src/daemon/caps.c

   1 /***
   2   This file is part of PulseAudio.
   3
   4   Copyright 2004-2006 Lennart Poettering
   5   Copyright 2006 Pierre Ossman <ossman@cendio.se> for Cendio AB
   6
   7   PulseAudio is free software; you can redistribute it and/or modify
   8   it under the terms of the GNU Lesser General Public License as published
   9   by the Free Software Foundation; either version 2.1 of the License,
  10   or (at your option) any later version.
  11
  12   PulseAudio is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with PulseAudio; if not, write to the Free Software
  19   Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
  20   USA.
  21 ***/
  22
  23 #ifdef HAVE_CONFIG_H
  24 #include <config.h>
  25 #endif
  26
  27 #include <unistd.h>
  28 #include <errno.h>
  29 #include <sys/types.h>
  30
  31 #include <pulse/i18n.h>
  32
  33 #include <pulsecore/macro.h>
  34 #include <pulsecore/log.h>
  35
  36 #ifdef HAVE_SYS_CAPABILITY_H
  37 #include <sys/capability.h>
  38 #endif
  39
  40 #ifdef HAVE_SYS_PRCTL_H
  41 #include <sys/prctl.h>
  42 #endif
  43
  44 #include "caps.h"
  45
  46 /* Glibc <= 2.2 has broken unistd.h */
  47 #if defined(linux) && (__GLIBC__ <= 2 && __GLIBC_MINOR__ <= 2)
  48 int setresgid(gid_t r, gid_t e, gid_t s);
  49 int setresuid(uid_t r, uid_t e, uid_t s);
  50 #endif
  51
  52 /* Drop root rights when called SUID root */
  53 void pa_drop_root(void) {
  54
  55 #ifdef HAVE_GETUID
  56     uid_t uid;
  57     gid_t gid;
  58
  59     pa_log_debug(_("Cleaning up privileges."));
  60     uid = getuid();
  61     gid = getgid();
  62
  63 #if defined(HAVE_SETRESUID)
  64     pa_assert_se(setresuid(uid, uid, uid) >= 0);
  65     pa_assert_se(setresgid(gid, gid, gid) >= 0);
  66 #elif defined(HAVE_SETREUID)
  67     pa_assert_se(setreuid(uid, uid) >= 0);
  68     pa_assert_se(setregid(gid, gid) >= 0);
  69 #else
  70     pa_assert_se(setuid(uid) >= 0);
  71     pa_assert_se(seteuid(uid) >= 0);
  72     pa_assert_se(setgid(gid) >= 0);
  73     pa_assert_se(setegid(gid) >= 0);
  74 #endif
  75
  76     pa_assert_se(getuid() == uid);
  77     pa_assert_se(geteuid() == uid);
  78     pa_assert_se(getgid() == gid);
  79     pa_assert_se(getegid() == gid);
  80 #endif
  81
  82 #ifdef HAVE_SYS_PRCTL_H
  83     pa_assert_se(prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0) == 0);
  84 #endif
  85
  86 #ifdef HAVE_SYS_CAPABILITY_H
  87     if (uid != 0) {
  88         cap_t caps;
  89         pa_assert_se(caps = cap_init());
  90         pa_assert_se(cap_clear(caps) == 0);
  91         pa_assert_se(cap_set_proc(caps) == 0);
  92         pa_assert_se(cap_free(caps) == 0);
  93     }
  94 #endif
  95 }