suricata
util-privs.h
Go to the documentation of this file.
1
/* Copyright (C) 2007-2010 Open Information Security Foundation
2
*
3
* You can copy, redistribute or modify this Program under the terms of
4
* the GNU General Public License version 2 as published by the Free
5
* Software Foundation.
6
*
7
* This program is distributed in the hope that it will be useful,
8
* but WITHOUT ANY WARRANTY; without even the implied warranty of
9
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
10
* GNU General Public License for more details.
11
*
12
* You should have received a copy of the GNU General Public License
13
* version 2 along with this program; if not, write to the Free Software
14
* Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
15
* 02110-1301, USA.
16
*/
17
18
/**
19
* \file
20
*
21
* \author Gurvinder Singh <gurvindersinghdahiya@gmail.com>
22
*/
23
24
#ifndef _UTIL_PRIVS_H
25
#define _UTIL_PRIVS_H
26
27
#define SC_CAP_NONE 0x01
28
#define SC_CAP_SYS_ADMIN 0x02
29
#define SC_CAP_SYS_RAW_IO 0x04
30
#define SC_CAP_IPC_LOCK 0x08
31
#define SC_CAP_NET_ADMIN 0x10
32
#define SC_CAP_NET_RAW 0x20
33
#define SC_CAP_NET_BIND_SERVICE 0x40
34
#define SC_CAP_NET_BROADCAST 0x80
35
36
#ifndef HAVE_LIBCAP_NG
37
#define SCDropCaps(...)
38
#define SCDropMainThreadCaps(...)
39
#else
40
#include "
threadvars.h
"
41
#include "
util-debug.h
"
42
#include <cap-ng.h>
43
44
/**Drop the previliges of the given thread tv, based on the thread cap_flags
45
* which implies the capability requirement of the given thread. Initially all
46
* caps are dropped and later, the required caps are set for the given thread
47
*/
48
void
SCDropCaps
(
ThreadVars
*
tv
);
49
/*
50
#define SCDropCaps(tv) ({ \
51
capng_clear(CAPNG_SELECT_BOTH); \
52
capng_apply(CAPNG_SELECT_BOTH); \
53
if (tv->cap_flags & SC_CAP_IPC_LOCK) { \
54
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_IPC_LOCK); \
55
capng_apply(CAPNG_SELECT_CAPS); \
56
SCLogDebug("For thread \"%s\" CAP_IPC_LOCK has been set", tv->name); \
57
} \
58
if (tv->cap_flags & SC_CAP_NET_ADMIN) { \
59
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_ADMIN); \
60
capng_apply(CAPNG_SELECT_CAPS); \
61
SCLogDebug("For thread \"%s\" CAP_NET_ADMIN has been set", tv->name); \
62
} \
63
if (tv->cap_flags & SC_CAP_NET_BIND_SERVICE) { \
64
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BIND_SERVICE); \
65
capng_apply(CAPNG_SELECT_CAPS); \
66
SCLogDebug("For thread \"%s\" CAP_NET_BIND_SERVICE has been set", tv->name); \
67
} \
68
if (tv->cap_flags & SC_CAP_NET_BROADCAST) { \
69
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_BROADCAST); \
70
capng_apply(CAPNG_SELECT_CAPS); \
71
SCLogDebug("For thread \"%s\" CAP_NET_BROADCAST has been set", tv->name); \
72
} \
73
if (tv->cap_flags & SC_CAP_NET_RAW) { \
74
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_NET_RAW); \
75
capng_apply(CAPNG_SELECT_CAPS); \
76
SCLogDebug("For thread \"%s\" CAP_NET_RAW has been set", tv->name); \
77
} \
78
if (tv->cap_flags & SC_CAP_SYS_ADMIN) { \
79
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_ADMIN); \
80
capng_apply(CAPNG_SELECT_CAPS); \
81
SCLogDebug("For thread \"%s\" CAP_SYS_ADMIN has been set", tv->name); \
82
} \
83
if (tv->cap_flags & SC_CAP_SYS_RAW_IO) { \
84
capng_update(CAPNG_ADD, (capng_type_t) (CAPNG_EFFECTIVE | CAPNG_PERMITTED), CAP_SYS_RAWIO); \
85
capng_apply(CAPNG_SELECT_CAPS); \
86
SCLogDebug("For thread \"%s\" CAP_SYS_RAWIO has been set", tv->name); \
87
} \
88
})
89
*/
90
void
SCDropMainThreadCaps
(uint32_t , uint32_t );
91
92
#endif
/* HAVE_LIBCAP_NG */
93
94
int
SCGetUserID
(
const
char
*,
const
char
*, uint32_t *, uint32_t *);
95
int
SCGetGroupID
(
const
char
*, uint32_t *);
96
97
#ifdef __OpenBSD__
98
int
SCPledge
(
void
);
99
#else
/* __OpenBSD__ */
100
#define SCPledge(...)
101
#endif
/* __OpenBSD__ */
102
103
#endif
/* _UTIL_PRIVS_H */
104
SCGetGroupID
int SCGetGroupID(const char *, uint32_t *)
Function to get the group ID from the specified group name.
Definition:
util-privs.c:213
SCPledge
#define SCPledge(...)
Definition:
util-privs.h:100
SCDropCaps
#define SCDropCaps(...)
Definition:
util-privs.h:37
SCGetUserID
int SCGetUserID(const char *, const char *, uint32_t *, uint32_t *)
Function to get the user and group ID from the specified user name.
Definition:
util-privs.c:149
util-debug.h
ThreadVars_
Per thread variable structure.
Definition:
threadvars.h:58
SCDropMainThreadCaps
#define SCDropMainThreadCaps(...)
Definition:
util-privs.h:38
tv
ThreadVars * tv
Definition:
fuzz_decodepcapfile.c:29
threadvars.h
src
util-privs.h
Generated on Sun May 22 2022 23:30:41 for suricata by
1.8.18