lib/privs.h

   1 /*
   2  * Zebra privileges header.
   3  *
   4  * Copyright (C) 2003 Paul Jakma.
   5  *
   6  * This file is part of GNU Zebra.
   7  *
   8  * GNU Zebra is free software; you can redistribute it and/or modify it
   9  * under the terms of the GNU General Public License as published by the
  10  * Free Software Foundation; either version 2, or (at your option) any
  11  * later version.
  12  *
  13  * GNU Zebra is distributed in the hope that it will be useful, but
  14  * WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  16  * General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License along
  19  * with this program; see the file COPYING; if not, write to the Free Software
  20  * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
  21  */
  22
  23 #ifndef _ZEBRA_PRIVS_H
  24 #define _ZEBRA_PRIVS_H
  25
  26 #include <pthread.h>
  27 #include <stdint.h>
  28 #include "lib/queue.h"
  29
  30 #ifdef __cplusplus
  31 extern "C" {
  32 #endif
  33
  34 /* list of zebra capabilities */
  35 typedef enum {
  36         ZCAP_SETID,
  37         ZCAP_BIND,
  38         ZCAP_NET_ADMIN,
  39         ZCAP_SYS_ADMIN,
  40         ZCAP_NET_RAW,
  41         ZCAP_CHROOT,
  42         ZCAP_NICE,
  43         ZCAP_PTRACE,
  44         ZCAP_DAC_OVERRIDE,
  45         ZCAP_READ_SEARCH,
  46         ZCAP_FOWNER,
  47         ZCAP_IPC_LOCK,
  48         ZCAP_SYS_RAWIO,
  49         ZCAP_MAX
  50 } zebra_capabilities_t;
  51
  52 typedef enum {
  53         ZPRIVS_LOWERED,
  54         ZPRIVS_RAISED,
  55         ZPRIVS_UNKNOWN,
  56 } zebra_privs_current_t;
  57
  58 typedef enum {
  59         ZPRIVS_RAISE,
  60         ZPRIVS_LOWER,
  61 } zebra_privs_ops_t;
  62
  63 struct zebra_privs_refs_t {
  64         STAILQ_ENTRY(zebra_privs_refs_t) entry;
  65         pthread_t tid;
  66         uint32_t refcount;
  67         const char *raised_in_funcname;
  68 };
  69
  70 struct zebra_privs_t {
  71         zebra_capabilities_t *caps_p; /* caps required for operation */
  72         zebra_capabilities_t *caps_i; /* caps to allow inheritance of */
  73         int cap_num_p;                /* number of caps in arrays */
  74         int cap_num_i;
  75
  76         /* Mutex and counter used to avoid race conditions in multi-threaded
  77          * processes. If privs status is process-wide, we need to
  78          * control changes to the privilege status among threads.
  79          * If privs changes are per-thread, we need to be able to
  80          * manage that too.
  81          */
  82         pthread_mutex_t mutex;
  83         struct zebra_privs_refs_t process_refs;
  84
  85         STAILQ_HEAD(thread_refs_q, zebra_privs_refs_t) thread_refs;
  86
  87         const char *user; /* user and group to run as */
  88         const char *group;
  89         const char *vty_group; /* group to chown vty socket to */
  90         /* methods */
  91         int (*change)(zebra_privs_ops_t); /* change privileges, 0 on success */
  92         zebra_privs_current_t (*current_state)(
  93                 void); /* current privilege state */
  94 };
  95
  96 struct zprivs_ids_t {
  97         /* -1 is undefined */
  98         uid_t uid_priv;   /* privileged uid */
  99         uid_t uid_normal; /* normal uid */
 100         gid_t gid_priv;   /* privileged uid */
 101         gid_t gid_normal; /* normal uid */
 102         gid_t gid_vty;    /* vty gid */
 103 };
 104
 105 extern struct zebra_privs_t *lib_privs;
 106
 107 /* initialise zebra privileges */
 108 extern void zprivs_preinit(struct zebra_privs_t *zprivs);
 109 extern void zprivs_init(struct zebra_privs_t *zprivs);
 110 /* drop all and terminate privileges */
 111 extern void zprivs_terminate(struct zebra_privs_t *);
 112 /* query for runtime uid's and gid's, eg vty needs this */
 113 extern void zprivs_get_ids(struct zprivs_ids_t *);
 114
 115 /*
 116  * Wrapper around zprivs, to be used as:
 117  *   frr_with_privs(&privs) {
 118  *     ... code ...
 119  *     if (error)
 120  *       break;         -- break can be used to get out of the block
 121  *     ... code ...
 122  *   }
 123  *
 124  * The argument to frr_with_privs() can be NULL to leave privileges as-is
 125  * (mostly useful for conditional privilege-raising, i.e.:)
 126  *   frr_with_privs(cond ? &privs : NULL) {}
 127  *
 128  * NB: The code block is always executed, regardless of whether privileges
 129  * could be raised or not, or whether NULL was given or not.  This is fully
 130  * intentional;  the user may have configured some RBAC or similar that we
 131  * are not aware of, but that allows our code to proceed without privileges.
 132  *
 133  * The point of this wrapper is to prevent accidental bugs where privileges
 134  * are elevated but then not dropped.  This can happen when, for example, a
 135  * "return", "goto" or "break" in the middle of the elevated-privilege code
 136  * skips past the privilege dropping call.
 137  *
 138  * The macro below uses variable cleanup to drop privileges as soon as the
 139  * code block is left in any way (and thus the _privs variable goes out of
 140  * scope.)  _once is just a trick to run the loop exactly once.
 141  */
 142 extern struct zebra_privs_t *_zprivs_raise(struct zebra_privs_t *privs,
 143                                            const char *funcname);
 144 extern void _zprivs_lower(struct zebra_privs_t **privs);
 145
 146 #define frr_with_privs(privs)                                               \
 147         for (struct zebra_privs_t *_once = NULL,                               \
 148                                   *_privs __attribute__(                       \
 149                                           (unused, cleanup(_zprivs_lower))) =  \
 150                                           _zprivs_raise(privs, __func__);      \
 151              _once == NULL; _once = (void *)1)
 152
 153 #ifdef __cplusplus
 154 }
 155 #endif
 156
 157 #endif /* _ZEBRA_PRIVS_H */