privs.h revision 941
1941Snate/* 2941Snate * privs.h - header for privileged operations 3941Snate * Copyright (c) 1993 by Thomas Koenig 4941Snate * All rights reserved. 5941Snate * 6941Snate * Redistribution and use in source and binary forms, with or without 7941Snate * modification, are permitted provided that the following conditions 8941Snate * are met: 9941Snate * 1. Redistributions of source code must retain the above copyright 10941Snate * notice, this list of conditions and the following disclaimer. 11941Snate * 2. The name of the author(s) may not be used to endorse or promote 12941Snate * products derived from this software without specific prior written 13941Snate * permission. 14941Snate * 15941Snate * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR 16941Snate * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 17941Snate * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 18941Snate * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 19941Snate * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 20941Snate * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 21941Snate * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 22941Snate * THEORY OF LIABILITY, WETHER IN CONTRACT, STRICT LIABILITY, OR TORT 23941Snate * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 24941Snate * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 25941Snate * 26941Snate * $Id: privs.h,v 1.1 1993/12/05 11:37:29 cgd Exp $ 27941Snate */ 28941Snate 29941Snate#ifndef _PRIVS_H 30941Snate#define _PRIVS_H 31941Snate 32941Snate#include <unistd.h> 33941Snate 34941Snate/* Relinquish privileges temporarily for a setuid program 35941Snate * with the option of getting them back later. This is done by swapping 36941Snate * the real and effective userid BSD style. Call RELINQUISH_PRIVS once 37941Snate * at the beginning of the main program. This will cause all operatons 38941Snate * to be executed with the real userid. When you need the privileges 39941Snate * of the setuid invocation, call PRIV_START; when you no longer 40941Snate * need it, call PRIV_END. Note that it is an error to call PRIV_START 41941Snate * and not PRIV_END within the same function. 42941Snate * 43941Snate * Use RELINQUISH_PRIVS_ROOT(a) if your program started out running 44941Snate * as root, and you want to drop back the effective userid to a 45941Snate * and the effective group id to b, with the option to get them back 46941Snate * later. 47941Snate * 48941Snate * If you no longer need root privileges, but those of some other 49941Snate * userid/groupid, you can call REDUCE_PRIV(a) when your effective 50941Snate * is the user's. 51941Snate * 52941Snate * Problems: Do not use return between PRIV_START and PRIV_END; this 53941Snate * will cause the program to continue running in an unprivileged 54941Snate * state. 55941Snate * 56941Snate * It is NOT safe to call exec(), system() or popen() with a user- 57941Snate * supplied program (i.e. without carefully checking PATH and any 58941Snate * library load paths) with relinquished privileges; the called program 59941Snate * can aquire them just as easily. Set both effective and real userid 60941Snate * to the real userid before calling any of them. 61941Snate */ 62941Snate 63941Snate#ifndef MAIN 64941Snateextern 65941Snate#endif 66941Snateuid_t real_uid, effective_uid; 67941Snate 68941Snate#define RELINQUISH_PRIVS { \ 69941Snate real_uid = getuid(); \ 70941Snate effective_uid = geteuid(); \ 71941Snate setreuid(effective_uid,real_uid); \ 72941Snate} 73941Snate 74941Snate#define RELINQUISH_PRIVS_ROOT(a) { \ 75941Snate real_uid = (a); \ 76941Snate effective_uid = geteuid(); \ 77941Snate setreuid(effective_uid,real_uid); \ 78941Snate} 79941Snate 80941Snate#define PRIV_START { \ 81941Snate setreuid(real_uid,effective_uid); 82941Snate 83941Snate#define PRIV_END \ 84941Snate setreuid(effective_uid,real_uid); \ 85941Snate} 86941Snate 87941Snate#define REDUCE_PRIV(a) { \ 88941Snate setreuid(real_uid,effective_uid); \ 89941Snate effective_uid = (a); \ 90941Snate setreuid(effective_uid,real_uid); \ 91941Snate} 92941Snate#endif 93