[apple/xnu.git] / tools / tests / personas / persona_spawn.c

/*
 * spawn_persona.c
 * Use new POSIX spawn attributes to create a new process in a persona
 *
 * Jeremy C. Andrus <jeremy_andrus@apple.com>
 *
 */
#include <ctype.h>
#include <err.h>
#include <errno.h>
#include <inttypes.h>
#include <libgen.h>
#include <pthread.h>
#include <signal.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <mach/mach.h>
#include <mach/task.h>
#include <mach/vm_param.h>
#include <sys/kauth.h>
#include <sys/queue.h>
#include <sys/sysctl.h>
#include <sys/types.h>

#include "persona_test.h"

/* internal */
#include <libproc.h>
#include <spawn_private.h>
#include <sys/persona.h>
#include <sys/proc_info.h>
#include <sys/spawn_internal.h>

#define PERSONA_TEST_NAME   "Persona Spawn"
#define PERSONA_TEST_VMAJOR 0
#define PERSONA_TEST_VMINOR 1

static struct test_config {
	int verbose;
	int wait_for_children;
} g;


/* = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
 *
 * Child Management
 *
 * = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
 */
struct child {
	TAILQ_ENTRY(child) sibling;
	int pid;
};

static pthread_mutex_t g_child_mtx;
static TAILQ_HEAD(, child) g_children = TAILQ_HEAD_INITIALIZER(g_children);
static int g_nchildren = 0;

static pid_t spawn_child(int argc, char **argv, struct persona_args *pa)
{
	int ret;
	uint32_t persona_flags = 0;
	posix_spawnattr_t attr;
	struct child *child = NULL;
	extern char **environ;

	(void)argc;

	if (!pa) {
		err_print("Invalid persona args!");
		return -ERR_SYSTEM;
	}

	if (!(pa->flags & PA_HAS_ID)) {
		err_print("No persona ID specified!");
		return -ERR_SYSTEM;
	}

	if (g.verbose) {
		dump_persona_args("Spawning new child with args: ", pa);
		infov("\t prog: \"%s\"", argv[0]);
		for (int i = 1; i < argc; i++) {
			infov("\t arg[%d]: %s", i, argv[i]);
		}
	}

	child = (struct child *)calloc(1, sizeof(*child));
	if (!child) {
		err_print("No memory left :-(");
		return -ERR_SYSTEM;
	}

	ret = posix_spawnattr_init(&attr);
	if (ret != 0) {
		err_print("posix_spawnattr_init");
		ret = -ERR_SPAWN_ATTR;
		goto out_err;
	}

	if (pa->flags & PA_SHOULD_VERIFY)
		persona_flags |= POSIX_SPAWN_PERSONA_FLAGS_VERIFY;

	if (pa->flags & PA_OVERRIDE)
		persona_flags |= POSIX_SPAWN_PERSONA_FLAGS_OVERRIDE;

	ret = posix_spawnattr_set_persona_np(&attr, pa->kinfo.persona_id, persona_flags);
	if (ret != 0) {
		err_print("posix_spawnattr_set_persona_np failed!");
		ret = -ERR_SPAWN_ATTR;
		goto out_err;
	}

	if (pa->flags & PA_HAS_UID) {
		ret = posix_spawnattr_set_persona_uid_np(&attr, pa->override_uid);
		if (ret != 0) {
			err_print("posix_spawnattr_set_persona_uid_np failed!");
			ret = -ERR_SPAWN_ATTR;
			goto out_err;
		}
	}

	if (pa->flags & PA_HAS_GID) {
		ret = posix_spawnattr_set_persona_gid_np(&attr, pa->kinfo.persona_gid);
		if (ret != 0) {
			err_print("posix_spawnattr_set_persona_gid_np failed!");
			ret = -ERR_SPAWN_ATTR;
			goto out_err;
		}
	}

	if (pa->flags & PA_HAS_GROUPS) {
		ret = posix_spawnattr_set_persona_groups_np(&attr, pa->kinfo.persona_ngroups, pa->kinfo.persona_groups, KAUTH_UID_NONE);
		if (ret != 0) {
			err_print("");
			ret = -ERR_SPAWN_ATTR;
			goto out_err;
		}
	}

	ret = posix_spawn(&child->pid, argv[0], NULL, &attr, argv, environ);
	if (ret != 0) {
		err_print("posix_spawn (ret=%d)", ret);
		ret = -ERR_SPAWN;
		goto out_err;
	}

	infov("\tspawned child PID: %d", child->pid);

	/* link the processes onto the global children list */
	pthread_mutex_lock(&g_child_mtx);
	TAILQ_INSERT_TAIL(&g_children, child, sibling);
	++g_nchildren;
	pthread_mutex_unlock(&g_child_mtx);

	posix_spawnattr_destroy(&attr);
	return child->pid;

out_err:
	posix_spawnattr_destroy(&attr);
	free(child);
	return (pid_t)ret;
}


static int child_should_exit = 0;

static void child_sighandler(int sig)
{
	(void)sig;
	dbg("PID: %d received sig %d", getpid(), sig);
	child_should_exit = 1;
}

static int child_main_loop(int argc, char **argv)
{
	char ch;
	sigset_t sigset;
	int err = 0;
	uid_t persona_id = 0;
	struct kpersona_info kinfo;
	int rval = 0;

	while ((ch = getopt(argc, argv, "vhER")) != -1) {
		switch (ch) {
		case 'v':
			g.verbose = 1;
			break;
		case 'E':
			child_should_exit = 1;
			break;
		case 'R':
			rval = 1;
			break;
		case 'h':
		case '?':
		case ':':
		default:
			err("Invalid child process invocation.");
		}
	}

	sigemptyset(&sigset);
	sigaddset(&sigset, SIGINT);
	sigaddset(&sigset, SIGHUP);
	sigaddset(&sigset, SIGTERM);
	sigaddset(&sigset, SIGABRT);
	sigaddset(&sigset, SIGCHLD);
	sigprocmask(SIG_UNBLOCK, &sigset, NULL);

	signal(SIGINT, child_sighandler);
	signal(SIGHUP, child_sighandler);
	signal(SIGTERM, child_sighandler);
	signal(SIGABRT, child_sighandler);
	signal(SIGCHLD, child_sighandler);

	err = kpersona_get(&persona_id);

	info("Child: PID:%d", getpid());
	info("Child: UID:%d, GID:%d", getuid(), getgid());
	info("Child: login:%s", getlogin());
	info("Child: Persona: %d (err:%d)", persona_id, err);

	kinfo.persona_info_version = PERSONA_INFO_V1;
	err = kpersona_info(persona_id, &kinfo);
	if (err == 0)
		dump_kpersona("Child: kpersona_info", &kinfo);
	else
		info("Child: ERROR grabbing kpersona_info: %d", errno);

	if (child_should_exit)
		return rval;

	infov("Child Sleeping!");
	while (!child_should_exit)
		sleep(1);

	infov("Child exiting!");
	return rval;
}


/* = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
 *
 * Main Entry Point
 *
 * = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
 */
static void main_sighandler(int sig)
{
	dbg("PID: %d received sig %d", getpid(), sig);
	if (sig == SIGCHLD) {
		--g_nchildren;
	}
}

static void usage_main(const char *progname, int verbose)
{
	const char *nm = basename((char *)progname);

	printf("%s v%d.%d\n", PERSONA_TEST_NAME, PERSONA_TEST_VMAJOR, PERSONA_TEST_VMINOR);
	printf("usage: %s [-I id] [-V] [-u uid] [-g gid] [-vw] progname [args...]\n", nm);
	printf("       Spawn a new process into a new or existing persona.\n");
	if (!verbose)
		exit(1);

	printf("\t%-10s\tID of the persona\n", "-I id");
	printf("\t%-10s\tVerify persona parameters against existing persona (given by -I)\n", "-V");
	printf("\t%-10s\tOverride/verify the user ID of the new process\n", "-u uid");
	printf("\t%-10s\tOverride/verify the group ID of the new process\n", "-g gid");
	printf("\t%-15s\tGroups to which the persona will belong\n", "-G {groupspec}");
	printf("\t%-15s\tgroupspec: G1{,G2,G3...}\n", " ");
	printf("\t%-10s\tBe verbose\n", "-v");
	printf("\t%-10s\tDo not wait for the child process\n", "-w");
	printf("\n");

	exit(1);
}

int main(int argc, char **argv)
{
	char ch;
	int ret;

	pthread_mutex_init(&g_child_mtx, NULL);

	/*
	 * Defaults
	 */
	g.verbose = 0;
	g.wait_for_children = 1;

	if (argc > 1 && strcmp(argv[1], "child") == 0) {
		optind = 2;
		ret = child_main_loop(argc, argv);
		if (ret != 1)
			exit(ret);
		if (strcmp(argv[optind], "spawn") != 0) {
			printf("child exiting (%s).\n", argv[optind]);
			exit(0);
		}
		optind++;

		/*
		 * If we get here, then the child wants us to continue running
		 * to potentially spawn yet another child process. This is
		 * helpful when testing inherited personas and verifying
		 * persona restrictions.
		 */
	}

	if (geteuid() != 0)
		err("%s must be run as root", argv[0] ? basename(argv[0]) : PERSONA_TEST_NAME);

	struct persona_args pa;
	memset(&pa, 0, sizeof(pa));

	pa.flags = PA_NONE;
	pa.kinfo.persona_id = getuid();

	/*
	 * Argument parse for default overrides:
	 */
	while ((ch = getopt(argc, argv, "Vg:G:I:u:vwh")) != -1) {
		switch (ch) {
		case 'V':
			pa.flags |= PA_SHOULD_VERIFY;
			break;
		case 'g':
			pa.kinfo.persona_gid = atoi(optarg);
			pa.flags |= PA_HAS_GID;
			pa.flags |= PA_OVERRIDE;
			break;
		case 'G':
			ret = parse_groupspec(&pa.kinfo, optarg);
			if (ret < 0)
				err("Invalid groupspec: \"%s\"", optarg);
			pa.flags |= PA_HAS_GROUPS;
			pa.flags |= PA_OVERRIDE;
			break;
		case 'I':
			pa.kinfo.persona_id = atoi(optarg);
			if (pa.kinfo.persona_id == 0)
				err("Invalid Persona ID: %s", optarg);
			pa.flags |= PA_HAS_ID;
			break;
		case 'u':
			pa.override_uid = atoi(optarg);
			pa.flags |= PA_HAS_UID;
			pa.flags |= PA_OVERRIDE;
			break;
		case 'v':
			g.verbose = 1;
			break;
		case 'w':
			g.wait_for_children = 0;
			break;
		case 'h':
		case '?':
			usage_main(argv[0], 1);
		case ':':
		default:
			printf("Invalid option: '%c'\n", ch);
			usage_main(argv[0], 0);
		}
	}

	if (pa.flags & PA_SHOULD_VERIFY)
		pa.flags = ~PA_OVERRIDE;

	if (optind >= argc) {
		printf("No program given!\n");
		usage_main(argv[0], 0);
	}

	argc -= optind;
	for (int i = 0; i < argc; i++) {
		argv[i] = argv[i + optind];
	}

	argv[argc] = NULL;

	ret = spawn_child(argc, argv, &pa);
	if (ret < 0)
		return ret;

	pid_t child_pid = (pid_t)ret;
	int status = 0;
	sigset_t sigset;
	sigemptyset(&sigset);
	sigaddset(&sigset, SIGCHLD);
	sigprocmask(SIG_UNBLOCK, &sigset, NULL);
	signal(SIGCHLD, main_sighandler);

	if (g.wait_for_children) {
		infov("Waiting for child...");
		waitpid(child_pid, &status, 0);
		if (WIFEXITED(status)) {
			status = WEXITSTATUS(status);
			if (status != 0)
				errc(ERR_CHILD_FAIL,
				     "Child exited with status: %d", status);
		}
	}

	info("Done.");
	return 0;
}
Commit	Line	Data
490019cf A	1	/*
	2	* spawn_persona.c
	3	* Use new POSIX spawn attributes to create a new process in a persona
	4	*
	5	* Jeremy C. Andrus <jeremy_andrus@apple.com>
	6	*
	7	*/
	8	#include <ctype.h>
	9	#include <err.h>
	10	#include <errno.h>
	11	#include <inttypes.h>
	12	#include <libgen.h>
	13	#include <pthread.h>
	14	#include <signal.h>
	15	#include <stdio.h>
	16	#include <stdlib.h>
	17	#include <string.h>
	18	#include <unistd.h>
	19	#include <mach/mach.h>
	20	#include <mach/task.h>
	21	#include <mach/vm_param.h>
d9a64523	22	#include <sys/kauth.h>
490019cf A	23	#include <sys/queue.h>
	24	#include <sys/sysctl.h>
	25	#include <sys/types.h>
	26
	27	#include "persona_test.h"
	28
	29	/* internal */
	30	#include <libproc.h>
	31	#include <spawn_private.h>
	32	#include <sys/persona.h>
	33	#include <sys/proc_info.h>
	34	#include <sys/spawn_internal.h>
	35
	36	#define PERSONA_TEST_NAME "Persona Spawn"
	37	#define PERSONA_TEST_VMAJOR 0
	38	#define PERSONA_TEST_VMINOR 1
	39
	40	static struct test_config {
	41	int verbose;
	42	int wait_for_children;
	43	} g;
	44
	45
	46	/* = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
	47	*
	48	* Child Management
	49	*
	50	* = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
	51	*/
	52	struct child {
	53	TAILQ_ENTRY(child) sibling;
	54	int pid;
	55	};
	56
	57	static pthread_mutex_t g_child_mtx;
	58	static TAILQ_HEAD(, child) g_children = TAILQ_HEAD_INITIALIZER(g_children);
	59	static int g_nchildren = 0;
	60
	61	static pid_t spawn_child(int argc, char *argv, struct persona_args pa)
	62	{
	63	int ret;
	64	uint32_t persona_flags = 0;
	65	posix_spawnattr_t attr;
	66	struct child *child = NULL;
	67	extern char **environ;
	68
	69	(void)argc;
	70
	71	if (!pa) {
	72	err_print("Invalid persona args!");
	73	return -ERR_SYSTEM;
	74	}
	75
d9a64523	76	if (!(pa->flags & PA_HAS_ID)) {
490019cf A	77	err_print("No persona ID specified!");
	78	return -ERR_SYSTEM;
	79	}
	80
	81	if (g.verbose) {
	82	dump_persona_args("Spawning new child with args: ", pa);
	83	infov("\t prog: \"%s\"", argv[0]);
	84	for (int i = 1; i < argc; i++) {
	85	infov("\t arg[%d]: %s", i, argv[i]);
	86	}
	87	}
	88
	89	child = (struct child )calloc(1, sizeof(child));
	90	if (!child) {
	91	err_print("No memory left :-(");
	92	return -ERR_SYSTEM;
	93	}
	94
	95	ret = posix_spawnattr_init(&attr);
	96	if (ret != 0) {
	97	err_print("posix_spawnattr_init");
	98	ret = -ERR_SPAWN_ATTR;
	99	goto out_err;
	100	}
	101
	102	if (pa->flags & PA_SHOULD_VERIFY)
	103	persona_flags \|= POSIX_SPAWN_PERSONA_FLAGS_VERIFY;
	104
	105	if (pa->flags & PA_OVERRIDE)
	106	persona_flags \|= POSIX_SPAWN_PERSONA_FLAGS_OVERRIDE;
	107
	108	ret = posix_spawnattr_set_persona_np(&attr, pa->kinfo.persona_id, persona_flags);
	109	if (ret != 0) {
	110	err_print("posix_spawnattr_set_persona_np failed!");
	111	ret = -ERR_SPAWN_ATTR;
	112	goto out_err;
	113	}
	114
	115	if (pa->flags & PA_HAS_UID) {
	116	ret = posix_spawnattr_set_persona_uid_np(&attr, pa->override_uid);
	117	if (ret != 0) {
	118	err_print("posix_spawnattr_set_persona_uid_np failed!");
	119	ret = -ERR_SPAWN_ATTR;
	120	goto out_err;
	121	}
	122	}
	123
	124	if (pa->flags & PA_HAS_GID) {
	125	ret = posix_spawnattr_set_persona_gid_np(&attr, pa->kinfo.persona_gid);
	126	if (ret != 0) {
	127	err_print("posix_spawnattr_set_persona_gid_np failed!");
	128	ret = -ERR_SPAWN_ATTR;
	129	goto out_err;
	130	}
	131	}
	132
d9a64523 A	133	if (pa->flags & PA_HAS_GROUPS) {
	134	ret = posix_spawnattr_set_persona_groups_np(&attr, pa->kinfo.persona_ngroups, pa->kinfo.persona_groups, KAUTH_UID_NONE);
	135	if (ret != 0) {
	136	err_print("");
	137	ret = -ERR_SPAWN_ATTR;
	138	goto out_err;
	139	}
	140	}
	141
490019cf A	142	ret = posix_spawn(&child->pid, argv[0], NULL, &attr, argv, environ);
	143	if (ret != 0) {
	144	err_print("posix_spawn (ret=%d)", ret);
	145	ret = -ERR_SPAWN;
	146	goto out_err;
	147	}
	148
	149	infov("\tspawned child PID: %d", child->pid);
	150
	151	/* link the processes onto the global children list */
	152	pthread_mutex_lock(&g_child_mtx);
	153	TAILQ_INSERT_TAIL(&g_children, child, sibling);
	154	++g_nchildren;
	155	pthread_mutex_unlock(&g_child_mtx);
	156
	157	posix_spawnattr_destroy(&attr);
	158	return child->pid;
	159
	160	out_err:
	161	posix_spawnattr_destroy(&attr);
	162	free(child);
	163	return (pid_t)ret;
	164	}
	165
	166
	167	static int child_should_exit = 0;
	168
	169	static void child_sighandler(int sig)
	170	{
	171	(void)sig;
	172	dbg("PID: %d received sig %d", getpid(), sig);
	173	child_should_exit = 1;
	174	}
	175
	176	static int child_main_loop(int argc, char **argv)
	177	{
	178	char ch;
	179	sigset_t sigset;
	180	int err = 0;
	181	uid_t persona_id = 0;
	182	struct kpersona_info kinfo;
	183	int rval = 0;
	184
	185	while ((ch = getopt(argc, argv, "vhER")) != -1) {
	186	switch (ch) {
	187	case 'v':
	188	g.verbose = 1;
	189	break;
	190	case 'E':
	191	child_should_exit = 1;
	192	break;
	193	case 'R':
	194	rval = 1;
	195	break;
	196	case 'h':
	197	case '?':
	198	case ':':
	199	default:
	200	err("Invalid child process invocation.");
	201	}
	202	}
	203
	204	sigemptyset(&sigset);
	205	sigaddset(&sigset, SIGINT);
206	sigaddset(&sigset, SIGHUP);
207	sigaddset(&sigset, SIGTERM);
208	sigaddset(&sigset, SIGABRT);
209	sigaddset(&sigset, SIGCHLD);
210	sigprocmask(SIG_UNBLOCK, &sigset, NULL);
211
212	signal(SIGINT, child_sighandler);
213	signal(SIGHUP, child_sighandler);
214	signal(SIGTERM, child_sighandler);
215	signal(SIGABRT, child_sighandler);
216	signal(SIGCHLD, child_sighandler);
217
218	err = kpersona_get(&persona_id);
219
220	info("Child: PID:%d", getpid());
221	info("Child: UID:%d, GID:%d", getuid(), getgid());
222	info("Child: login:%s", getlogin());
223	info("Child: Persona: %d (err:%d)", persona_id, err);
224
225	kinfo.persona_info_version = PERSONA_INFO_V1;
226	err = kpersona_info(persona_id, &kinfo);
227	if (err == 0)
228	dump_kpersona("Child: kpersona_info", &kinfo);
229	else
230	info("Child: ERROR grabbing kpersona_info: %d", errno);
231
232	if (child_should_exit)
233	return rval;
234
235	infov("Child Sleeping!");
236	while (!child_should_exit)
237	sleep(1);
238
239	infov("Child exiting!");
240	return rval;
241	}
242
243
244	/* = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
245	*
246	* Main Entry Point
247	*
248	* = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = = =
249	*/
250	static void main_sighandler(int sig)
251	{
252	dbg("PID: %d received sig %d", getpid(), sig);
253	if (sig == SIGCHLD) {
254	--g_nchildren;
255	}
256	}
257
258	static void usage_main(const char *progname, int verbose)
259	{
260	const char nm = basename((char )progname);
261
262	printf("%s v%d.%d\n", PERSONA_TEST_NAME, PERSONA_TEST_VMAJOR, PERSONA_TEST_VMINOR);
263	printf("usage: %s [-I id] [-V] [-u uid] [-g gid] [-vw] progname [args...]\n", nm);
264	printf(" Spawn a new process into a new or existing persona.\n");
265	if (!verbose)
266	exit(1);
267
268	printf("\t%-10s\tID of the persona\n", "-I id");
269	printf("\t%-10s\tVerify persona parameters against existing persona (given by -I)\n", "-V");
270	printf("\t%-10s\tOverride/verify the user ID of the new process\n", "-u uid");
271	printf("\t%-10s\tOverride/verify the group ID of the new process\n", "-g gid");
d9a64523 A	272	printf("\t%-15s\tGroups to which the persona will belong\n", "-G {groupspec}");
d9a64523 A	273	printf("\t%-15s\tgroupspec: G1{,G2,G3...}\n", " ");
490019cf A	274	printf("\t%-10s\tBe verbose\n", "-v");
	275	printf("\t%-10s\tDo not wait for the child process\n", "-w");
	276	printf("\n");
	277
	278	exit(1);
	279	}
	280
	281	int main(int argc, char **argv)
	282	{
	283	char ch;
	284	int ret;
	285
	286	pthread_mutex_init(&g_child_mtx, NULL);
	287
	288	/*
	289	* Defaults
	290	*/
	291	g.verbose = 0;
	292	g.wait_for_children = 1;
	293
	294	if (argc > 1 && strcmp(argv[1], "child") == 0) {
	295	optind = 2;
	296	ret = child_main_loop(argc, argv);
	297	if (ret != 1)
d9a64523 A	298	exit(ret);
	299	if (strcmp(argv[optind], "spawn") != 0) {
	300	printf("child exiting (%s).\n", argv[optind]);
490019cf	301	exit(0);
d9a64523 A	302	}
d9a64523 A	303	optind++;
490019cf A	304
	305	/*
	306	* If we get here, then the child wants us to continue running
	307	* to potentially spawn yet another child process. This is
	308	* helpful when testing inherited personas and verifying
	309	* persona restrictions.
	310	*/
	311	}
	312
	313	if (geteuid() != 0)
	314	err("%s must be run as root", argv[0] ? basename(argv[0]) : PERSONA_TEST_NAME);
	315
	316	struct persona_args pa;
	317	memset(&pa, 0, sizeof(pa));
	318
	319	pa.flags = PA_NONE;
	320	pa.kinfo.persona_id = getuid();
	321
	322	/*
	323	* Argument parse for default overrides:
	324	*/
d9a64523	325	while ((ch = getopt(argc, argv, "Vg:G:I:u:vwh")) != -1) {
490019cf A	326	switch (ch) {
	327	case 'V':
	328	pa.flags \|= PA_SHOULD_VERIFY;
	329	break;
	330	case 'g':
	331	pa.kinfo.persona_gid = atoi(optarg);
490019cf A	332	pa.flags \|= PA_HAS_GID;
	333	pa.flags \|= PA_OVERRIDE;
	334	break;
d9a64523 A	335	case 'G':
	336	ret = parse_groupspec(&pa.kinfo, optarg);
	337	if (ret < 0)
	338	err("Invalid groupspec: \"%s\"", optarg);
	339	pa.flags \|= PA_HAS_GROUPS;
	340	pa.flags \|= PA_OVERRIDE;
	341	break;
490019cf A	342	case 'I':
	343	pa.kinfo.persona_id = atoi(optarg);
	344	if (pa.kinfo.persona_id == 0)
	345	err("Invalid Persona ID: %s", optarg);
	346	pa.flags \|= PA_HAS_ID;
	347	break;
	348	case 'u':
	349	pa.override_uid = atoi(optarg);
490019cf A	350	pa.flags \|= PA_HAS_UID;
	351	pa.flags \|= PA_OVERRIDE;
	352	break;
	353	case 'v':
	354	g.verbose = 1;
	355	break;
	356	case 'w':
	357	g.wait_for_children = 0;
	358	break;
	359	case 'h':
	360	case '?':
	361	usage_main(argv[0], 1);
	362	case ':':
	363	default:
	364	printf("Invalid option: '%c'\n", ch);
	365	usage_main(argv[0], 0);
	366	}
	367	}
	368
	369	if (pa.flags & PA_SHOULD_VERIFY)
	370	pa.flags = ~PA_OVERRIDE;
	371
	372	if (optind >= argc) {
	373	printf("No program given!\n");
	374	usage_main(argv[0], 0);
	375	}
	376
	377	argc -= optind;
	378	for (int i = 0; i < argc; i++) {
	379	argv[i] = argv[i + optind];
	380	}
	381
	382	argv[argc] = NULL;
	383
	384	ret = spawn_child(argc, argv, &pa);
	385	if (ret < 0)
	386	return ret;
	387
	388	pid_t child_pid = (pid_t)ret;
	389	int status = 0;
	390	sigset_t sigset;
	391	sigemptyset(&sigset);
	392	sigaddset(&sigset, SIGCHLD);
	393	sigprocmask(SIG_UNBLOCK, &sigset, NULL);
	394	signal(SIGCHLD, main_sighandler);
	395
	396	if (g.wait_for_children) {
	397	infov("Waiting for child...");
	398	waitpid(child_pid, &status, 0);
	399	if (WIFEXITED(status)) {
	400	status = WEXITSTATUS(status);
	401	if (status != 0)
	402	errc(ERR_CHILD_FAIL,
	403	"Child exited with status: %d", status);
	404	}
	405	}
	406
	407	info("Done.");
	408	return 0;
	409	}