From: Alan T. DeKok <aland@freeradius.org>
Date: Fri, 2 Nov 2018 12:17:19 +0000 (-0400)
Subject: add suid up/down for DHCP
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ecb8516030decaa639972e05ecea456edf7c0623;p=thirdparty%2Ffreeradius-server.git

add suid up/down for DHCP
---

diff --git a/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c b/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c
index 5147e8f76c9..5d0bfd8e52b 100644
--- a/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c
+++ b/src/modules/proto_dhcpv4/proto_dhcpv4_udp.c
@@ -462,7 +462,7 @@ static int mod_open(fr_listen_t *li)
 	proto_dhcpv4_udp_t const	*inst = talloc_get_type_abort_const(li->app_io_instance, proto_dhcpv4_udp_t);
 	proto_dhcpv4_udp_thread_t	*thread = talloc_get_type_abort(li->thread_instance, proto_dhcpv4_udp_thread_t);
 
-	int				sockfd;
+	int				sockfd, rcode;
 	uint16_t			port = inst->port;
 	CONF_SECTION			*server_cs;
 	CONF_ITEM			*ci;
@@ -498,7 +498,13 @@ static int mod_open(fr_listen_t *li)
 		}
 	}
 
-	if (fr_socket_bind(sockfd, &inst->ipaddr, &port, inst->interface) < 0) {
+	/*
+	 *	SUID up is really only needed if interface is set, OR port <1024.
+	 */
+	rad_suid_up();
+	rcode = fr_socket_bind(sockfd, &inst->ipaddr, &port, inst->interface);
+	rad_suid_down();
+	if (rcode < 0) {
 		close(sockfd);
 		PERROR("Failed binding socket");
 		goto error;