diff options
Diffstat (limited to 'lib')
| -rw-r--r-- | lib/lib.h | 3 | ||||
| -rw-r--r-- | lib/xwrap.c | 23 |
2 files changed, 17 insertions, 9 deletions
@@ -109,11 +109,12 @@ void xstat(char *path, struct stat *st); char *xabspath(char *path, int exact); char *xrealpath(char *path); void xchdir(char *path); +void xchroot(char *path); void xmkpath(char *path, int mode); -void xsetuid(uid_t uid); struct passwd *xgetpwuid(uid_t uid); struct group *xgetgrgid(gid_t gid); struct passwd *xgetpwnam(char *name); +void xsetuser(struct passwd *pwd); char *xreadlink(char *name); long xparsetime(char *arg, long units, long *fraction); void xpidfile(char *name); diff --git a/lib/xwrap.c b/lib/xwrap.c index c0c8a44b..08a93ddf 100644 --- a/lib/xwrap.c +++ b/lib/xwrap.c @@ -363,6 +363,12 @@ void xchdir(char *path) if (chdir(path)) error_exit("chdir '%s'", path); } +void xchroot(char *path) +{ + if (chroot(path)) error_exit("chroot '%s'", path); + xchdir("/"); +} + // Ensure entire path exists. // If mode != -1 set permissions on newly created dirs. // Requires that path string be writable (for temporary null terminators). @@ -391,14 +397,6 @@ void xmkpath(char *path, int mode) } } -// setuid() can fail (for example, too many processes belonging to that user), -// which opens a security hole if the process continues as the original user. - -void xsetuid(uid_t uid) -{ - if (setuid(uid)) perror_exit("xsetuid"); -} - struct passwd *xgetpwuid(uid_t uid) { struct passwd *pwd = getpwuid(uid); @@ -420,6 +418,15 @@ struct passwd *xgetpwnam(char *name) return up; } +// setuid() can fail (for example, too many processes belonging to that user), +// which opens a security hole if the process continues as the original user. + +void xsetuser(struct passwd *pwd) +{ + if (initgroups(pwd->pw_name, pwd->pw_gid) || setgid(pwd->pw_uid) + || setuid(pwd->pw_uid)) perror_exit("xsetuser '%s'", pwd->pw_name); +} + // This can return null (meaning file not found). It just won't return null // for memory allocation reasons. char *xreadlink(char *name) |