -1)
1758 		fatal("unveil %s", repo_path);
1759 
1760 	if (unveil(GOT_TMPDIR_STR, "rwc") == -1)
1761 		fatal("unveil %s", GOT_TMPDIR_STR);
1762 
1763 	if (unveil(NULL, NULL) == -1)
1764 		fatal("unveil");
1765 }
1766 
1767 static void
1768 apply_unveil_none(void)
1769 {
1770 	if (unveil("/", "") == -1)
1771 		fatal("unveil");
1772 
1773 	if (unveil(NULL, NULL) == -1)
1774 		fatal("unveil");
1775 }
1776 
1777 static void
1778 apply_unveil_selfexec(void)
1779 {
1780 	if (unveil(gotd.argv0, "x") == -1)
1781 		fatal("unveil %s", gotd.argv0);
1782 
1783 	if (unveil(NULL, NULL) == -1)
1784 		fatal("unveil");
1785 }
1786 
1787 int
1788 main(int argc, char **argv)
1789 {
1790 	const struct got_error *error = NULL;
1791 	int ch, fd = -1, daemonize = 1, verbosity = 0, noaction = 0;
1792 	const char *confpath = GOTD_CONF_PATH;
1793 	char *argv0 = argv[0];
1794 	char title[2048];
1795 	struct passwd *pw = NULL;
1796 	char *repo_path = NULL;
1797 	enum gotd_procid proc_id = PROC_GOTD;
1798 	struct event evsigint, evsigterm, evsighup, evsigusr1;
1799 	int *pack_fds = NULL, *temp_fds = NULL;
1800 
1801 	log_init(1, LOG_DAEMON); /* Log to stderr until daemonized. */
1802 
1803 	while ((ch = getopt(argc, argv, "Adf:LnP:RSvW")) != -1) {
1804 		switch (ch) {
1805 		case 'A':
1806 			proc_id = PROC_AUTH;
1807 			break;
1808 		case 'd':
1809 			daemonize = 0;
1810 			break;
1811 		case 'f':
1812 			confpath = optarg;
1813 			break;
1814 		case 'L':
1815 			proc_id = PROC_LISTEN;
1816 			break;
1817 		case 'n':
1818 			noaction = 1;
1819 			break;
1820 		case 'P':
1821 			repo_path = realpath(optarg, NULL);
1822 			if (repo_path == NULL)
1823 				fatal("realpath '%s'", optarg);
1824 			break;
1825 		case 'R':
1826 			proc_id = PROC_REPO_READ;
1827 			break;
1828 		case 'S':
1829 			proc_id = PROC_SESSION;
1830 			break;
1831 		case 'v':
1832 			if (verbosity < 3)
1833 				verbosity++;
1834 			break;
1835 		case 'W':
1836 			proc_id = PROC_REPO_WRITE;
1837 			break;
1838 		default:
1839 			usage();
1840 		}
1841 	}
1842 
1843 	argc -= optind;
1844 	argv += optind;
1845 
1846 	if (argc != 0)
1847 		usage();
1848 
1849 	/* Require an absolute path in argv[0] for reliable re-exec. */
1850 	if (!got_path_is_absolute(argv0))
1851 		fatalx("bad path \"%s\": must be an absolute path", argv0);
1852 
1853 	if (geteuid() && (proc_id == PROC_GOTD || proc_id == PROC_LISTEN))
1854 		fatalx("need root privileges");
1855 
1856 	log_init(daemonize ? 0 : 1, LOG_DAEMON);
1857 	log_setverbose(verbosity);
1858 
1859 	if (parse_config(confpath, proc_id, &gotd) != 0)
1860 		return 1;
1861 
1862 	gotd.argv0 = argv0;
1863 	gotd.daemonize = daemonize;
1864 	gotd.verbosity = verbosity;
1865 	gotd.confpath = confpath;
1866 
1867 	if (proc_id == PROC_GOTD &&
1868 	    (gotd.nrepos == 0 || TAILQ_EMPTY(&gotd.repos)))
1869 		fatalx("no repository defined in configuration file");
1870 
1871 	pw = getpwnam(gotd.user_name);
1872 	if (pw == NULL)
1873 		fatalx("user %s not found", gotd.user_name);
1874 
1875 	if (pw->pw_uid == 0) {
1876 		fatalx("cannot run %s as %s: the user running %s "
1877 		    "must not be the superuser",
1878 		    getprogname(), pw->pw_name, getprogname());
1879 	}
1880 
1881 	if (proc_id == PROC_LISTEN &&
1882 	    !got_path_is_absolute(gotd.unix_socket_path))
1883 		fatalx("bad unix socket path \"%s\": must be an absolute path",
1884 		    gotd.unix_socket_path);
1885 
1886 	if (noaction)
1887 		return 0;
1888 
1889 	if (proc_id == PROC_GOTD) {
1890 		gotd.pid = getpid();
1891 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1892 		start_listener(argv0, confpath, daemonize, verbosity);
1893 		arc4random_buf(&clients_hash_key, sizeof(clients_hash_key));
1894 		if (daemonize && daemon(1, 0) == -1)
1895 			fatal("daemon");
1896 	} else if (proc_id == PROC_LISTEN) {
1897 		snprintf(title, sizeof(title), "%s", gotd_proc_names[proc_id]);
1898 		if (verbosity) {
1899 			log_info("socket: %s", gotd.unix_socket_path);
1900 			log_info("user: %s", pw->pw_name);
1901 		}
1902 
1903 		fd = unix_socket_listen(gotd.unix_socket_path, pw->pw_uid,
1904 		    pw->pw_gid);
1905 		if (fd == -1) {
1906 			fatal("cannot listen on unix socket %s",
1907 			    gotd.unix_socket_path);
1908 		}
1909 		if (daemonize && daemon(0, 0) == -1)
1910 			fatal("daemon");
1911 	} else if (proc_id == PROC_AUTH) {
1912 		snprintf(title, sizeof(title), "%s %s",
1913 		    gotd_proc_names[proc_id], repo_path);
1914 		if (daemonize && daemon(0, 0) == -1)
1915 			fatal("daemon");
1916 	} else if (proc_id == PROC_REPO_READ || proc_id == PROC_REPO_WRITE ||
1917 	    proc_id == PROC_SESSION) {
1918 		error = got_repo_pack_fds_open(&pack_fds);
1919 		if (error != NULL)
1920 			fatalx("cannot open pack tempfiles: %s", error->msg);
1921 		error = got_repo_temp_fds_open(&temp_fds);
1922 		if (error != NULL)
1923 			fatalx("cannot open pack tempfiles: %s", error->msg);
1924 		if (repo_path == NULL)
1925 			fatalx("repository path not specified");
1926 		snprintf(title, sizeof(title), "%s %s",
1927 		    gotd_proc_names[proc_id], repo_path);
1928 		if (daemonize && daemon(0, 0) == -1)
1929 			fatal("daemon");
1930 	} else
1931 		fatal("invalid process id %d", proc_id);
1932 
1933 	setproctitle("%s", title);
1934 	log_procinit(title);
1935 
1936 	/* Drop root privileges. */
1937 	if (setgid(pw->pw_gid) == -1)
1938 		fatal("setgid %d failed", pw->pw_gid);
1939 	if (setuid(pw->pw_uid) == -1)
1940 		fatal("setuid %d failed", pw->pw_uid);
1941 
1942 	event_init();
1943 
1944 	switch (proc_id) {
1945 	case PROC_GOTD:
1946 #ifndef PROFILE
1947 		/* "exec" promise will be limited to argv[0] via unveil(2). */
1948 		if (pledge("stdio proc exec sendfd recvfd unveil", NULL) == -1)
1949 			err(1, "pledge");
1950 #endif
1951 		break;
1952 	case PROC_LISTEN:
1953 #ifndef PROFILE
1954 		if (pledge("stdio sendfd unix unveil", NULL) == -1)
1955 			err(1, "pledge");
1956 #endif
1957 		/*
1958 		 * Ensure that AF_UNIX bind(2) cannot be used with any other
1959 		 * sockets by revoking all filesystem access via unveil(2).
1960 		 */
1961 		apply_unveil_none();
1962 
1963 		listen_main(title, fd, gotd.connection_limits,
1964 		    gotd.nconnection_limits);
1965 		/* NOTREACHED */
1966 		break;
1967 	case PROC_AUTH:
1968 #ifndef PROFILE
1969 		if (pledge("stdio getpw recvfd unix unveil", NULL) == -1)
1970 			err(1, "pledge");
1971 #endif
1972 		/*
1973 		 * We need the "unix" pledge promise for getpeername(2) only.
1974 		 * Ensure that AF_UNIX bind(2) cannot be used by revoking all
1975 		 * filesystem access via unveil(2). Access to password database
1976 		 * files will still work since "getpw" bypasses unveil(2).
1977 		 */
1978 		apply_unveil_none();
1979 
1980 		auth_main(title, &gotd.repos, repo_path);
1981 		/* NOTREACHED */
1982 		break;
1983 	case PROC_SESSION:
1984 #ifndef PROFILE
1985 		/*
1986 		 * The "recvfd" promise is only needed during setup and
1987 		 * will be removed in a later pledge(2) call.
1988 		 */
1989 		if (pledge("stdio rpath wpath cpath recvfd sendfd fattr flock "
1990 		    "unveil", NULL) == -1)
1991 			err(1, "pledge");
1992 #endif
1993 		apply_unveil_repo_readwrite(repo_path);
1994 		session_main(title, repo_path, pack_fds, temp_fds,
1995 		    &gotd.request_timeout);
1996 		/* NOTREACHED */
1997 		break;
1998 	case PROC_REPO_READ:
1999 #ifndef PROFILE
2000 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2001 			err(1, "pledge");
2002 #endif
2003 		apply_unveil_repo_readonly(repo_path);
2004 		repo_read_main(title, repo_path, pack_fds, temp_fds);
2005 		/* NOTREACHED */
2006 		exit(0);
2007 	case PROC_REPO_WRITE:
2008 #ifndef PROFILE
2009 		if (pledge("stdio rpath recvfd unveil", NULL) == -1)
2010 			err(1, "pledge");
2011 #endif
2012 		apply_unveil_repo_readonly(repo_path);
2013 		repo_write_main(title, repo_path, pack_fds, temp_fds);
2014 		/* NOTREACHED */
2015 		exit(0);
2016 	default:
2017 		fatal("invalid process id %d", proc_id);
2018 	}
2019 
2020 	if (proc_id != PROC_GOTD)
2021 		fatal("invalid process id %d", proc_id);
2022 
2023 	apply_unveil_selfexec();
2024 
2025 	signal_set(&evsigint, SIGINT, gotd_sighdlr, NULL);
2026 	signal_set(&evsigterm, SIGTERM, gotd_sighdlr, NULL);
2027 	signal_set(&evsighup, SIGHUP, gotd_sighdlr, NULL);
2028 	signal_set(&evsigusr1, SIGUSR1, gotd_sighdlr, NULL);
2029 	signal(SIGPIPE, SIG_IGN);
2030 
2031 	signal_add(&evsigint, NULL);
2032 	signal_add(&evsigterm, NULL);
2033 	signal_add(&evsighup, NULL);
2034 	signal_add(&evsigusr1, NULL);
2035 
2036 	gotd_imsg_event_add(&gotd.listen_proc.iev);
2037 
2038 	event_dispatch();
2039 
2040 	free(repo_path);
2041 	gotd_shutdown();
2042 
2043 	return 0;
2044 }