1/*-
2 *  privs.h - header for privileged operations
3 *
4 * SPDX-License-Identifier: BSD-2-Clause
5 *
6 *  Copyright (C) 1993  Thomas Koenig
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 *    notice, this list of conditions and the following disclaimer.
13 * 2. The name of the author(s) may not be used to endorse or promote
14 *    products derived from this software without specific prior written
15 *    permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
18 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
19 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
20 * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
21 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
22 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
23 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
24 * THEORY OF LIABILITY, WETHER IN CONTRACT, STRICT LIABILITY, OR TORT
25 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
26 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
27 */
28
29#ifndef _PRIVS_H
30#define _PRIVS_H
31
32#include <unistd.h>
33
34/* Relinquish privileges temporarily for a setuid or setgid program
35 * with the option of getting them back later.  This is done by
36 * utilizing POSIX saved user and group IDs.  Call RELINQUISH_PRIVS once
37 * at the beginning of the main program.  This will cause all operations
38 * to be executed with the real userid.  When you need the privileges
39 * of the setuid/setgid invocation, call PRIV_START; when you no longer
40 * need it, call PRIV_END.  Note that it is an error to call PRIV_START
41 * and not PRIV_END within the same function.
42 *
43 * Use RELINQUISH_PRIVS_ROOT(a,b) if your program started out running
44 * as root, and you want to drop back the effective userid to a
45 * and the effective group id to b, with the option to get them back
46 * later.
47 *
48 * If you no longer need root privileges, but those of some other
49 * userid/groupid, you can call REDUCE_PRIV(a,b) when your effective
50 * is the user's.
51 *
52 * Problems: Do not use return between PRIV_START and PRIV_END; this
53 * will cause the program to continue running in an unprivileged
54 * state.
55 *
56 * It is NOT safe to call exec(), system() or popen() with a user-
57 * supplied program (i.e. without carefully checking PATH and any
58 * library load paths) with relinquished privileges; the called program
59 * can acquire them just as easily.  Set both effective and real userid
60 * to the real userid before calling any of them.
61 */
62
63extern uid_t real_uid, effective_uid;
64extern gid_t real_gid, effective_gid;
65
66#ifdef MAIN
67uid_t real_uid, effective_uid;
68gid_t real_gid, effective_gid;
69#endif
70
71#define RELINQUISH_PRIVS { \
72	real_uid = getuid(); \
73	effective_uid = geteuid(); \
74	real_gid = getgid(); \
75	effective_gid = getegid(); \
76	if (seteuid(real_uid) != 0) err(1, "seteuid failed"); \
77	if (setegid(real_gid) != 0) err(1, "setegid failed"); \
78}
79
80#define RELINQUISH_PRIVS_ROOT(a, b) { \
81	real_uid = (a); \
82	effective_uid = geteuid(); \
83	real_gid = (b); \
84	effective_gid = getegid(); \
85	if (setegid(real_gid) != 0) err(1, "setegid failed"); \
86	if (seteuid(real_uid) != 0) err(1, "seteuid failed"); \
87}
88
89#define PRIV_START { \
90	if (seteuid(effective_uid) != 0) err(1, "seteuid failed"); \
91	if (setegid(effective_gid) != 0) err(1, "setegid failed"); \
92}
93
94#define PRIV_END { \
95	if (setegid(real_gid) != 0) err(1, "setegid failed"); \
96	if (seteuid(real_uid) != 0) err(1, "seteuid failed"); \
97}
98
99#define REDUCE_PRIV(a, b) { \
100	PRIV_START \
101	effective_uid = (a); \
102	effective_gid = (b); \
103	if (setregid((gid_t)-1, effective_gid) != 0) err(1, "setregid failed"); \
104	if (setreuid((uid_t)-1, effective_uid) != 0) err(1, "setreuid failed"); \
105	PRIV_END \
106}
107#endif
108