Changeset aaf92a9

Timestamp:

2007-12-02T23:18:25Z (16 years ago)

Author:

Wilmer van der Gaast <wilmer@…>

Branches:

master

Children:

08135df, de03374

Parents:

80e9db9

Message:

Imported setuid() patch from Simo Leone <simo@archlinux...> with some
modifications. Also adding some missing g_free()s to conf.c.

Files:

• bitlbee.conf (modified) (1 diff)
• conf.c (modified) (7 diffs)
• conf.h (modified) (1 diff)
• unix.c (modified) (3 diffs)

bitlbee.conf

@@ -19 +19 @@
 ##
 # RunMode = Inetd
+
+## User:
+## 
+## If BitlBee is started by root as a daemon, it can drop root privileges,
+## and change to the specified user.
+##
+# User = bitlbee
 
 ## DaemonPort/DaemonInterface:

conf.c

@@ -63 +63 @@
         conf->ping_interval = 180;
         conf->ping_timeout = 300;
+        conf->user = NULL;
         proxytype = 0;
         
@@ -76 +77 @@
         }
         
-        while( argc > 0 && ( opt = getopt( argc, argv, "i:p:P:nvIDFc:d:hR:" ) ) >= 0 )
+        while( argc > 0 && ( opt = getopt( argc, argv, "i:p:P:nvIDFc:d:hR:u:" ) ) >= 0 )
         /*     ^^^^ Just to make sure we skip this step from the REHASH handler. */
         {
@@ -132 +133 @@
                                 "  -D  Daemon mode. (Still EXPERIMENTAL!)\n"
                                 "  -F  Forking daemon. (one process per client)\n"
+                                "  -u  Run daemon as specified user.\n"
                                 "  -P  Specify PID-file (not for inetd mode)\n"
                                 "  -i  Specify the interface (by IP address) to listen on.\n"
@@ -151 +153 @@
                         ipc_master_set_statefile( optarg );
                 }
+                else if( opt == 'u' )
+                {
+                        g_free( conf->user );
+                        conf->user = g_strdup( optarg );
+                }
         }
         
@@ -192 +199 @@
                         else if( g_strcasecmp( ini->key, "daemoninterface" ) == 0 )
                         {
+                                g_free( conf->iface );
                                 conf->iface = g_strdup( ini->value );
                         }
                         else if( g_strcasecmp( ini->key, "daemonport" ) == 0 )
                         {
+                                g_free( conf->port );
                                 conf->port = g_strdup( ini->value );
                         }
@@ -209 +218 @@
                         else if( g_strcasecmp( ini->key, "authpassword" ) == 0 )
                         {
+                                g_free( conf->auth_pass );
                                 conf->auth_pass = g_strdup( ini->value );
                         }
                         else if( g_strcasecmp( ini->key, "operpassword" ) == 0 )
                         {
+                                g_free( conf->oper_pass );
                                 conf->oper_pass = g_strdup( ini->value );
                         }
                         else if( g_strcasecmp( ini->key, "hostname" ) == 0 )
                         {
+                                g_free( conf->hostname );
                                 conf->hostname = g_strdup( ini->value );
                         }
@@ -281 +293 @@
                                 g_free( url );
                         }
+                        else if( g_strcasecmp( ini->key, "user" ) == 0 )
+                        {
+                                g_free( conf->user );
+                                conf->user = g_strdup( ini->value );
+                        }
                         else
                         {

conf.h

@@ -49 +49 @@
         int ping_interval;
         int ping_timeout;
+        char *user;
 } conf_t;
 

unix.c

@@ -34 +34 @@
 #include <sys/time.h>
 #include <sys/wait.h>
+#include <pwd.h>
 
 global_t global;        /* Against global namespace pollution */
@@ -45 +46 @@
         struct sigaction sig, old;
         
-        memset( &global, 0, sizeof( global_t ) );
-        
         log_init();
         CONF_FILE = g_strdup( CONF_FILE_DEF );
@@ -87 +86 @@
                 return( i );
         
+        if( ( global.conf->user && *global.conf->user ) &&
+            ( global.conf->runmode == RUNMODE_DAEMON || 
+              global.conf->runmode == RUNMODE_FORKDAEMON ) &&
+            ( !getuid() || !geteuid() ) )
+        {
+                struct passwd *pw = NULL;
+                pw = getpwnam( global.conf->user );
+                if( pw )
+                {
+                        setgid( pw->pw_gid );
+                        setuid( pw->pw_uid );
+                }
+        }
+
         global.storage = storage_init( global.conf->primary_storage, global.conf->migrate_storage );
-        if ( global.storage == NULL) {
+        if( global.storage == NULL )
+        {
                 log_message( LOGLVL_ERROR, "Unable to load storage backend '%s'", global.conf->primary_storage );
                 return( 1 );
         }
-        
         
         /* Catch some signals to tell the user what's happening before quitting */