1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
|
/* Copyright (C) 2007-2010 Open Information Security Foundation
*
* You can copy, redistribute or modify this Program under the terms of
* the GNU General Public License version 2 as published by the Free
* Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* version 2 along with this program; if not, write to the Free Software
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301, USA.
*/
/**
* \file
*
* \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
*/
#ifndef _UTIL_PRIVS_H
#define _UTIL_PRIVS_H
#define SC_CAP_NONE 0x01
#define SC_CAP_SYS_ADMIN 0x02
#define SC_CAP_SYS_RAW_IO 0x04
#define SC_CAP_IPC_LOCK 0x08
#define SC_CAP_NET_ADMIN 0x10
#define SC_CAP_NET_RAW 0x20
#define SC_CAP_NET_BIND_SERVICE 0x40
#define SC_CAP_NET_BROADCAST 0x80
#ifdef HAVE_LIBCAP_NG
#include <cap-ng.h>
#include "threadvars.h"
/**Drop the privileges of the given thread tv, based on the thread cap_flags
* which implies the capability requirement of the given thread. Initially all
* caps are dropped and later, the required caps are set for the given thread
*/
void SCDropCaps(ThreadVars *tv);
/*
#define SCDropCaps(tv) ({ \
capng_clear(CAPNG_SELECT_BOTH); \
capng_apply(CAPNG_SELECT_BOTH); \
if (tv->cap_flags & SC_CAP_IPC_LOCK) { \
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_IPC_LOCK); \
capng_apply(CAPNG_SELECT_CAPS); \
SCLogDebug("For thread \"%s\" CAP_IPC_LOCK has been set", tv->name); \
} \
if (tv->cap_flags & SC_CAP_NET_ADMIN) { \
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_ADMIN); \
capng_apply(CAPNG_SELECT_CAPS); \
SCLogDebug("For thread \"%s\" CAP_NET_ADMIN has been set", tv->name); \
} \
if (tv->cap_flags & SC_CAP_NET_BIND_SERVICE) { \
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BIND_SERVICE); \
capng_apply(CAPNG_SELECT_CAPS); \
SCLogDebug("For thread \"%s\" CAP_NET_BIND_SERVICE has been set", tv->name); \
} \
if (tv->cap_flags & SC_CAP_NET_BROADCAST) { \
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BROADCAST); \
capng_apply(CAPNG_SELECT_CAPS); \
SCLogDebug("For thread \"%s\" CAP_NET_BROADCAST has been set", tv->name); \
} \
if (tv->cap_flags & SC_CAP_NET_RAW) { \
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_RAW); \
capng_apply(CAPNG_SELECT_CAPS); \
SCLogDebug("For thread \"%s\" CAP_NET_RAW has been set", tv->name); \
} \
if (tv->cap_flags & SC_CAP_SYS_ADMIN) { \
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_ADMIN); \
capng_apply(CAPNG_SELECT_CAPS); \
SCLogDebug("For thread \"%s\" CAP_SYS_ADMIN has been set", tv->name); \
} \
if (tv->cap_flags & SC_CAP_SYS_RAW_IO) { \
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_RAWIO); \
capng_apply(CAPNG_SELECT_CAPS); \
SCLogDebug("For thread \"%s\" CAP_SYS_RAWIO has been set", tv->name); \
} \
})
*/
void SCDropMainThreadCaps(uint32_t , uint32_t );
#else
#define SCDropCaps(...)
#define SCDropMainThreadCaps(...)
#endif /* HAVE_LIBCAP_NG */
void SCGetUserID(const char *, const char *, uint32_t *, uint32_t *);
void SCGetGroupID(const char *, uint32_t *);
#ifdef __OpenBSD__
int SCPledge(void);
#else /* __OpenBSD__ */
#define SCPledge(...)
#endif /* __OpenBSD__ */
#endif /* _UTIL_PRIVS_H */
|
