denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactored heavily #ifdefd capability code to its own libstrongswan class

Browse Source
This commit is contained in:
Martin Willi
2012-07-04 11:01:40 +02:00
parent 644c6c968d
commit 0619ddfaa4
16 changed files with 393 additions and 233 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon-nm/charon-nm.c
+5 -53
View File
@@ -18,11 +18,6 @@
#include <signal.h>
#include <sys/types.h>
#include <unistd.h>
#include <pwd.h>
#include <grp.h>
#ifdef HAVE_PRCTL
#include <sys/prctl.h>
#endif
#include <hydra.h>
#include <daemon.h>
@@ -149,63 +144,20 @@ static void initialize_logger()
static bool lookup_uid_gid()
{
#ifdef IPSEC_USER
if (!charon->caps->resolve_uid(charon->caps, IPSEC_USER))
{
char buf[1024];
struct passwd passwd, *pwp;
if (getpwnam_r(IPSEC_USER, &passwd, buf, sizeof(buf), &pwp) != 0 ||
pwp == NULL)
{
DBG1(DBG_DMN, "resolving user '"IPSEC_USER"' failed");
return FALSE;
}
charon->uid = pwp->pw_uid;
return FALSE;
}
#endif
#ifdef IPSEC_GROUP
if (!charon->caps->resolve_gid(charon->caps, IPSEC_GROUP))
{
char buf[1024];
struct group group, *grp;
if (getgrnam_r(IPSEC_GROUP, &group, buf, sizeof(buf), &grp) != 0 ||
grp == NULL)
{
DBG1(DBG_DMN, "resolving group '"IPSEC_GROUP"' failed");
return FALSE;
}
charon->gid = grp->gr_gid;
return FALSE;
}
#endif
return TRUE;
}
/**
* Drop process capabilities
*/
static bool drop_capabilities()
{
#ifdef HAVE_PRCTL
prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0);
#endif
if (setgid(charon->gid) != 0)
{
DBG1(DBG_DMN, "change to unprivileged group failed");
return FALSE;
}
if (setuid(charon->uid) != 0)
{
DBG1(DBG_DMN, "change to unprivileged user failed");
return FALSE;
}
if (!charon->drop_capabilities(charon))
{
DBG1(DBG_DMN, "unable to drop daemon capabilities");
return FALSE;
}
return TRUE;
}
/**
* Main function, starts NetworkManager backend.
*/
@@ -275,7 +227,7 @@ int main(int argc, char *argv[])
goto deinit;
}
if (!drop_capabilities())
if (!charon->caps->drop(charon->caps))
{
DBG1(DBG_DMN, "capability dropping failed - aborting charon-nm");
goto deinit;
src/charon-nm/nm/nm_backend.c
+2 -2
View File
@@ -137,7 +137,7 @@ static bool nm_backend_init()
}
/* bypass file permissions to read from users ssh-agent */
charon->keep_cap(charon, CAP_DAC_OVERRIDE);
charon->caps->keep(charon->caps, CAP_DAC_OVERRIDE);
lib->processor->queue_job(lib->processor,
(job_t*)callback_job_create_with_prio((callback_job_cb_t)run, this,
@@ -171,4 +171,4 @@ void nm_backend_register()
};
lib->plugins->add_static_features(lib->plugins, "nm-backend", features,
countof(features), TRUE);
}
}