privs.h revision 941
10Sduke/* 22362Sohair * privs.h - header for privileged operations 30Sduke * Copyright (c) 1993 by Thomas Koenig 40Sduke * All rights reserved. 50Sduke * 60Sduke * Redistribution and use in source and binary forms, with or without 70Sduke * modification, are permitted provided that the following conditions 80Sduke * are met: 90Sduke * 1. Redistributions of source code must retain the above copyright 100Sduke * notice, this list of conditions and the following disclaimer. 110Sduke * 2. The name of the author(s) may not be used to endorse or promote 120Sduke * products derived from this software without specific prior written 130Sduke * permission. 140Sduke * 150Sduke * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR 160Sduke * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 170Sduke * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 180Sduke * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 192362Sohair * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 202362Sohair * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 212362Sohair * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 220Sduke * THEORY OF LIABILITY, WETHER IN CONTRACT, STRICT LIABILITY, OR TORT 230Sduke * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 240Sduke * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 250Sduke * 260Sduke * $Id: privs.h,v 1.1 1993/12/05 11:37:29 cgd Exp $ 270Sduke */ 280Sduke 2911822Sdarcy#ifndef _PRIVS_H 300Sduke#define _PRIVS_H 310Sduke 320Sduke#include <unistd.h> 330Sduke 340Sduke/* Relinquish privileges temporarily for a setuid program 350Sduke * with the option of getting them back later. This is done by swapping 360Sduke * the real and effective userid BSD style. Call RELINQUISH_PRIVS once 370Sduke * at the beginning of the main program. This will cause all operatons 380Sduke * to be executed with the real userid. When you need the privileges 390Sduke * of the setuid invocation, call PRIV_START; when you no longer 400Sduke * need it, call PRIV_END. Note that it is an error to call PRIV_START 410Sduke * and not PRIV_END within the same function. 420Sduke * 430Sduke * Use RELINQUISH_PRIVS_ROOT(a) if your program started out running 440Sduke * as root, and you want to drop back the effective userid to a 450Sduke * and the effective group id to b, with the option to get them back 460Sduke * later. 470Sduke * 480Sduke * If you no longer need root privileges, but those of some other 490Sduke * userid/groupid, you can call REDUCE_PRIV(a) when your effective 500Sduke * is the user's. 510Sduke * 520Sduke * Problems: Do not use return between PRIV_START and PRIV_END; this 530Sduke * will cause the program to continue running in an unprivileged 540Sduke * state. 550Sduke * 560Sduke * It is NOT safe to call exec(), system() or popen() with a user- 570Sduke * supplied program (i.e. without carefully checking PATH and any 580Sduke * library load paths) with relinquished privileges; the called program 590Sduke * can aquire them just as easily. Set both effective and real userid 600Sduke * to the real userid before calling any of them. 610Sduke */ 620Sduke 630Sduke#ifndef MAIN 640Sdukeextern 650Sduke#endif 660Sdukeuid_t real_uid, effective_uid; 670Sduke 680Sduke#define RELINQUISH_PRIVS { \ 690Sduke real_uid = getuid(); \ 700Sduke effective_uid = geteuid(); \ 710Sduke setreuid(effective_uid,real_uid); \ 720Sduke} 730Sduke 740Sduke#define RELINQUISH_PRIVS_ROOT(a) { \ 750Sduke real_uid = (a); \ 760Sduke effective_uid = geteuid(); \ 770Sduke setreuid(effective_uid,real_uid); \ 780Sduke} 790Sduke 800Sduke#define PRIV_START { \ 810Sduke setreuid(real_uid,effective_uid); 820Sduke 830Sduke#define PRIV_END \ 840Sduke setreuid(effective_uid,real_uid); \ 850Sduke} 860Sduke 870Sduke#define REDUCE_PRIV(a) { \ 880Sduke setreuid(real_uid,effective_uid); \ 890Sduke effective_uid = (a); \ 900Sduke setreuid(effective_uid,real_uid); \ 910Sduke} 920Sduke#endif 930Sduke