]> git.proxmox.com Git - mirror_frr.git/blob - lib/privs.h
Merge pull request #13278 from FRRouting/mergify/bp/stable/8.5/pr-13269
[mirror_frr.git] / lib / privs.h
1 /*
2 * Zebra privileges header.
3 *
4 * Copyright (C) 2003 Paul Jakma.
5 *
6 * This file is part of GNU Zebra.
7 *
8 * GNU Zebra is free software; you can redistribute it and/or modify it
9 * under the terms of the GNU General Public License as published by the
10 * Free Software Foundation; either version 2, or (at your option) any
11 * later version.
12 *
13 * GNU Zebra is distributed in the hope that it will be useful, but
14 * WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
16 * General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License along
19 * with this program; see the file COPYING; if not, write to the Free Software
20 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
21 */
22
23 #ifndef _ZEBRA_PRIVS_H
24 #define _ZEBRA_PRIVS_H
25
26 #include <pthread.h>
27 #include <stdint.h>
28 #include "lib/queue.h"
29
30 #ifdef __cplusplus
31 extern "C" {
32 #endif
33
34 /* list of zebra capabilities */
35 typedef enum {
36 ZCAP_SETID,
37 ZCAP_BIND,
38 ZCAP_NET_ADMIN,
39 ZCAP_SYS_ADMIN,
40 ZCAP_NET_RAW,
41 ZCAP_CHROOT,
42 ZCAP_NICE,
43 ZCAP_PTRACE,
44 ZCAP_DAC_OVERRIDE,
45 ZCAP_READ_SEARCH,
46 ZCAP_FOWNER,
47 ZCAP_IPC_LOCK,
48 ZCAP_SYS_RAWIO,
49 ZCAP_MAX
50 } zebra_capabilities_t;
51
52 typedef enum {
53 ZPRIVS_LOWERED,
54 ZPRIVS_RAISED,
55 ZPRIVS_UNKNOWN,
56 } zebra_privs_current_t;
57
58 typedef enum {
59 ZPRIVS_RAISE,
60 ZPRIVS_LOWER,
61 } zebra_privs_ops_t;
62
63 struct zebra_privs_refs_t {
64 STAILQ_ENTRY(zebra_privs_refs_t) entry;
65 pthread_t tid;
66 uint32_t refcount;
67 const char *raised_in_funcname;
68 };
69
70 struct zebra_privs_t {
71 zebra_capabilities_t *caps_p; /* caps required for operation */
72 zebra_capabilities_t *caps_i; /* caps to allow inheritance of */
73 int cap_num_p; /* number of caps in arrays */
74 int cap_num_i;
75
76 /* Mutex and counter used to avoid race conditions in multi-threaded
77 * processes. If privs status is process-wide, we need to
78 * control changes to the privilege status among threads.
79 * If privs changes are per-thread, we need to be able to
80 * manage that too.
81 */
82 pthread_mutex_t mutex;
83 struct zebra_privs_refs_t process_refs;
84
85 STAILQ_HEAD(thread_refs_q, zebra_privs_refs_t) thread_refs;
86
87 const char *user; /* user and group to run as */
88 const char *group;
89 const char *vty_group; /* group to chown vty socket to */
90 /* methods */
91 int (*change)(zebra_privs_ops_t); /* change privileges, 0 on success */
92 zebra_privs_current_t (*current_state)(
93 void); /* current privilege state */
94 };
95
96 struct zprivs_ids_t {
97 /* -1 is undefined */
98 uid_t uid_priv; /* privileged uid */
99 uid_t uid_normal; /* normal uid */
100 gid_t gid_priv; /* privileged uid */
101 gid_t gid_normal; /* normal uid */
102 gid_t gid_vty; /* vty gid */
103 };
104
105 extern struct zebra_privs_t *lib_privs;
106
107 /* initialise zebra privileges */
108 extern void zprivs_preinit(struct zebra_privs_t *zprivs);
109 extern void zprivs_init(struct zebra_privs_t *zprivs);
110 /* drop all and terminate privileges */
111 extern void zprivs_terminate(struct zebra_privs_t *);
112 /* query for runtime uid's and gid's, eg vty needs this */
113 extern void zprivs_get_ids(struct zprivs_ids_t *);
114
115 /*
116 * Wrapper around zprivs, to be used as:
117 * frr_with_privs(&privs) {
118 * ... code ...
119 * if (error)
120 * break; -- break can be used to get out of the block
121 * ... code ...
122 * }
123 *
124 * The argument to frr_with_privs() can be NULL to leave privileges as-is
125 * (mostly useful for conditional privilege-raising, i.e.:)
126 * frr_with_privs(cond ? &privs : NULL) {}
127 *
128 * NB: The code block is always executed, regardless of whether privileges
129 * could be raised or not, or whether NULL was given or not. This is fully
130 * intentional; the user may have configured some RBAC or similar that we
131 * are not aware of, but that allows our code to proceed without privileges.
132 *
133 * The point of this wrapper is to prevent accidental bugs where privileges
134 * are elevated but then not dropped. This can happen when, for example, a
135 * "return", "goto" or "break" in the middle of the elevated-privilege code
136 * skips past the privilege dropping call.
137 *
138 * The macro below uses variable cleanup to drop privileges as soon as the
139 * code block is left in any way (and thus the _privs variable goes out of
140 * scope.) _once is just a trick to run the loop exactly once.
141 */
142 extern struct zebra_privs_t *_zprivs_raise(struct zebra_privs_t *privs,
143 const char *funcname);
144 extern void _zprivs_lower(struct zebra_privs_t **privs);
145
146 #define frr_with_privs(privs) \
147 for (struct zebra_privs_t *_once = NULL, \
148 *_privs __attribute__( \
149 (unused, cleanup(_zprivs_lower))) = \
150 _zprivs_raise(privs, __func__); \
151 _once == NULL; _once = (void *)1)
152
153 #ifdef __cplusplus
154 }
155 #endif
156
157 #endif /* _ZEBRA_PRIVS_H */