Return to syspriv.h CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / bird / sysdep / linux

Annotation of embedaddon/bird/sysdep/linux/syspriv.h, revision 1.1.1.1

1.1       misho       1: #ifndef _BIRD_SYSPRIV_H_
                      2: #define _BIRD_SYSPRIV_H_
                      3: 
                      4: #ifndef _GNU_SOURCE
                      5: #define _GNU_SOURCE
                      6: #endif
                      7: 
                      8: #include <unistd.h>
                      9: #include <sys/prctl.h>
                     10: #include <linux/capability.h>
                     11: 
                     12: #ifndef _LINUX_CAPABILITY_VERSION_3
                     13: #define _LINUX_CAPABILITY_VERSION_3  0x20080522
                     14: #define _LINUX_CAPABILITY_U32S_3     2
                     15: #endif
                     16: 
                     17: /* CAP_TO_MASK is missing in CentOS header files */
                     18: #ifndef CAP_TO_MASK
                     19: #define CAP_TO_MASK(x)      (1 << ((x) & 31))
                     20: #endif
                     21: 
                     22: /* capset() prototype is missing ... */
                     23: int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
                     24: 
                     25: static inline int
                     26: set_capabilities(u32 caps)
                     27: {
                     28:   struct __user_cap_header_struct cap_hdr;
                     29:   struct __user_cap_data_struct cap_dat[_LINUX_CAPABILITY_U32S_3];
                     30:   int err;
                     31: 
                     32:   cap_hdr.version = _LINUX_CAPABILITY_VERSION_3;
                     33:   cap_hdr.pid = 0;
                     34: 
                     35:   memset(cap_dat, 0, sizeof(cap_dat));
                     36:   cap_dat[0].effective = cap_dat[0].permitted = caps;
                     37: 
                     38:   err = capset(&cap_hdr, cap_dat);
                     39:   if (!err)
                     40:     return 0;
                     41: 
                     42:   /* Kernel may support do not support our version of capability interface.
                     43:        The last call returned supported version so we just retry it. */
                     44:   if (errno == EINVAL)
                     45:   {
                     46:     err = capset(&cap_hdr, cap_dat);
                     47:     if (!err)
                     48:       return 0;
                     49:   }
                     50: 
                     51:   return -1;
                     52: }
                     53: 
                     54: static void
                     55: drop_uid(uid_t uid)
                     56: {
                     57:   u32 caps =
                     58:     CAP_TO_MASK(CAP_NET_BIND_SERVICE) |
                     59:     CAP_TO_MASK(CAP_NET_BROADCAST) |
                     60:     CAP_TO_MASK(CAP_NET_ADMIN) |
                     61:     CAP_TO_MASK(CAP_NET_RAW);
                     62: 
                     63:   /* change effective user ID to be able to switch to that
                     64:      user ID completely after dropping CAP_SETUID */
                     65:   if (seteuid(uid) < 0)
                     66:     die("seteuid: %m");
                     67: 
                     68:   /* restrict the capabilities */
                     69:   if (set_capabilities(caps) < 0)
                     70:     die("capset: %m");
                     71: 
                     72:   /* keep the capabilities after dropping root ID */
                     73:   if (prctl(PR_SET_KEEPCAPS, 1) < 0)
                     74:     die("prctl: %m");
                     75: 
                     76:   /* completely switch to the unprivileged user ID */
                     77:   if (setresuid(uid, uid, uid) < 0)
                     78:     die("setresuid: %m");
                     79: }
                     80: 
                     81: #endif /* _BIRD_SYSPRIV_H_ */