xref: /freebsd/usr.bin/at/privs.h (revision 1e413cf93298b5b97441a21d9a50fdcd0ee9945e)
1 /*
2  *  privs.h - header for privileged operations
3  *  Copyright (C) 1993  Thomas Koenig
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. The name of the author(s) may not be used to endorse or promote
11  *    products derived from this software without specific prior written
12  *    permission.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS OR
15  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
16  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
17  * IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT, INDIRECT,
18  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
19  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
20  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
21  * THEORY OF LIABILITY, WETHER IN CONTRACT, STRICT LIABILITY, OR TORT
22  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
23  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
24  *
25  * $FreeBSD$
26  */
27 
28 #ifndef _PRIVS_H
29 #define _PRIVS_H
30 
31 #include <unistd.h>
32 
33 /* Relinquish privileges temporarily for a setuid or setgid program
34  * with the option of getting them back later.  This is done by
35  * utilizing POSIX saved user and group IDs.  Call RELINQUISH_PRIVS once
36  * at the beginning of the main program.  This will cause all operations
37  * to be executed with the real userid.  When you need the privileges
38  * of the setuid/setgid invocation, call PRIV_START; when you no longer
39  * need it, call PRIV_END.  Note that it is an error to call PRIV_START
40  * and not PRIV_END within the same function.
41  *
42  * Use RELINQUISH_PRIVS_ROOT(a,b) if your program started out running
43  * as root, and you want to drop back the effective userid to a
44  * and the effective group id to b, with the option to get them back
45  * later.
46  *
47  * If you no longer need root privileges, but those of some other
48  * userid/groupid, you can call REDUCE_PRIV(a,b) when your effective
49  * is the user's.
50  *
51  * Problems: Do not use return between PRIV_START and PRIV_END; this
52  * will cause the program to continue running in an unprivileged
53  * state.
54  *
55  * It is NOT safe to call exec(), system() or popen() with a user-
56  * supplied program (i.e. without carefully checking PATH and any
57  * library load paths) with relinquished privileges; the called program
58  * can acquire them just as easily.  Set both effective and real userid
59  * to the real userid before calling any of them.
60  */
61 
62 #ifndef MAIN
63 extern
64 #endif
65 uid_t real_uid, effective_uid;
66 
67 #ifndef MAIN
68 extern
69 #endif
70 gid_t real_gid, effective_gid;
71 
72 #define RELINQUISH_PRIVS { \
73 	real_uid = getuid(); \
74 	effective_uid = geteuid(); \
75 	real_gid = getgid(); \
76 	effective_gid = getegid(); \
77 	seteuid(real_uid); \
78 	setegid(real_gid); \
79 }
80 
81 #define RELINQUISH_PRIVS_ROOT(a, b) { \
82 	real_uid = (a); \
83 	effective_uid = geteuid(); \
84 	real_gid = (b); \
85 	effective_gid = getegid(); \
86 	setegid(real_gid); \
87 	seteuid(real_uid); \
88 }
89 
90 #define PRIV_START { \
91 	seteuid(effective_uid); \
92 	setegid(effective_gid); \
93 }
94 
95 #define PRIV_END { \
96 	setegid(real_gid); \
97 	seteuid(real_uid); \
98 }
99 
100 #define REDUCE_PRIV(a, b) { \
101 	PRIV_START \
102 	effective_uid = (a); \
103 	effective_gid = (b); \
104 	setreuid((uid_t)-1, effective_uid); \
105 	setregid((gid_t)-1, effective_gid); \
106 	PRIV_END \
107 }
108 #endif
109