| 97 | |
| 98 | class FirewallClient: |
| 99 | def __init__(self, port, subnets_include, subnets_exclude, dnsport): |
| 100 | self.port = port |
| 101 | self.auto_nets = [] |
| 102 | self.subnets_include = subnets_include |
| 103 | self.subnets_exclude = subnets_exclude |
| 104 | self.dnsport = dnsport |
| 105 | argvbase = ([sys.argv[1], sys.argv[0], sys.argv[1]] + |
| 106 | ['-v'] * (helpers.verbose or 0) + |
| 107 | ['--firewall', str(port), str(dnsport)]) |
| 108 | if ssyslog._p: |
| 109 | argvbase += ['--syslog'] |
| 110 | argv_tries = [ |
| 111 | ['sudo', '-p', '[local sudo] Password: '] + argvbase, |
| 112 | ['su', '-c', ' '.join(argvbase)], |
| 113 | argvbase |
| 114 | ] |
| 115 | |
| 116 | # we can't use stdin/stdout=subprocess.PIPE here, as we normally would, |
| 117 | # because stupid Linux 'su' requires that stdin be attached to a tty. |
| 118 | # Instead, attach a *bidirectional* socket to its stdout, and use |
| 119 | # that for talking in both directions. |
| 120 | (s1,s2) = socket.socketpair() |
| 121 | def setup(): |
| 122 | # run in the child process |
| 123 | s2.close() |
| 124 | e = None |
| 125 | if os.getuid() == 0: |
| 126 | argv_tries = argv_tries[-1:] # last entry only |
| 127 | for argv in argv_tries: |
| 128 | try: |
| 129 | if argv[0] == 'su': |
| 130 | sys.stderr.write('[local su] ') |
| 131 | self.p = ssubprocess.Popen(argv, stdout=s1, preexec_fn=setup) |
| 132 | e = None |
| 133 | break |
| 134 | except OSError, e: |
| 135 | pass |
| 136 | self.argv = argv |
| 137 | s1.close() |
| 138 | self.pfile = s2.makefile('wb+') |
| 139 | if e: |
| 140 | log('Spawning firewall manager: %r\n' % self.argv) |
| 141 | raise Fatal(e) |
| 142 | line = self.pfile.readline() |
| 143 | self.check() |
| 144 | if line != 'READY\n': |
| 145 | raise Fatal('%r expected READY, got %r' % (self.argv, line)) |
| 146 | |
| 147 | def check(self): |
| 148 | rv = self.p.poll() |