summaryrefslogtreecommitdiff
path: root/lib/privs.c
AgeCommit message (Collapse)Author
2022-07-20*: frr_with_mutex change to follow our standardDonald Sharp
convert: frr_with_mutex(..) to: frr_with_mutex (..) To make all our code agree with what clang-format is going to produce Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2022-06-29lib: Allow downgrade of all caps when none are specifiedDonald Sharp
Staticd when run tells privs.c that it does not need any priviledges. The lib/privs.c code was not downgrading any and all permissions it may have been given at startup. Since we don't need any let's actually tell the system that FRR does not need the capabilities anymore in the case where a daemon does not ask for any cap's. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2022-06-27lib: add SYS_RAWIO to the capabilities definitionsAnuradha Karuppiah
Signed-off-by: Anuradha Karuppiah <anuradhak@nvidia.com>
2022-04-19*: Fix spelling of neccessaryDonald Sharp
Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2021-05-11lib: Add ZCAP_IPC_LOCKDonald Sharp
We'll need ZCAP_IPC_LOCK for future work coming down the pike related to dataplane work being done. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2021-03-17*: require semicolon after DEFINE_MTYPE & coDavid Lamparter
Back when I put this together in 2015, ISO C11 was still reasonably new and we couldn't require it just yet. Without ISO C11, there is no "good" way (only bad hacks) to require a semicolon after a macro that ends with a function definition. And if you added one anyway, you'd get "spurious semicolon" warnings on some compilers... With C11, `_Static_assert()` at the end of a macro will make it so that the semicolon is properly required, consumed, and not warned about. Consistently requiring semicolons after "file-level" macros matches Linux kernel coding style and helps some editors against mis-syntax'ing these macros. Signed-off-by: David Lamparter <equinox@diac24.net>
2021-02-12lib: have a lib_privs for ... lib privsDavid Lamparter
Logging code might want to raise privs for file operations. Signed-off-by: David Lamparter <equinox@diac24.net>
2020-09-21*: Remove solaris from FRRDonald Sharp
The Solaris code has gone through a deprecation cycle. No-one has said anything to us and worse of all we don't have any test systems running Solaris to know if we are making changes that are breaking on Solaris. Remove it from the system so we can clean up a bit. Signed-off-by: Donald Sharp <sharpd@nvidia.com>
2020-09-02lib: explicitly cast -1 to uid_tQuentin Young
We should be explicit about what's happening here Signed-off-by: Quentin Young <qlyoung@nvidia.com>
2020-07-14*: un-split strings across linesDavid Lamparter
Remove mid-string line breaks, cf. workflow doc: .. [#tool_style_conflicts] For example, lines over 80 characters are allowed for text strings to make it possible to search the code for them: please see `Linux kernel style (breaking long lines and strings) <https://www.kernel.org/doc/html/v4.10/process/coding-style.html#breaking-long-lines-and-strings>`_ and `Issue #1794 <https://github.com/FRRouting/frr/issues/1794>`_. Scripted commit, idempotent to running: ``` python3 tools/stringmangle.py --unwrap `git ls-files | egrep '\.[ch]$'` ``` Signed-off-by: David Lamparter <equinox@diac24.net>
2020-06-11lib: don't try to change/reset capabilities if process has noneMark Stapp
A couple of daemons take/use no capabilities/privs; allow cleanup of the privs/capabilities library module even if a daemon has no caps. Signed-off-by: Mark Stapp <mjs@voltanet.io>
2019-09-03lib: add frr_with_mutex() block-wrapperDavid Lamparter
frr_with_mutex(...) { ... } locks and automatically unlocks the listed mutex(es) when the block is exited. This adds a bit of safety against forgetting the unlock in error paths & co. and makes the code a slight bit more readable. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2019-04-30Merge pull request #3045 from opensourcerouting/atomsLou Berger
READY: lists/skiplists/rb-trees new API & sequence lock & atomic lists
2019-04-22libs: control privs changes with refcountMark Stapp
Use a refcount to control privs changes. Support process-wide privs apis, as well as per-pthread apis. Signed-off-by: Mark Stapp <mjs@voltanet.io>
2019-04-18lib: ZEBRA_NUM_OF -> array_sizeDavid Lamparter
The latter is widely used, e.g. in the Linux kernel. Signed-off-by: David Lamparter <equinox@diac24.net>
2019-03-17libs: fix race in privs changesMark Stapp
Use the privs struct mutex more strictly, to ensure that the privs are at the level the caller expects when the apis return. Signed-off-by: Mark Stapp <mjs@voltanet.io>
2019-03-05libs: make privilege escalation thread-safeMark Stapp
Privs escalation is process-wide, and a multi-threaded process can deadlock. This adds a mutex and a counter to the privs object, preventing multiple threads from making the privs escalation system call. Signed-off-by: Mark Stapp <mjs@voltanet.io>
2019-02-15lib: fix garbage array size in zprivs_initQuentin Young
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2019-02-14lib: fix uninitialized value use in privs.cQuentin Young
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2018-09-13*: LIB_[ERR|WARN] -> EC_LIBQuentin Young
Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2018-09-06lib: Convert privs.c to use new error-code subsystemDonald Sharp
Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2018-08-14lib: add frr_elevate_privs() wrapperDavid Lamparter
Used as: frr_elevate_privs(&my_privs) { ... code ... } and handles privilege raise/lower automatically in conjunction with the C expression block. This makes it impossible to accidentally exit a function with privileges raised (and then running a whole bunch of other code with privs.) Signed-off-by: David Lamparter <equinox@diac24.net>
2018-06-21lib: Fix privs when using HAVE_CAPABILITIESDonald Sharp
If your daemon does not need any special privileges and you are compiling with HAVE_CAPABILIES, the zprivs->change pointer will end up NULL due to the way zprivs_caps_init. So as a check let's add a NULL check for zprivs->change and set it to a function that will do nothing. This change prevents a crash if you raise privileges when your daemon needs no special privileges. Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com>
2017-08-21lib: terminate capabilities only if initializedDavid Lamparter
zprivs_caps_init() is called conditionally, apply the same condition on terminate. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-08-02lib: privs: make uid/gid accessible before setuidDavid Lamparter
This splits off privs_preinit(), which does the lookups for user and group IDs. This is so the init code can create state directories while still running as root. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-07-22Revert "*: reindent pt. 2"David Lamparter
This reverts commit c14777c6bfd0a446c85243d3a9835054a259c276. clang 5 is not widely available enough for people to indent with. This is particularly problematic when rebasing/adjusting branches. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-07-17*: reindent pt. 2whitespace / reindent
w/ clang 5 * reflow comments * struct members go 1 per line * binpack algo was adjusted
2017-07-17*: reindentreindent-master-afterwhitespace / reindent
indent.py `git ls-files | pcregrep '\.[ch]$' | pcregrep -v '^(ldpd|babeld|nhrpd)/'` Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-05-24Merge remote-tracking branch 'origin/stable/3.0'Donald Sharp
2017-05-22lib: fix array sizes for capability mapQuentin Young
incorrect array sizes causing out of bounds read and potentially incorrect capability settings introduced in 1b322039 Signed-off-by: Quentin Young <qlyoung@cumulusnetworks.com>
2017-05-15*: make consistent & update GPLv2 file headersDavid Lamparter
The FSF's address changed, and we had a mixture of comment styles for the GPL file header. (The style with * at the beginning won out with 580 to 141 in existing files.) Note: I've intentionally left intact other "variations" of the copyright header, e.g. whether it says "Zebra", "Quagga", "FRR", or nothing. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2017-04-18Merge pull request #315 from LabNConsulting/working/master/patch/bgp-startupDonald Sharp
Restore functionality broken/overridden by 857b5446497505f582417e4a5ada029712743cbc
2017-04-02lib/frr: fix reference to zsuid before it is setLou Berger
Signed-off-by: Lou Berger <lberger@labn.net>
2017-04-01lib: fix usage of getgrouplist() in *BSDMike Tancsa
On BSD systems, the getgrouplist() function returns 0 if successful and -1 on error. Linux in the other hand returns *ngroups (the number of groups of which user is a member) on success and -1 on error. Given this difference, the most portable way to use getgrouplist() is use its return value only for checking if it succeeded or not. Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2017-01-26lib: Don't change uid/gid if we are already the correct uid/gidMartin Winter
Signed-off-by: Martin Winter <mwinter@opensourcerouting.org>
2016-11-09lib: privs: always look up VTY groupDavid Lamparter
Even if we're running without user switch, we should still try to honor the VTY group. This applies both to watchquagga (which always runs as root) as well as "no-userswitch" configurations for other daemons. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2016-09-23ldpd: adapt the code for QuaggaRenato Westphal
Signed-off-by: Renato Westphal <renato@opensourcerouting.org>
2016-09-19*: split & distribute memtypes and stop (re|ab)using lib/ MTYPEsDavid Lamparter
This is a rather large mechanical commit that splits up the memory types defined in lib/memtypes.c and distributes them into *_memory.[ch] files in the individual daemons. The zebra change is slightly annoying because there is no nice place to put the #include "zebra_memory.h" statement. bgpd, ospf6d, isisd and some tests were reusing MTYPEs defined in the library for its own use. This is bad practice and would break when the memtype are made static. Acked-by: Vincent JARDIN <vincent.jardin@6wind.com> Acked-by: Donald Sharp <sharpd@cumulusnetworks.com> [CF: rebased for cmaster-next] Signed-off-by: David Lamparter <equinox@opensourcerouting.org> Signed-off-by: Christian Franke <chris@opensourcerouting.org>
2016-09-03lib: fix memory leak in zprivs_caps_initLou Berger
2016-04-08lib: Fix priviledge modification for vty group specifiedDonald Sharp
When attempting to switch runtime permissions over to the correct group specified for the vty group, if the user specified to run as does not have that vty group then do warn about the issue and stop running Signed-off-by: Donald Sharp <sharpd@cumulusnetworks.com> Reported-by: Thomas Martin <tmartincpp@gmail.com>
2016-04-08lib: add getgrouplist() for SolarisDavid Lamparter
Of course Solaris doesn't have getgrouplist()... Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2016-04-08privs: fix privilege dropping to use system defined groupsTimo Teräs
It may be requred for quagga process to belong to additional groups. E.g. nhrp module will need to talk to strongSwan using vici and may require additional permissions. Initialize groups from the system group database. Signed-off-by: Timo Teräs <timo.teras@iki.fi> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2016-04-08lib/privs: Don't use CAP_NET_BROADCASTChristian Franke
From what I can tell, CAP_NET_BROADCAST has never been required for any functionality in the Linux kernel, so we do not really need it. However, it causes breakage in contexts where Quagga is started with a limited set of capabilities, e.g. in Docker, because these may not include CAP_NET_BROADCAST and in the case of Docker do not even support adding CAP_NET_BROADCAST. Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2016-04-08lib/privs: display more info if cap_set_proc fails.Christian Franke
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2016-04-08lib: Fix POSIX capabilities on SunOS platformsBrian Bennett
When using POSIX capabilities on SunOS the capabilities are too restricitve resulting in quagga processes not being able to read their own config files. Credit goes to Oracle where this patch was originally authored and included in OpenSolaris. lib/privs.c: Include additional capabilities, better checking of missing capabilities. Fixes: #820 Acked-by: Greg Troxel <gdt@ir.bbn.com> Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2014-06-04*: nuke ^L (page feed)David Lamparter
Quagga sources have inherited a slew of Page Feed (^L, \xC) characters from ancient history. Among other things, these break patchwork's XML-RPC API because \xC is not a valid character in XML documents. Nuke them from high orbit. Patches can be adapted simply by: sed -e 's%^L%%' -i filename.patch (you can type page feeds in some environments with Ctrl-V Ctrl-L) Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
2007-09-18[privs/Solaris] Quagga should work in zones with IP instancesPaul Jakma
2007-09-18 Paul Jakma <paul.jakma@sun.com> * privs.c: definition of ZCAP_NET_ADMIN on Solaris should be PRIV_SYS_IP_CONFIG, when that's available. Thus allowing Quagga to work with in Solaris zones with exclusive IP instances.
2006-03-30[lib/privs] Changing user IDs should be done before dropping privilegesPaul Jakma
2006-03-14 Paul Jakma <paul.jakma@sun.com> * privs.c: (zprivs_caps_init) Change user IDs before lowering privileges, while this seems to work on Linux, on Solaris it rightfully refuses due to PRIV_PROC_SETID having been dropped.
2005-11-24[privs/solaris] Fix unused variable and incorrect format string.paul
2005-11-24 Paul Jakma <paul.jakma@sun.com> * privs.c: (zcaps2sys/solaris) remove unused variable. (zprivs_state_caps/solaris) Format string missing a specifier.
2005-09-292005-09-29 Paul Jakma <paul.jakma@sun.com>paul
* configure.ac: Add the test for Solaris least-privileges. Set defines for whether capabilities are supported and whether of the linux or solaris variety. Add missing-prototypes, missing-declarations, char-subscripts and cast-qual warnings to default cflags, cause Hasso enjoys warnings, and we really should clean the remaining ones up. (ie isisd..). * (*/*main.c) Update the zebra_capabilities_t arrays in the various daemons to match the changes made in lib/privs.h. * zebra.h: Solaris capabilities requires priv.h to be included. * privs.{c,h}: Add support for Solaris Least-Privileges. privs.h: Reduce some of the abstract capabilities, which do not have rough equivalents on both systems. Rename the net related caps to _NET, as they should have been in first place. (zprivs_terminate) should take the zebra_privs_t as argument so that it can update change pointer. Add an additional privilege state, ZPRIVS_UNKNOWN. * privs.c: (various capability functions) Add Solaris privileges variants. (zprivs_state) Use privs.c specific generic types to represent various capability/privilege related types, so that each can be typedef'd as appropriate on each platform. (zprivs_null_state) static added, to hold the state the null method should report (should be raised by default, and LOWERED if zprivs_terminate has been called) (zprivs_state_null) Report back the zprivs_null_state. (cap_map) Make it able to map abstract capability to multiple system capabilities. (zcaps2sys) Map to abstract capabilities to multiple system privileges/capabilities. (zprivs_init) move capability related init to seperate function, zprivs_caps_init. (zprivs_terminate) ditto, moved to zprivs_caps_terminate. Set the change_state callback to the NULL state, so the user can continue to run and use the callbacks.