sharpetronics/strongswan
1
0
Fork 0
mirror of https://github.com/strongswan/strongswan.git synced 2025-10-05 00:00:45 -04:00
Code Issues Projects Releases Wiki Activity

When running with an unprivileged user, initialize supplementary groups

Browse Source
This commit is contained in:
Martin Willi 2013-02-20 10:38:45 +01:00
parent 21dd4c4bea
commit 53fcc70acc
2 changed files with 38 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
configure.in
View File

@ -461,7 +461,7 @@ AC_CHECK_FUNC(
)] )]
) )
AC_CHECK_FUNCS(prctl mallinfo getpass closefrom getpwnam_r getgrnam_r) AC_CHECK_FUNCS(prctl mallinfo getpass closefrom getpwnam_r getgrnam_r getpwuid_r)
AC_CHECK_HEADERS(sys/sockio.h glob.h) AC_CHECK_HEADERS(sys/sockio.h glob.h)
AC_CHECK_HEADERS(net/pfkeyv2.h netipsec/ipsec.h netinet6/ipsec.h linux/udp.h) AC_CHECK_HEADERS(net/pfkeyv2.h netipsec/ipsec.h netinet6/ipsec.h linux/udp.h)

38
src/libstrongswan/utils/capabilities.c
View File

@ -29,7 +29,9 @@
#include <utils/debug.h> #include <utils/debug.h>
#if !defined(HAVE_GETPWNAM_R) || !defined(HAVE_GETGRNAM_R) #if !defined(HAVE_GETPWNAM_R) || \
!defined(HAVE_GETGRNAM_R) || \
!defined(HAVE_GETPWUID_R)
# include <threading/mutex.h> # include <threading/mutex.h>
# define EMULATE_R_FUNCS # define EMULATE_R_FUNCS
#endif #endif
@ -188,6 +190,34 @@ METHOD(capabilities_t, resolve_gid, bool,
return FALSE; return FALSE;
} }
/**
* Initialize supplementary groups for unprivileged user
*/
static bool init_supplementary_groups(private_capabilities_t *this)
{
struct passwd *pwp;
int res = -1;
#ifdef HAVE_GETPWUID_R
struct passwd pwd;
char buf[1024];
if (getpwuid_r(this->uid, &pwd, buf, sizeof(buf), &pwp) == 0 && pwp)
{
res = initgroups(pwp->pw_name, this->gid);
}
#else /* HAVE_GETPWUID_R */
this->mutex->lock(this->mutex);
pwp = getpwuid(this->uid);
if (pwp)
{
res = initgroups(pwp->pw_name, this->gid);
}
this->mutex->unlock(this->mutex);
#endif /* HAVE_GETPWUID_R */
return res == 0;
}
METHOD(capabilities_t, drop, bool, METHOD(capabilities_t, drop, bool,
private_capabilities_t *this) private_capabilities_t *this)
{ {
@ -195,6 +225,12 @@ METHOD(capabilities_t, drop, bool,
prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0); prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
#endif #endif
if (!init_supplementary_groups(this))
{
DBG1(DBG_LIB, "initializing supplementary groups for %u failed",
this->uid);
return FALSE;
}
if (this->gid && setgid(this->gid) != 0) if (this->gid && setgid(this->gid) != 0)
{ {
DBG1(DBG_LIB, "change to unprivileged group %u failed: %s", DBG1(DBG_LIB, "change to unprivileged group %u failed: %s",