diff options
author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 15:19:27 +0000 |
---|---|---|
committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 15:19:27 +0000 |
commit | e0023883c6d2e6745a19e4b48e186ed156c1fca8 (patch) | |
tree | 1a48b8056ec984385d0d862b683535d04d6ed215 /gl/lib/idpriv-drop.c | |
parent | Initial commit. (diff) | |
download | man-db-upstream.tar.xz man-db-upstream.zip |
Adding upstream version 2.11.2.upstream/2.11.2upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to '')
-rw-r--r-- | gl/lib/idpriv-drop.c | 131 |
1 files changed, 131 insertions, 0 deletions
diff --git a/gl/lib/idpriv-drop.c b/gl/lib/idpriv-drop.c new file mode 100644 index 0000000..e122cb0 --- /dev/null +++ b/gl/lib/idpriv-drop.c @@ -0,0 +1,131 @@ +/* Dropping uid/gid privileges of the current process permanently. + Copyright (C) 2009-2022 Free Software Foundation, Inc. + + This program is free software: you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation, either version 3 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program. If not, see <https://www.gnu.org/licenses/>. */ + +#include <config.h> + +#include "idpriv.h" + +#include <stdlib.h> +#include <sys/types.h> +#include <unistd.h> + +int +idpriv_drop (void) +{ +#if HAVE_GETUID + int uid = getuid (); +#endif +#if HAVE_GETGID + int gid = getgid (); +#endif + + /* Drop the gid privilege first, because in some cases the gid privilege + cannot be dropped after the uid privilege has been dropped. */ + + /* This is for executables that have the setgid bit set. */ +#if HAVE_SETRESGID /* glibc, FreeBSD, OpenBSD, HP-UX */ + /* This code is needed: In particular, on HP-UX 11.11, setregid (gid, gid) + may leave the saved gid as 0. See also the comment below regarding + setresuid. */ + if (setresgid (gid, gid, gid) < 0) + return -1; +#elif HAVE_SETREGID /* Mac OS X, NetBSD, AIX, IRIX, Solaris, OSF/1, Cygwin */ + if (setregid (gid, gid) < 0) + return -1; +#elif HAVE_SETEGID /* Solaris 2.4 */ + if (setegid (gid) < 0) + return -1; +#endif + + /* This is for executables that have the setuid bit set. */ +#if HAVE_SETRESUID /* glibc, FreeBSD, OpenBSD, HP-UX */ + /* On systems which have setresuid(), we use it instead of setreuid(), + because + Hao Chen, David Wagner, Drew Dean: Setuid Demystified + <https://www.usenix.org/legacy/publications/library/proceedings/sec02/full_papers/chen/chen.pdf> + says about setreuid(): "The rule by which the saved uid id is modified + is complicated." Similarly, <https://unixpapa.com/incnote/setuid.html> + says about setreuid(): "What exactly happens to the saved UID when this + is used seems to vary a lot." */ + if (setresuid (uid, uid, uid) < 0) + return -1; +#elif HAVE_SETREUID /* Mac OS X, NetBSD, AIX, IRIX, Solaris, OSF/1, Cygwin */ + if (setreuid (uid, uid) < 0) + return -1; +#elif HAVE_SETEUID /* Solaris 2.4 */ + if (seteuid (uid) < 0) + return -1; +#endif + + /* Verify that the privileges have really been dropped. + This verification is here for security reasons. Doesn't matter if it + takes a couple of system calls. + On Solaris (which has saved uids and gids but no getresuid, getresgid + functions), we could read /proc/<pid>/cred and verify the saved uid and + gid found there. But it's not clear to me when to interpret the file as a + 'prcred_t' and when as a 'prcred32_t'. + Hao Chen, David Wagner, Drew Dean: Setuid Demystified + <https://www.usenix.org/legacy/publications/library/proceedings/sec02/full_papers/chen/chen.pdf> + section 8.1.3 also recommends to use a setreuid call as a probe, but + this call would unexpectedly succeed (and the verification thus fail) + on Linux if the process has the CAP_SETUID capability. + When the verification fails, it indicates that we need to use different + API in the code above. Therefore 'abort ()', not 'return -1'. */ +#if HAVE_GETRESUID /* glibc, FreeBSD, OpenBSD, HP-UX */ + { + uid_t real; + uid_t effective; + uid_t saved; + if (getresuid (&real, &effective, &saved) < 0 + || real != uid + || effective != uid + || saved != uid) + abort (); + } +#else +# if HAVE_GETEUID + if (geteuid () != uid) + abort (); +# endif +# if HAVE_GETUID + if (getuid () != uid) + abort (); +# endif +#endif +#if HAVE_GETRESGID /* glibc, FreeBSD, OpenBSD, HP-UX */ + { + gid_t real; + gid_t effective; + gid_t saved; + if (getresgid (&real, &effective, &saved) < 0 + || real != gid + || effective != gid + || saved != gid) + abort (); + } +#else +# if HAVE_GETEGID + if (getegid () != gid) + abort (); +# endif +# if HAVE_GETGID + if (getgid () != gid) + abort (); +# endif +#endif + + return 0; +} |