sys: move getpwnam() call to main.c

Pass uid/gid instead of user name to the root dropping function.

diff --git a/main.c b/main.c
index c3c55744c96e494de149fb312465c2a1cd1e517b..25f05dc6c547a8e0635bcf0447d671fb27e4099d 100644 (file)
--- a/main.c
+++ b/main.c
@@ -350,6 +350,7 @@ int main
   const char *conf_file = DEFAULT_CONF_FILE;
   const char *progname = argv[0];
   char *user = NULL;
+  struct passwd *pw;
   int debug = 0, nofork = 0, address_family = IPADDR_UNSPEC;
   int do_init_rtc = 0, restarted = 0;
   int other_pid;
@@ -488,8 +489,12 @@ int main
   if (!user) {
     user = CNF_GetUser();
   }
+
   if (user && strcmp(user, "root")) {
-    SYS_DropRoot(user);
+    if ((pw = getpwnam(user)) == NULL)
+      LOG_FATAL(LOGF_Main, "Could not get %s uid/gid", user);
+
+    SYS_DropRoot(pw->pw_uid, pw->pw_gid);
   }
 
   LOG_CreateLogFileDir();

diff --git a/sys.c b/sys.c
index f0c81df654cff1c4fd5e03fa87fb6255e5d0319f..a407fb680f112601078290c010fd13cb630b2427 100644 (file)
--- a/sys.c
+++ b/sys.c
@@ -27,6 +27,8 @@
 
 #include "config.h"
 
+#include "sysincl.h"
+
 #include "sys.h"
 #include "logging.h"
 
@@ -107,10 +109,10 @@ SYS_Finalise(void)
 
 /* ================================================== */
 
-void SYS_DropRoot(char *user)
+void SYS_DropRoot(uid_t uid, gid_t gid)
 {
 #if defined(LINUX) && defined (FEAT_PRIVDROP)
-  SYS_Linux_DropRoot(user);
+  SYS_Linux_DropRoot(uid, gid);
 #else
   LOG_FATAL(LOGF_Sys, "dropping root privileges not supported");
 #endif

diff --git a/sys.h b/sys.h
index 569ecdb820e43abf6e8c8542cc45c38188122c68..a3f58c04aad375c457f77b55d0a74cef2f744ba7 100644 (file)
--- a/sys.h
+++ b/sys.h
@@ -35,8 +35,8 @@ extern void SYS_Initialise(void);
 /* Called at the end of the run to do final clean-up */
 extern void SYS_Finalise(void);
 
-/* Drop root privileges to the specified user */
-extern void SYS_DropRoot(char *user);
+/* Drop root privileges to the specified user and group */
+extern void SYS_DropRoot(uid_t uid, gid_t gid);
 
 extern void SYS_SetScheduler(int SchedPriority);
 extern void SYS_LockMemory(void);

diff --git a/sys_linux.c b/sys_linux.c
index fc0249a26e3c61e2c7418092bbac58a2f6eca498..3c9b0cd8182a3414a2d4067e25a62e04f26896da 100644 (file)
--- a/sys_linux.c
+++ b/sys_linux.c
@@ -45,8 +45,6 @@ int LockAll = 0;
 #endif
 
 #ifdef FEAT_PRIVDROP
-#include <sys/types.h>
-#include <pwd.h>
 #include <sys/prctl.h>
 #include <sys/capability.h>
 #include <grp.h>
@@ -382,18 +380,10 @@ SYS_Linux_Finalise(void)
 
 #ifdef FEAT_PRIVDROP
 void
-SYS_Linux_DropRoot(char *user)
+SYS_Linux_DropRoot(uid_t uid, gid_t gid)
 {
-  struct passwd *pw;
   cap_t cap;
 
-  if (user == NULL)
-    return;
-
-  if ((pw = getpwnam(user)) == NULL) {
-    LOG_FATAL(LOGF_SysLinux, "getpwnam(%s) failed", user);
-  }
-
   if (prctl(PR_SET_KEEPCAPS, 1)) {
     LOG_FATAL(LOGF_SysLinux, "prctl() failed");
   }
@@ -402,12 +392,12 @@ SYS_Linux_DropRoot(char *user)
     LOG_FATAL(LOGF_SysLinux, "setgroups() failed");
   }
 
-  if (setgid(pw->pw_gid)) {
-    LOG_FATAL(LOGF_SysLinux, "setgid(%d) failed", pw->pw_gid);
+  if (setgid(gid)) {
+    LOG_FATAL(LOGF_SysLinux, "setgid(%d) failed", gid);
   }
 
-  if (setuid(pw->pw_uid)) {
-    LOG_FATAL(LOGF_SysLinux, "setuid(%d) failed", pw->pw_uid);
+  if (setuid(uid)) {
+    LOG_FATAL(LOGF_SysLinux, "setuid(%d) failed", uid);
   }
 
   if ((cap = cap_from_text("cap_net_bind_service,cap_sys_time=ep")) == NULL) {
@@ -420,7 +410,7 @@ SYS_Linux_DropRoot(char *user)
 
   cap_free(cap);
 
-  DEBUG_LOG(LOGF_SysLinux, "Privileges dropped to user %s", user);
+  DEBUG_LOG(LOGF_SysLinux, "Root dropped to uid %d gid %d", uid, gid);
 }
 #endif
 

diff --git a/sys_linux.h b/sys_linux.h
index 46caf358a5aa8d6590f3e73ad724013fb6b339c7..6c69082b4f89d50711e597eb256ae20f01cbdbff 100644 (file)
--- a/sys_linux.h
+++ b/sys_linux.h
@@ -31,7 +31,7 @@ extern void SYS_Linux_Initialise(void);
 
 extern void SYS_Linux_Finalise(void);
 
-extern void SYS_Linux_DropRoot(char *user);
+extern void SYS_Linux_DropRoot(uid_t uid, gid_t gid);
 
 extern void SYS_Linux_MemLockAll(int LockAll);
 

diff --git a/sysincl.h b/sysincl.h
index 5c1fb374f1123b0426c423a5d9f2720515cddafd..31ddde4941addf30318e0db53990d5fb64f821b5 100644 (file)
--- a/sysincl.h
+++ b/sysincl.h
@@ -45,6 +45,7 @@
 #include <math.h>
 #include <netdb.h>
 #include <netinet/in.h>
+#include <pwd.h>
 #include <resolv.h>
 #include <signal.h>
 #include <stdarg.h>