mainscnt/sinkserver
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

drop root

Browse Source
This commit is contained in:
Wolfgang Hottgenroth 2021-02-11 12:07:37 +01:00
parent ac376da42f
commit afe57f9b4b
1 changed files with 15 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
sink/sink20169.c
View File

@ -315,6 +315,8 @@ void usage() {
printf(" -v ............... Verbose, writes all logging on stdout too\n"); printf(" -v ............... Verbose, writes all logging on stdout too\n");
printf(" -s FACILITY ...... Sets syslog facility, only LOCAL[0..7]\n"); printf(" -s FACILITY ...... Sets syslog facility, only LOCAL[0..7]\n");
printf(" USER and DAEMON are supported\n"); printf(" USER and DAEMON are supported\n");
printf(" -n UID ........... If started as root drop privileges and become\n");
printf(" user with id UID\n");
printf(" -h ............... This help\n"); printf(" -h ............... This help\n");
} }
@ -325,9 +327,10 @@ int main(int argc, char **argv) {
const char *configFilename = DEFAULT_CONFIG_FILENAME; const char *configFilename = DEFAULT_CONFIG_FILENAME;
uid_t dropPrivilegesToUID = 0;
int c; int c;
while ((c = getopt(argc, argv, "f:vs:h")) != -1) { while ((c = getopt(argc, argv, "f:vs:hn:")) != -1) {
switch (c) { switch (c) {
case 'f': case 'f':
configFilename = strdup(optarg); configFilename = strdup(optarg);
@ -338,6 +341,9 @@ int main(int argc, char **argv) {
case 's': case 's':
setfacility(optarg); setfacility(optarg);
break; break;
case 'n':
dropPrivilegesToUID = (uid_t) strtol(optarg, NULL, 10);
break;
case 'h': case 'h':
usage(); usage();
exit(0); exit(0);
@ -345,6 +351,14 @@ int main(int argc, char **argv) {
} }
} }
if ((getuid() == 0) && (dropPrivilegesToUID != 0)) {
logmsg(LOG_INFO, "dropping root privileges");
if (setuid(dropPrivilegesToUID) != 0) {
logmsg(LOG_ERR, "unable to drop root privileges");
exit(-1);
}
}
if (0 != initConfig(configFilename, &configHandle)) { if (0 != initConfig(configFilename, &configHandle)) {
logmsg(LOG_ERR, "error when reading configuration"); logmsg(LOG_ERR, "error when reading configuration");
exit(-1); exit(-1);