From b06374f6a518584fc40f58e42dae14ee93f645f2 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Tue, 14 Apr 2020 10:31:49 +0200 Subject: [PATCH] file-logger: Set owner/group of log file The file is usually opened/created by root, however, if user/group IDs are configured and the configuration is reloaded, the file will be reopened as configured user. Like with UNIX sockets we only attempt to change the user if we have CAP_CHOWN allowing a start as regular user. We don't have chown() on Windows, so check for it. --- configure.ac | 2 +- src/libcharon/bus/listeners/file_logger.c | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index 7788121e1..867b2040d 100644 --- a/configure.ac +++ b/configure.ac @@ -661,7 +661,7 @@ AC_CHECK_FUNC( ] ) -AC_CHECK_FUNCS(prctl mallinfo getpass closefrom getpwnam_r getgrnam_r getpwuid_r) +AC_CHECK_FUNCS(prctl mallinfo getpass closefrom getpwnam_r getgrnam_r getpwuid_r chown) AC_CHECK_FUNCS(fmemopen funopen mmap memrchr setlinebuf strptime dirfd sigwaitinfo explicit_bzero) AC_CHECK_FUNC([syslog], [ diff --git a/src/libcharon/bus/listeners/file_logger.c b/src/libcharon/bus/listeners/file_logger.c index d1f180227..704c4a510 100644 --- a/src/libcharon/bus/listeners/file_logger.c +++ b/src/libcharon/bus/listeners/file_logger.c @@ -243,6 +243,25 @@ METHOD(file_logger_t, open_, void, this->filename, strerror(errno)); return; } +#ifdef HAVE_CHOWN + if (lib->caps->check(lib->caps, CAP_CHOWN)) + { + if (chown(this->filename, lib->caps->get_uid(lib->caps), + lib->caps->get_gid(lib->caps)) != 0) + { + DBG1(DBG_NET, "changing owner/group for '%s' failed: %s", + this->filename, strerror(errno)); + } + } + else + { + if (chown(this->filename, -1, lib->caps->get_gid(lib->caps)) != 0) + { + DBG1(DBG_NET, "changing group for '%s' failed: %s", + this->filename, strerror(errno)); + } + } +#endif /* HAVE_CHOWN */ #ifdef HAVE_SETLINEBUF if (flush_line) {