Add -U to drop privileges in shibari-server-udp

Signed-off-by: Laurent Bercot <ska@appnovation.com>

3 files changed, 28 insertions, 7 deletions

diff --git a/doc/shibari-server-tcp.html b/doc/shibari-server-tcp.html
index 5f36087..42808fa 100644
--- a/doc/shibari-server-tcp.html
+++ b/doc/shibari-server-tcp.html
@@ -28,7 +28,7 @@ on its standard output.
 </div>
 
 <pre>
-     shibari-server-tcp [ -v <em>verbosity</em> [ -f <em>tdbfile</em> ] [ -r <em>rtimeout</em> ] [ -w <em>wtimeout</em> ]
+     shibari-server-tcp [ -v <em>verbosity</em> ] [ -f <em>tdbfile</em> ] [ -r <em>rtimeout</em> ] [ -w <em>wtimeout</em> ]
 </pre>
 
 <ul>
diff --git a/doc/shibari-server-udp.html b/doc/shibari-server-udp.html
index 7ac2897..a3395ba 100644
--- a/doc/shibari-server-udp.html
+++ b/doc/shibari-server-udp.html
@@ -28,7 +28,7 @@ answers DNS queries it receives, until it is killed.
 </div>
 
 <pre>
-     shibari-server-udp [ -v <em>verbosity</em> ] [ -d <em>notif</em> ] [ -f <em>tdbfile</em> ] [ -w <em>wtimeout</em> ] [ -i <em>rulesdir</em> ] [ -x <em>rulesfile</em> ] [ -p <em>port</em> ] <em>ip</em>
+     shibari-server-udp [ -U ] [ -v <em>verbosity</em> ] [ -d <em>notif</em> ] [ -f <em>tdbfile</em> ] [ -w <em>wtimeout</em> ] [ -i <em>rulesdir</em> ] [ -x <em>rulesfile</em> ] [ -p <em>port</em> ] <em>ip</em>
 </pre>
 
 <ul>
@@ -65,6 +65,12 @@ underlying operating system. </dd>
 </div>
 
 <dl>
+
+ <dt> -U </dt>
+ <dd> Drop privileges. shibari-server-udp will expect the UID and GID
+environment variables to contain a suitable uid and gid, and will change
+to this uid and gid after binding its socket. </dd>
+
  <dt> -v <em>verbosity</em> </dt>
  <dd> Be more or less verbose.
 A <em>verbosity</em> of 0 means no warnings, no logs, only error messages. 1
diff --git a/src/server/shibari-server-udp.c b/src/server/shibari-server-udp.c
index 87f0118..0a723ea 100644
--- a/src/server/shibari-server-udp.c
+++ b/src/server/shibari-server-udp.c
@@ -29,7 +29,7 @@
 #include <shibari/common.h>
 #include <shibari/server.h>
 
-#define USAGE "shibari-server-udp [ -v verbosity ] [ -d notif ] [ -f cdbfile ] [ -w wtimeout ] [ -i rulesdir | -x rulesfile ] [ -p port ] ip"
+#define USAGE "shibari-server-udp [ -U ] [ -v verbosity ] [ -d notif ] [ -f cdbfile ] [ -w wtimeout ] [ -i rulesdir | -x rulesfile ] [ -p port ] ip"
 #define dieusage() strerr_dieusage(100, USAGE)
 
 #define VAR "LOC"
@@ -116,6 +116,8 @@ int main (int argc, char const *const *argv)
   tain wtto = TAIN_INFINITE_RELATIVE ;
   s6_accessrules_params_t params = S6_ACCESSRULES_PARAMS_ZERO ;
   unsigned int notif = 0 ;
+  uid_t uid = 0 ;
+  gid_t gid = 0 ;
   char buf[512] ;
   shibari_packet pkt = SHIBARI_PACKET_INIT(buf, 512, 0) ;
   uint16_t localport = 53 ;
@@ -125,13 +127,15 @@ int main (int argc, char const *const *argv)
 
   {
     unsigned int wtimeout = 0 ;
+    int flagdrop = 0 ;
     subgetopt l = SUBGETOPT_ZERO ;
     for (;;)
     {
-      int opt = subgetopt_r(argc, argv, "v:d:f:w:i:x:p:", &l) ;
+      int opt = subgetopt_r(argc, argv, "Uv:d:f:w:i:x:p:", &l) ;
       if (opt == -1) break ;
       switch (opt)
       {
+        case 'U' : flagdrop = 1 ; break ;
         case 'v' : if (!uint320_scan(l.arg, &verbosity)) dieusage() ; break ;
         case 'd' : if (!uint0_scan(l.arg, &notif)) dieusage() ; break ;
         case 'f' : tdbfile = l.arg ; break ;
@@ -143,12 +147,20 @@ int main (int argc, char const *const *argv)
       }
     }
     argc -= l.ind ; argv += l.ind ;
+    if (!argc) dieusage() ;
+    if (!ip46_scan(argv[0], &localip)) dieusage() ;
+    if (flagdrop)
+    {
+      char const *x = getenv("UID") ;
+      if (!x) strerr_dienotset(100, "UID") ;
+      if (!uid0_scan(x, &uid)) strerr_dieinvalid(100, "UID") ;
+      x = getenv("GID") ;
+      if (!x) strerr_dienotset(100, "GID") ;
+      if (!uid0_scan(x, &gid)) strerr_dieinvalid(100, "GID") ;
+    }
     if (wtimeout) tain_from_millisecs(&wtto, wtimeout) ;
   }
 
-  if (!argc) dieusage() ;
-  if (!ip46_scan(argv[0], &localip)) dieusage() ;
-
   if (notif)
   {
     if (notif < 3) strerr_dief1x(100, "notification fd cannot be 0, 1 or 2") ;
@@ -174,6 +186,9 @@ int main (int argc, char const *const *argv)
   x[1].fd = socket_udp46_nb(ip46_is6(&localip)) ;
   if (x[1].fd == -1) strerr_diefu1sys(111, "create socket") ;
   if (socket_bind46_reuse(x[1].fd, &localip, localport) == -1) strerr_diefu1sys(111, "bind socket") ;
+
+  if (gid && setgid(gid) == -1) strerr_diefu1sys(111, "setgid") ;
+  if (uid && setuid(uid) == -1) strerr_diefu1sys(111, "setuid") ;
   if (!tain_now_set_stopwatch_g()) strerr_diefu1sys(111, "initialize clock") ;
 
   shibari_log_start(verbosity, &localip, localport) ;