1
0

Setuid_linux.c 3.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102
  1. /* vim: set expandtab ts=4 sw=4: */
  2. /*
  3. * You may redistribute this program and/or modify it under the terms of
  4. * the GNU General Public License as published by the Free Software Foundation,
  5. * either version 3 of the License, or (at your option) any later version.
  6. *
  7. * This program is distributed in the hope that it will be useful,
  8. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  9. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  10. * GNU General Public License for more details.
  11. *
  12. * You should have received a copy of the GNU General Public License
  13. * along with this program. If not, see <https://www.gnu.org/licenses/>.
  14. */
  15. #include "util/Setuid_impl.h"
  16. #include "memory/Allocator.h"
  17. #include "exception/Except.h"
  18. #include <stdlib.h>
  19. #include <unistd.h>
  20. #include <string.h>
  21. #include <errno.h>
  22. #include <sys/socket.h>
  23. #include <netinet/in.h>
  24. #include <arpa/inet.h>
  25. #include <linux/capability.h>
  26. #include <sys/prctl.h>
  27. #ifndef CAP_TO_MASK
  28. #define CAP_TO_MASK(X) (1 << ((X) & 31))
  29. #endif
  30. #ifndef _LINUX_CAPABILITY_VERSION_3
  31. #define _LINUX_CAPABILITY_VERSION_3 0x20080522
  32. #endif
  33. #define PERMITTED_MASK CAP_TO_MASK(CAP_NET_ADMIN)
  34. static inline int capSet(cap_user_header_t hdr, cap_user_data_t data)
  35. {
  36. int capset(cap_user_header_t hdr, cap_user_data_t data);
  37. return capset(hdr, data);
  38. }
  39. static inline int capGet(cap_user_header_t hdr, cap_user_data_t data)
  40. {
  41. int capget(cap_user_header_t hdr, cap_user_data_t data);
  42. return capget(hdr, data);
  43. }
  44. Er_DEFUN(void Setuid_preSetuid(struct Allocator* alloc))
  45. {
  46. cap_user_header_t hdr = Allocator_calloc(alloc, sizeof(*hdr), 1);
  47. cap_user_data_t data = Allocator_calloc(alloc, sizeof(*data), 2);
  48. hdr->version = _LINUX_CAPABILITY_VERSION_3;
  49. hdr->pid = 0;
  50. if (capGet(hdr, data)) {
  51. Er_raise(alloc, "Error getting capabilities: [errno:%d (%s)]", errno, strerror(errno));
  52. }
  53. data->permitted &= PERMITTED_MASK | CAP_TO_MASK(CAP_SETUID) | CAP_TO_MASK(CAP_SETGID);
  54. data->effective = data->permitted;
  55. data->inheritable = 0;
  56. if (capSet(hdr, data)) {
  57. Er_raise(alloc, "Error setting capabilities: [errno:%d (%s)]", errno, strerror(errno));
  58. }
  59. if (prctl(PR_SET_KEEPCAPS, 1)) {
  60. Er_raise(alloc, "Error keeping capabilities: [errno:%d (%s)]", errno, strerror(errno));
  61. }
  62. Er_ret();
  63. }
  64. Er_DEFUN(void Setuid_postSetuid(struct Allocator* alloc))
  65. {
  66. cap_user_header_t hdr = Allocator_calloc(alloc, sizeof(*hdr), 1);
  67. cap_user_data_t data = Allocator_calloc(alloc, sizeof(*data), 2);
  68. hdr->version = _LINUX_CAPABILITY_VERSION_3;
  69. hdr->pid = 0;
  70. if (capGet(hdr, data)) {
  71. Er_raise(alloc, "Error getting capabilities (post-setuid): [errno:%d (%s)]",
  72. errno, strerror(errno));
  73. }
  74. data->permitted &= PERMITTED_MASK;
  75. data->effective = data->permitted;
  76. data->inheritable = 0;
  77. if (capSet(hdr, data)) {
  78. Er_raise(alloc, "Error setting capabilities (post-setuid): [errno:%d (%s)]",
  79. errno, strerror(errno));
  80. }
  81. if (prctl(PR_SET_KEEPCAPS, 0)) {
  82. Er_raise(alloc, "Error un-keeping capabilities (post-setuid): [errno:%d (%s)]",
  83. errno, strerror(errno));
  84. }
  85. Er_ret();
  86. }