faraphel/chrony
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

sys: move getpwnam() call to main.c

Browse source 
Pass uid/gid instead of user name to the root dropping function.
This commit is contained in:
Miroslav Lichvar 2015-08-10 15:53:36 +02:00
parent 236576c124
commit 6402350c83
6 changed files with 20 additions and 22 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
main.c
View file

@ -350,6 +350,7 @@ int main
const char *conf_file = DEFAULT_CONF_FILE;
const char *progname = argv[0];
char *user = NULL;
struct passwd *pw;
int debug = 0, nofork = 0, address_family = IPADDR_UNSPEC;
int do_init_rtc = 0, restarted = 0;
int other_pid;
@ -488,8 +489,12 @@ int main
if (!user) {
user = CNF_GetUser();
}
if (user && strcmp(user, "root")) {
SYS_DropRoot(user);
if ((pw = getpwnam(user)) == NULL)
LOG_FATAL(LOGF_Main, "Could not get %s uid/gid", user);
SYS_DropRoot(pw->pw_uid, pw->pw_gid);
}
LOG_CreateLogFileDir();

6
sys.c
View file

@ -27,6 +27,8 @@
#include "config.h"
#include "sysincl.h"
#include "sys.h"
#include "logging.h"
@ -107,10 +109,10 @@ SYS_Finalise(void)
/* ================================================== */
void SYS_DropRoot(char *user)
void SYS_DropRoot(uid_t uid, gid_t gid)
{
#if defined(LINUX) && defined (FEAT_PRIVDROP)
SYS_Linux_DropRoot(user);
SYS_Linux_DropRoot(uid, gid);
#else
LOG_FATAL(LOGF_Sys, "dropping root privileges not supported");
#endif

4
sys.h
View file

@ -35,8 +35,8 @@ extern void SYS_Initialise(void);
/* Called at the end of the run to do final clean-up */
extern void SYS_Finalise(void);
/* Drop root privileges to the specified user */
extern void SYS_DropRoot(char *user);
/* Drop root privileges to the specified user and group */
extern void SYS_DropRoot(uid_t uid, gid_t gid);
extern void SYS_SetScheduler(int SchedPriority);
extern void SYS_LockMemory(void);

22
sys_linux.c
View file

@ -45,8 +45,6 @@ int LockAll = 0;
#endif
#ifdef FEAT_PRIVDROP
#include <sys/types.h>
#include <pwd.h>
#include <sys/prctl.h>
#include <sys/capability.h>
#include <grp.h>
@ -382,18 +380,10 @@ SYS_Linux_Finalise(void)
#ifdef FEAT_PRIVDROP
void
SYS_Linux_DropRoot(char *user)
SYS_Linux_DropRoot(uid_t uid, gid_t gid)
{
struct passwd *pw;
cap_t cap;
if (user == NULL)
return;
if ((pw = getpwnam(user)) == NULL) {
LOG_FATAL(LOGF_SysLinux, "getpwnam(%s) failed", user);
}
if (prctl(PR_SET_KEEPCAPS, 1)) {
LOG_FATAL(LOGF_SysLinux, "prctl() failed");
}
@ -402,12 +392,12 @@ SYS_Linux_DropRoot(char *user)
LOG_FATAL(LOGF_SysLinux, "setgroups() failed");
}
if (setgid(pw->pw_gid)) {
LOG_FATAL(LOGF_SysLinux, "setgid(%d) failed", pw->pw_gid);
if (setgid(gid)) {
LOG_FATAL(LOGF_SysLinux, "setgid(%d) failed", gid);
}
if (setuid(pw->pw_uid)) {
LOG_FATAL(LOGF_SysLinux, "setuid(%d) failed", pw->pw_uid);
if (setuid(uid)) {
LOG_FATAL(LOGF_SysLinux, "setuid(%d) failed", uid);
}
if ((cap = cap_from_text("cap_net_bind_service,cap_sys_time=ep")) == NULL) {
@ -420,7 +410,7 @@ SYS_Linux_DropRoot(char *user)
cap_free(cap);
DEBUG_LOG(LOGF_SysLinux, "Privileges dropped to user %s", user);
DEBUG_LOG(LOGF_SysLinux, "Root dropped to uid %d gid %d", uid, gid);
}
#endif

2
sys_linux.h
View file

@ -31,7 +31,7 @@ extern void SYS_Linux_Initialise(void);
extern void SYS_Linux_Finalise(void);
extern void SYS_Linux_DropRoot(char *user);
extern void SYS_Linux_DropRoot(uid_t uid, gid_t gid);
extern void SYS_Linux_MemLockAll(int LockAll);

1
sysincl.h
View file

@ -45,6 +45,7 @@
#include <math.h>
#include <netdb.h>
#include <netinet/in.h>
#include <pwd.h>
#include <resolv.h>
#include <signal.h>
#include <stdarg.h>