[PATCH v2 3/9] setpriv: dump user and group info
Patrick Steinhardt
ps at pks.im
Sun Jul 2 13:42:52 UTC 2017
setpriv from util-linux has an option to dump the current state
regarding privilege settings via `--dump`. It prints out information on
the real and effective user and group IDs, supplementary groups, the
no-new-privs flag, the capability sets as well as secure bits.
This patch is the start of supporting this mode. To make introduction of
the `--dump` easier to reason about, its introduction has been split
into multiple patches. This particular one introduces the ability to
print out user and group information of the current process.
---
util-linux/setpriv.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++++++--
1 file changed, 69 insertions(+), 2 deletions(-)
diff --git a/util-linux/setpriv.c b/util-linux/setpriv.c
index d586f4bef..dabc6d355 100644
--- a/util-linux/setpriv.c
+++ b/util-linux/setpriv.c
@@ -15,6 +15,14 @@
//config: help
//config: Run a program with different Linux privilege settings.
//config: Requires kernel >= 3.5
+//config:
+//config:config FEATURE_SETPRIV_DUMP
+//config: bool "Support dumping current privilege state"
+//config: default y
+//config: depends on SETPRIV
+//config: help
+//config: Enables the "--dump" switch to print out the current privilege
+//config: state. This is helpful for diagnosing problems.
//applet:IF_SETPRIV(APPLET(setpriv, BB_DIR_BIN, BB_SUID_DROP))
@@ -24,6 +32,9 @@
//usage: "[OPTIONS] PROG [ARGS]"
//usage:#define setpriv_full_usage "\n\n"
//usage: "Run PROG with different privilege settings\n"
+//usage: IF_FEATURE_SETPRIV_DUMP(
+//usage: "\n-d,--dump Show current capabilities"
+//usage: )
//usage: "\n--nnp,--no-new-privs Ignore setuid/setgid bits and file capabilities"
//setpriv from util-linux 2.28:
@@ -45,6 +56,7 @@
// --apparmor-profile <pr> set AppArmor profile
#include <sys/prctl.h>
+#include <unistd.h>
#include "libbb.h"
#ifndef PR_SET_NO_NEW_PRIVS
@@ -52,15 +64,61 @@
#endif
enum {
+ IF_FEATURE_SETPRIV_DUMP(OPTBIT_DUMP,)
OPTBIT_NNP,
- OPT_NNP = (1 << OPTBIT_NNP),
+ IF_FEATURE_SETPRIV_DUMP(OPT_DUMP = (1 << OPTBIT_DUMP),)
+ OPT_NNP = (1 << OPTBIT_NNP),
};
+#if ENABLE_FEATURE_SETPRIV_DUMP
+static int dump(void)
+{
+ uid_t ruid, euid, suid;
+ gid_t rgid, egid, sgid;
+ gid_t *gids;
+ int ngids;
+
+ if (getresuid(&ruid, &euid, &suid) < 0)
+ bb_simple_perror_msg_and_die("getresgid");
+
+ if (getresgid(&rgid, &egid, &sgid) < 0)
+ bb_simple_perror_msg_and_die("getresgid");
+
+ if ((ngids = getgroups(0, NULL)) < 0)
+ bb_simple_perror_msg_and_die("getgroups");
+ gids = xmalloc(ngids * sizeof(*gids));
+ if ((ngids = getgroups(ngids, gids)) < 0)
+ bb_simple_perror_msg_and_die("getgroups");
+
+ printf("uid: %d\n", ruid);
+ printf("euid: %d\n", euid);
+ printf("gid: %d\n", rgid);
+ printf("egid: %d\n", egid);
+
+ printf("Supplementary groups: ");
+ if (ngids == 0) {
+ printf("[none]");
+ } else {
+ int i;
+ for (i = 0; i < ngids; i++) {
+ if (i)
+ putchar(',');
+ printf("%d", gids[i]);
+ }
+ }
+ putchar('\n');
+
+ free(gids);
+ return 0;
+}
+#endif /* FEATURE_SETPRIV_DUMP */
+
int setpriv_main(int argc, char **argv) MAIN_EXTERNALLY_VISIBLE;
int setpriv_main(int argc UNUSED_PARAM, char **argv)
{
static const char setpriv_longopts[] ALIGN1 =
+ IF_FEATURE_SETPRIV_DUMP("dump\0" No_argument "d")
"nnp\0" No_argument "\xff"
"no-new-privs\0" No_argument "\xff"
;
@@ -68,11 +126,20 @@ int setpriv_main(int argc UNUSED_PARAM, char **argv)
opt_complementary = "";
applet_long_options = setpriv_longopts;
- opts = getopt32(argv, "+");
+ opts = getopt32(argv, "+" IF_FEATURE_SETPRIV_DUMP("d"));
argc -= optind;
argv += optind;
+#if ENABLE_FEATURE_SETPRIV_DUMP
+ if (opts & OPT_DUMP) {
+ if ((opts & ~OPT_DUMP) || argc)
+ bb_error_msg_and_die("setpriv: --dump is incompatible with all other options");
+
+ return dump();
+ }
+#endif
+
if (!argc)
bb_error_msg_and_die("no program specified");
--
2.13.2
More information about the busybox
mailing list