Of course, Linux has to do things differently

This commit is contained in:
Frank Denis 2018-10-03 16:33:33 +02:00
parent d49a7b462d
commit a74c0fedeb
2 changed files with 95 additions and 1 deletions

View File

@ -0,0 +1,94 @@
package main
import (
"os"
"os/exec"
"os/user"
"path/filepath"
"runtime"
"strconv"
"syscall"
"github.com/jedisct1/dlog"
)
var cmd *exec.Cmd
func (proxy *Proxy) dropPrivilege(userStr string, fds []*os.File) {
currentUser, err := user.Current()
if err != nil {
dlog.Fatal(err)
}
if currentUser.Uid != "0" {
dlog.Fatal("I need root permissions. Try again with 'sudo'")
}
user, err := user.Lookup(userStr)
args := os.Args
if err != nil {
dlog.Fatal(err)
}
uid, err := strconv.Atoi(user.Uid)
if err != nil {
dlog.Fatal(err)
}
gid, err := strconv.Atoi(user.Gid)
if err != nil {
dlog.Fatal(err)
}
execPath, err := exec.LookPath(args[0])
if err != nil {
dlog.Fatal(err)
}
path, err := filepath.Abs(execPath)
if err != nil {
dlog.Fatal(err)
}
ServiceManagerReadyNotify()
args = append(args, "-child")
dlog.Notice("Dropping privileges")
runtime.LockOSThread()
if _, _, rcode := syscall.RawSyscall(syscall.SYS_SETGROUPS, uintptr(0), uintptr(0), 0); rcode != 0 {
dlog.Fatalf("Unable to drop additional groups: %s", err)
}
if _, _, rcode := syscall.RawSyscall(syscall.SYS_SETGID, uintptr(gid), 0, 0); rcode != 0 {
dlog.Fatalf("Unable to drop user privileges: %s", err)
}
if _, _, rcode := syscall.RawSyscall(syscall.SYS_SETUID, uintptr(uid), 0, 0); rcode != 0 {
dlog.Fatalf("Unable to drop user privileges: %s", err)
}
maxfd := uintptr(0)
for _, fd := range fds {
if fd.Fd() > maxfd {
maxfd = fd.Fd()
}
}
fdbase := maxfd + 1
for i, fd := range fds {
if _, _, rcode := syscall.RawSyscall(syscall.SYS_DUP3, fd.Fd(), fdbase+uintptr(i), 0); rcode != 0 {
dlog.Fatal("Unable to clone file descriptor")
}
if _, _, rcode := syscall.RawSyscall(syscall.SYS_FCNTL, fd.Fd(), syscall.F_SETFD, syscall.FD_CLOEXEC); rcode != 0 {
dlog.Fatal("Unable to set the close on exec flag")
}
}
for i := range fds {
if _, _, rcode := syscall.RawSyscall(syscall.SYS_DUP3, fdbase+uintptr(i), uintptr(i)+3, 0); rcode != 0 {
dlog.Fatal("Unable to reassign descriptor")
}
}
syscall.Exec(path, args, os.Environ())
dlog.Fatalf("Unable to reexecute [%s]", path)
os.Exit(1)
}
func killChild() {
if cmd != nil {
if err := cmd.Process.Kill(); err != nil {
dlog.Fatal("Failed to kill child process.")
}
}
}

View File

@ -1,4 +1,4 @@
// +build !windows
// +build !windows,!linux
package main