mirrors/passt
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Don't store UID & GID persistently in the context structure

Browse source 
c->uid and c->gid are first set in conf(), and last used in check_root()
itself called from conf().  Therefore these don't need to be fields in the
long lived context structure and can instead be locals in conf().

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
David Gibson 2022-09-12 22:23:59 +10:00 committed by Stefano Brivio
parent e2cae8f1c3
commit 7330ae3abf
4 changed files with 12 additions and 15 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
conf.c
View file

@ -1086,6 +1086,8 @@ void conf(struct ctx *c, int argc, char **argv)
uint32_t *dns4 = c->ip4.dns; uint32_t *dns4 = c->ip4.dns;
int name, ret, mask, b, i; int name, ret, mask, b, i;
unsigned int ifi = 0; unsigned int ifi = 0;
uid_t uid = 0;
gid_t gid = 0;
if (c->mode == MODE_PASTA) if (c->mode == MODE_PASTA)
c->no_dhcp_dns = c->no_dhcp_dns_search = 1; c->no_dhcp_dns = c->no_dhcp_dns_search = 1;
@ -1208,12 +1210,12 @@ void conf(struct ctx *c, int argc, char **argv)
c->trace = c->debug = c->foreground = 1; c->trace = c->debug = c->foreground = 1;
break; break;
case 12: case 12:
if (c->uid || c->gid) { if (uid || gid) {
err("Multiple --runas options given"); err("Multiple --runas options given");
usage(argv[0]); usage(argv[0]);
} }
if (conf_runas(optarg, &c->uid, &c->gid)) { if (conf_runas(optarg, &uid, &gid)) {
err("Invalid --runas option: %s", optarg); err("Invalid --runas option: %s", optarg);
usage(argv[0]); usage(argv[0]);
} }
@ -1497,7 +1499,7 @@ void conf(struct ctx *c, int argc, char **argv)
} }
} while (name != -1); } while (name != -1);
check_root(c); check_root(&uid, &gid);
if (c->mode == MODE_PASTA) { if (c->mode == MODE_PASTA) {
if (*netns && optind != argc) { if (*netns && optind != argc) {

5
passt.h
View file

@ -144,8 +144,6 @@ struct ip6_ctx {
* @sock_path: Path for UNIX domain socket * @sock_path: Path for UNIX domain socket
* @pcap: Path for packet capture file * @pcap: Path for packet capture file
* @pid_file: Path to PID file, empty string if not configured * @pid_file: Path to PID file, empty string if not configured
* @uid: UID we should drop to, if started as root
* @gid: GID we should drop to, if started as root
* @pasta_netns_fd: File descriptor for network namespace in pasta mode * @pasta_netns_fd: File descriptor for network namespace in pasta mode
* @pasta_userns_fd: Descriptor for user namespace to join, -1 once joined * @pasta_userns_fd: Descriptor for user namespace to join, -1 once joined
* @netns_only: In pasta mode, don't join or create a user namespace * @netns_only: In pasta mode, don't join or create a user namespace
@ -198,9 +196,6 @@ struct ctx {
char pcap[PATH_MAX]; char pcap[PATH_MAX];
char pid_file[PATH_MAX]; char pid_file[PATH_MAX];
uid_t uid;
uid_t gid;
int pasta_netns_fd; int pasta_netns_fd;
int pasta_userns_fd; int pasta_userns_fd;
int netns_only; int netns_only;

12
util.c
View file

@ -485,7 +485,7 @@ void drop_caps(void)
/** /**
* check_root() - Check if root in init ns, exit if we can't drop to user * check_root() - Check if root in init ns, exit if we can't drop to user
*/ */
void check_root(struct ctx *c) void check_root(uid_t *uid, gid_t *gid)
{ {
const char root_uid_map[] = " 0 0 4294967295"; const char root_uid_map[] = " 0 0 4294967295";
struct passwd *pw; struct passwd *pw;
@ -506,7 +506,7 @@ void check_root(struct ctx *c)
close(fd); close(fd);
if (!c->uid) { if (!*uid) {
fprintf(stderr, "Don't run as root. Changing to nobody...\n"); fprintf(stderr, "Don't run as root. Changing to nobody...\n");
#ifndef GLIBC_NO_STATIC_NSS #ifndef GLIBC_NO_STATIC_NSS
pw = getpwnam("nobody"); pw = getpwnam("nobody");
@ -515,17 +515,17 @@ void check_root(struct ctx *c)
exit(EXIT_FAILURE); exit(EXIT_FAILURE);
} }
c->uid = pw->pw_uid; *uid = pw->pw_uid;
c->gid = pw->pw_gid; *gid = pw->pw_gid;
#else #else
(void)pw; (void)pw;
/* Common value for 'nobody', not really specified */ /* Common value for 'nobody', not really specified */
c->uid = c->gid = 65534; *uid = *gid = 65534;
#endif #endif
} }
if (!setgroups(0, NULL) && !setgid(c->gid) && !setuid(c->uid)) if (!setgroups(0, NULL) && !setgid(*gid) && !setuid(*uid))
return; return;
fprintf(stderr, "Can't change user/group, exiting"); fprintf(stderr, "Can't change user/group, exiting");

2
util.h
View file

@ -234,7 +234,7 @@ char *line_read(char *buf, size_t len, int fd);
void procfs_scan_listen(struct ctx *c, uint8_t proto, int ip_version, int ns, void procfs_scan_listen(struct ctx *c, uint8_t proto, int ip_version, int ns,
uint8_t *map, uint8_t *exclude); uint8_t *map, uint8_t *exclude);
void drop_caps(void); void drop_caps(void);
void check_root(struct ctx *c); void check_root(uid_t *uid, gid_t *gid);
int ns_enter(const struct ctx *c); int ns_enter(const struct ctx *c);
void write_pidfile(int fd, pid_t pid); void write_pidfile(int fd, pid_t pid);
int __daemon(int pidfile_fd, int devnull_fd); int __daemon(int pidfile_fd, int devnull_fd);