summaryrefslogtreecommitdiffstats
path: root/src/util-privs.h
blob: 454533963d346490b63fc3bce5638bf065ff1e94 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
/* Copyright (C) 2007-2010 Open Information Security Foundation
 *
 * You can copy, redistribute or modify this Program under the terms of
 * the GNU General Public License version 2 as published by the Free
 * Software Foundation.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * version 2 along with this program; if not, write to the Free Software
 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
 * 02110-1301, USA.
 */

/**
 * \file
 *
 * \author  Gurvinder Singh <gurvindersinghdahiya@gmail.com>
 */

#ifndef _UTIL_PRIVS_H
#define	_UTIL_PRIVS_H

#define SC_CAP_NONE             0x01
#define SC_CAP_SYS_ADMIN        0x02
#define SC_CAP_SYS_RAW_IO       0x04
#define SC_CAP_IPC_LOCK         0x08
#define SC_CAP_NET_ADMIN        0x10
#define SC_CAP_NET_RAW          0x20
#define SC_CAP_NET_BIND_SERVICE 0x40
#define SC_CAP_NET_BROADCAST    0x80

#ifdef HAVE_LIBCAP_NG
#include <cap-ng.h>
#include "threadvars.h"

/**Drop the privileges of the given thread tv, based on the thread cap_flags
 * which implies the capability requirement of the given thread. Initially all
 * caps are dropped and later, the required caps are set for the given thread
 */
void SCDropCaps(ThreadVars *tv);
/*
#define SCDropCaps(tv) ({ \
    capng_clear(CAPNG_SELECT_BOTH); \
    capng_apply(CAPNG_SELECT_BOTH); \
    if (tv->cap_flags & SC_CAP_IPC_LOCK) { \
        capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_IPC_LOCK); \
        capng_apply(CAPNG_SELECT_CAPS); \
        SCLogDebug("For thread \"%s\" CAP_IPC_LOCK has been set", tv->name); \
    } \
    if (tv->cap_flags & SC_CAP_NET_ADMIN) { \
        capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_ADMIN); \
        capng_apply(CAPNG_SELECT_CAPS); \
        SCLogDebug("For thread \"%s\" CAP_NET_ADMIN has been set", tv->name); \
    } \
    if (tv->cap_flags & SC_CAP_NET_BIND_SERVICE) { \
        capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BIND_SERVICE); \
        capng_apply(CAPNG_SELECT_CAPS); \
        SCLogDebug("For thread \"%s\" CAP_NET_BIND_SERVICE has been set", tv->name); \
    } \
    if (tv->cap_flags & SC_CAP_NET_BROADCAST) { \
        capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BROADCAST); \
        capng_apply(CAPNG_SELECT_CAPS); \
        SCLogDebug("For thread \"%s\" CAP_NET_BROADCAST has been set", tv->name); \
    } \
    if (tv->cap_flags & SC_CAP_NET_RAW) { \
        capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_RAW); \
        capng_apply(CAPNG_SELECT_CAPS); \
        SCLogDebug("For thread \"%s\" CAP_NET_RAW has been set", tv->name); \
    } \
    if (tv->cap_flags & SC_CAP_SYS_ADMIN) { \
        capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_ADMIN); \
        capng_apply(CAPNG_SELECT_CAPS); \
        SCLogDebug("For thread \"%s\" CAP_SYS_ADMIN has been set", tv->name); \
    } \
    if (tv->cap_flags & SC_CAP_SYS_RAW_IO) { \
        capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_RAWIO); \
        capng_apply(CAPNG_SELECT_CAPS); \
        SCLogDebug("For thread \"%s\" CAP_SYS_RAWIO has been set", tv->name); \
    } \
})
*/
void SCDropMainThreadCaps(uint32_t , uint32_t );

#else
#define SCDropCaps(...)
#define SCDropMainThreadCaps(...)
#endif /* HAVE_LIBCAP_NG */

void SCGetUserID(const char *, const char *, uint32_t *, uint32_t *);
void SCGetGroupID(const char *, uint32_t *);

#ifdef __OpenBSD__
int SCPledge(void);
#else /* __OpenBSD__ */
#define SCPledge(...)
#endif /* __OpenBSD__ */

#endif	/* _UTIL_PRIVS_H */