blob: 20c18554ba5b270d9f719b4d216403cbf89d7042 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
|
/*
* Copyright (C) 2013 Tobias Brunner
* Hochschule fuer Technik Rapperswil
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
*
* This program is free software; you can redistribute it and/or modify it
* under the terms of the GNU General Public License as published by the
* Free Software Foundation; either version 2 of the License, or (at your
* option) any later version. See <http://www.fsf.org/copyleft/gpl.txt>.
*
* This program is distributed in the hope that it will be useful, but
* WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
* or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
* for more details.
*/
/**
* @defgroup capabilities capabilities
* @{ @ingroup utils
*/
#ifndef CAPABILITIES_H_
#define CAPABILITIES_H_
typedef struct capabilities_t capabilities_t;
#include <library.h>
#ifdef HAVE_SYS_CAPABILITY_H
# include <sys/capability.h>
#elif defined(CAPABILITIES_NATIVE)
# include <linux/capability.h>
#endif
#ifndef CAP_CHOWN
# define CAP_CHOWN 0
#endif
#ifndef CAP_NET_BIND_SERVICE
# define CAP_NET_BIND_SERVICE 10
#endif
#ifndef CAP_NET_ADMIN
# define CAP_NET_ADMIN 12
#endif
#ifndef CAP_NET_RAW
# define CAP_NET_RAW 13
#endif
#ifndef CAP_DAC_OVERRIDE
# define CAP_DAC_OVERRIDE 1
#endif
/**
* POSIX capability dropping abstraction layer.
*/
struct capabilities_t {
/**
* Register a capability to keep while calling drop(). Verifies that the
* capability is currently held.
*
* @note CAP_CHOWN is handled specially as it might not be required.
*
* @param cap capability to keep
* @return FALSE if the capability is currently not held
*/
bool (*keep)(capabilities_t *this,
u_int cap) __attribute__((warn_unused_result));
/**
* Check if the given capability is currently held.
*
* @note CAP_CHOWN is handled specially as it might not be required.
*
* @param cap capability to check
* @return TRUE if the capability is currently held
*/
bool (*check)(capabilities_t *this, u_int cap);
/**
* Get the user ID set through set_uid/resolve_uid.
*
* @return currently set user ID
*/
uid_t (*get_uid)(capabilities_t *this);
/**
* Get the group ID set through set_gid/resolve_gid.
*
* @return currently set group ID
*/
gid_t (*get_gid)(capabilities_t *this);
/**
* Set the numerical user ID to use during rights dropping.
*
* @param uid user ID to use
*/
void (*set_uid)(capabilities_t *this, uid_t uid);
/**
* Set the numerical group ID to use during rights dropping.
*
* @param gid group ID to use
*/
void (*set_gid)(capabilities_t *this, gid_t gid);
/**
* Resolve a username and set the user ID accordingly.
*
* @param username username get the uid for
* @return TRUE if username resolved and uid set
*/
bool (*resolve_uid)(capabilities_t *this, char *username);
/**
* Resolve a groupname and set the group ID accordingly.
*
* @param groupname groupname to get the gid for
* @return TRUE if groupname resolved and gid set
*/
bool (*resolve_gid)(capabilities_t *this, char *groupname);
/**
* Drop all capabilities not previously passed to keep(), switch to UID/GID.
*
* @return TRUE if capability drop successful
*/
bool (*drop)(capabilities_t *this);
/**
* Destroy a capabilities_t.
*/
void (*destroy)(capabilities_t *this);
};
/**
* Create a capabilities instance.
*/
capabilities_t *capabilities_create();
#endif /** CAPABILITIES_H_ @}*/
|
