experiments/clixon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

* Added autotool check for getresuid (and related functions) necessary for lowering of priviliges for backend and restconf

Browse source 
* If getresuid is not available, CLICON_RESTCONF_PRIVILEGES must be set to 'none'
This commit is contained in:
Olof hagsand 2021-06-11 11:02:22 +02:00
parent e24e2eb78b
commit 5ead099d0b
6 changed files with 26 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
CHANGELOG.md
View file

@ -77,6 +77,8 @@ Users may have to change how they access the system
### Minor features
* Added autotool check for getresuid (+ related functions) necessary for lowering of priviliges for backend and restconf
* If getresuid is not available, CLICON_RESTCONF_PRIVILEGES must be set to 'none'
* Added new startup-mode: `running-startup`: First try running db, if it is empty try startup db.
* See [Can startup mode to be extended to support running-startup mode? #234](https://github.com/clicon/clixon/issues/234)
* Restconf: added inline configuration using `-R <xml>` command line as an alternative to making advanced restconf configuration

2
configure vendored
View file

@ -5564,7 +5564,7 @@ fi
fi
#
for ac_func in inet_aton sigaction sigvec strlcpy strsep strndup alphasort versionsort getpeereid setns
for ac_func in inet_aton sigaction sigvec strlcpy strsep strndup alphasort versionsort getpeereid setns getresuid
do :
as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"

2
configure.ac
View file

@ -296,7 +296,7 @@ if test "${with_libxml2}"; then
fi
#
AC_CHECK_FUNCS(inet_aton sigaction sigvec strlcpy strsep strndup alphasort versionsort getpeereid setns)
AC_CHECK_FUNCS(inet_aton sigaction sigvec strlcpy strsep strndup alphasort versionsort getpeereid setns getresuid)
# Checks for getsockopt options for getting unix socket peer credentials on
# Linux

3
include/clixon_config.h.in
View file

@ -30,6 +30,9 @@
/* Define to 1 if you have the `getpeereid' function. */
#undef HAVE_GETPEEREID
/* Define to 1 if you have the `getresuid' function. */
#undef HAVE_GETRESUID
/* Define to 1 if you have the `inet_aton' function. */
#undef HAVE_INET_ATON

15
lib/src/clixon_uid.c
View file

@ -170,6 +170,7 @@ uid2name(const uid_t uid,
int
drop_priv_temp(uid_t new_uid)
{
#ifdef HAVE_GETRESUID
int retval = -1;
/* XXX: implicit declaration of function 'setresuid' on travis */
@ -184,6 +185,10 @@ drop_priv_temp(uid_t new_uid)
retval = 0;
done:
return retval;
#else
clicon_debug(1, "%s Drop privileges not implemented on this platform since getresuid is not available", __FUNCTION__);
return 0;
#endif
}
/*! Permanently drop privileges
@ -192,6 +197,7 @@ drop_priv_temp(uid_t new_uid)
int
drop_priv_perm(uid_t new_uid)
{
#ifdef HAVE_GETRESUID
int retval = -1;
uid_t ruid;
uid_t euid;
@ -214,12 +220,17 @@ drop_priv_perm(uid_t new_uid)
retval = 0;
done:
return retval;
#else
clicon_debug(1, "%s Drop privileges not implemented on this platform since getresuid is not available", __FUNCTION__);
return 0;
#endif
}
/*! Restore privileges to saved level */
int
restore_priv(void)
{
#ifdef HAVE_GETRESUID
int retval = -1;
uid_t ruid;
uid_t euid;
@ -240,4 +251,8 @@ restore_priv(void)
retval = 0;
done:
return retval;
#else
clicon_debug(1, "%s Drop privileges not implemented on this platform since getresuid is not available", __FUNCTION__);
return 0;
#endif
}

5
yang/clixon/clixon-config@2021-05-20.yang
View file

@ -536,7 +536,10 @@ module clixon-config {
default drop_perm;
description
"Restconf privileges mode.
If drop_perm or drop_temp then drop privileges to CLICON_RESTCONF_USER.";
If drop_perm or drop_temp then drop privileges to CLICON_RESTCONF_USER.
If the platform does not support getresuid and accompanying functions, the mode
must be set to 'none'.
";
}
leaf CLICON_CLI_DIR {
type string;