diff options
| -rw-r--r-- | doc/shibari-server-tcp.html | 2 | ||||
| -rw-r--r-- | doc/shibari-server-udp.html | 8 | ||||
| -rw-r--r-- | src/server/shibari-server-udp.c | 25 |
3 files changed, 28 insertions, 7 deletions
diff --git a/doc/shibari-server-tcp.html b/doc/shibari-server-tcp.html index 5f36087..42808fa 100644 --- a/doc/shibari-server-tcp.html +++ b/doc/shibari-server-tcp.html @@ -28,7 +28,7 @@ on its standard output. </div> <pre> - shibari-server-tcp [ -v <em>verbosity</em> [ -f <em>tdbfile</em> ] [ -r <em>rtimeout</em> ] [ -w <em>wtimeout</em> ] + shibari-server-tcp [ -v <em>verbosity</em> ] [ -f <em>tdbfile</em> ] [ -r <em>rtimeout</em> ] [ -w <em>wtimeout</em> ] </pre> <ul> diff --git a/doc/shibari-server-udp.html b/doc/shibari-server-udp.html index 7ac2897..a3395ba 100644 --- a/doc/shibari-server-udp.html +++ b/doc/shibari-server-udp.html @@ -28,7 +28,7 @@ answers DNS queries it receives, until it is killed. </div> <pre> - shibari-server-udp [ -v <em>verbosity</em> ] [ -d <em>notif</em> ] [ -f <em>tdbfile</em> ] [ -w <em>wtimeout</em> ] [ -i <em>rulesdir</em> ] [ -x <em>rulesfile</em> ] [ -p <em>port</em> ] <em>ip</em> + shibari-server-udp [ -U ] [ -v <em>verbosity</em> ] [ -d <em>notif</em> ] [ -f <em>tdbfile</em> ] [ -w <em>wtimeout</em> ] [ -i <em>rulesdir</em> ] [ -x <em>rulesfile</em> ] [ -p <em>port</em> ] <em>ip</em> </pre> <ul> @@ -65,6 +65,12 @@ underlying operating system. </dd> </div> <dl> + + <dt> -U </dt> + <dd> Drop privileges. shibari-server-udp will expect the UID and GID +environment variables to contain a suitable uid and gid, and will change +to this uid and gid after binding its socket. </dd> + <dt> -v <em>verbosity</em> </dt> <dd> Be more or less verbose. A <em>verbosity</em> of 0 means no warnings, no logs, only error messages. 1 diff --git a/src/server/shibari-server-udp.c b/src/server/shibari-server-udp.c index 87f0118..0a723ea 100644 --- a/src/server/shibari-server-udp.c +++ b/src/server/shibari-server-udp.c @@ -29,7 +29,7 @@ #include <shibari/common.h> #include <shibari/server.h> -#define USAGE "shibari-server-udp [ -v verbosity ] [ -d notif ] [ -f cdbfile ] [ -w wtimeout ] [ -i rulesdir | -x rulesfile ] [ -p port ] ip" +#define USAGE "shibari-server-udp [ -U ] [ -v verbosity ] [ -d notif ] [ -f cdbfile ] [ -w wtimeout ] [ -i rulesdir | -x rulesfile ] [ -p port ] ip" #define dieusage() strerr_dieusage(100, USAGE) #define VAR "LOC" @@ -116,6 +116,8 @@ int main (int argc, char const *const *argv) tain wtto = TAIN_INFINITE_RELATIVE ; s6_accessrules_params_t params = S6_ACCESSRULES_PARAMS_ZERO ; unsigned int notif = 0 ; + uid_t uid = 0 ; + gid_t gid = 0 ; char buf[512] ; shibari_packet pkt = SHIBARI_PACKET_INIT(buf, 512, 0) ; uint16_t localport = 53 ; @@ -125,13 +127,15 @@ int main (int argc, char const *const *argv) { unsigned int wtimeout = 0 ; + int flagdrop = 0 ; subgetopt l = SUBGETOPT_ZERO ; for (;;) { - int opt = subgetopt_r(argc, argv, "v:d:f:w:i:x:p:", &l) ; + int opt = subgetopt_r(argc, argv, "Uv:d:f:w:i:x:p:", &l) ; if (opt == -1) break ; switch (opt) { + case 'U' : flagdrop = 1 ; break ; case 'v' : if (!uint320_scan(l.arg, &verbosity)) dieusage() ; break ; case 'd' : if (!uint0_scan(l.arg, ¬if)) dieusage() ; break ; case 'f' : tdbfile = l.arg ; break ; @@ -143,12 +147,20 @@ int main (int argc, char const *const *argv) } } argc -= l.ind ; argv += l.ind ; + if (!argc) dieusage() ; + if (!ip46_scan(argv[0], &localip)) dieusage() ; + if (flagdrop) + { + char const *x = getenv("UID") ; + if (!x) strerr_dienotset(100, "UID") ; + if (!uid0_scan(x, &uid)) strerr_dieinvalid(100, "UID") ; + x = getenv("GID") ; + if (!x) strerr_dienotset(100, "GID") ; + if (!uid0_scan(x, &gid)) strerr_dieinvalid(100, "GID") ; + } if (wtimeout) tain_from_millisecs(&wtto, wtimeout) ; } - if (!argc) dieusage() ; - if (!ip46_scan(argv[0], &localip)) dieusage() ; - if (notif) { if (notif < 3) strerr_dief1x(100, "notification fd cannot be 0, 1 or 2") ; @@ -174,6 +186,9 @@ int main (int argc, char const *const *argv) x[1].fd = socket_udp46_nb(ip46_is6(&localip)) ; if (x[1].fd == -1) strerr_diefu1sys(111, "create socket") ; if (socket_bind46_reuse(x[1].fd, &localip, localport) == -1) strerr_diefu1sys(111, "bind socket") ; + + if (gid && setgid(gid) == -1) strerr_diefu1sys(111, "setgid") ; + if (uid && setuid(uid) == -1) strerr_diefu1sys(111, "setuid") ; if (!tain_now_set_stopwatch_g()) strerr_diefu1sys(111, "initialize clock") ; shibari_log_start(verbosity, &localip, localport) ; |