lib/privs.h

   1 // SPDX-License-Identifier: GPL-2.0-or-later
   2 /*
   3  * Zebra privileges header.
   4  *
   5  * Copyright (C) 2003 Paul Jakma.
   6  */
   7
   8 #ifndef _ZEBRA_PRIVS_H
   9 #define _ZEBRA_PRIVS_H
  10
  11 #include <pthread.h>
  12 #include <stdint.h>
  13 #include "lib/queue.h"
  14
  15 #ifdef __cplusplus
  16 extern "C" {
  17 #endif
  18
  19 /* list of zebra capabilities */
  20 typedef enum {
  21         ZCAP_SETID,
  22         ZCAP_BIND,
  23         ZCAP_NET_ADMIN,
  24         ZCAP_SYS_ADMIN,
  25         ZCAP_NET_RAW,
  26         ZCAP_CHROOT,
  27         ZCAP_NICE,
  28         ZCAP_PTRACE,
  29         ZCAP_DAC_OVERRIDE,
  30         ZCAP_READ_SEARCH,
  31         ZCAP_FOWNER,
  32         ZCAP_IPC_LOCK,
  33         ZCAP_SYS_RAWIO,
  34         ZCAP_MAX
  35 } zebra_capabilities_t;
  36
  37 typedef enum {
  38         ZPRIVS_LOWERED,
  39         ZPRIVS_RAISED,
  40         ZPRIVS_UNKNOWN,
  41 } zebra_privs_current_t;
  42
  43 typedef enum {
  44         ZPRIVS_RAISE,
  45         ZPRIVS_LOWER,
  46 } zebra_privs_ops_t;
  47
  48 struct zebra_privs_refs_t {
  49         STAILQ_ENTRY(zebra_privs_refs_t) entry;
  50         pthread_t tid;
  51         uint32_t refcount;
  52         const char *raised_in_funcname;
  53 };
  54
  55 struct zebra_privs_t {
  56         zebra_capabilities_t *caps_p; /* caps required for operation */
  57         zebra_capabilities_t *caps_i; /* caps to allow inheritance of */
  58         int cap_num_p;                /* number of caps in arrays */
  59         int cap_num_i;
  60
  61         /* Mutex and counter used to avoid race conditions in multi-threaded
  62          * processes. If privs status is process-wide, we need to
  63          * control changes to the privilege status among threads.
  64          * If privs changes are per-thread, we need to be able to
  65          * manage that too.
  66          */
  67         pthread_mutex_t mutex;
  68         struct zebra_privs_refs_t process_refs;
  69
  70         STAILQ_HEAD(thread_refs_q, zebra_privs_refs_t) thread_refs;
  71
  72         const char *user; /* user and group to run as */
  73         const char *group;
  74         const char *vty_group; /* group to chown vty socket to */
  75         /* methods */
  76         int (*change)(zebra_privs_ops_t); /* change privileges, 0 on success */
  77         zebra_privs_current_t (*current_state)(
  78                 void); /* current privilege state */
  79 };
  80
  81 struct zprivs_ids_t {
  82         /* -1 is undefined */
  83         uid_t uid_priv;   /* privileged uid */
  84         uid_t uid_normal; /* normal uid */
  85         gid_t gid_priv;   /* privileged uid */
  86         gid_t gid_normal; /* normal uid */
  87         gid_t gid_vty;    /* vty gid */
  88 };
  89
  90 extern struct zebra_privs_t *lib_privs;
  91
  92 /* initialise zebra privileges */
  93 extern void zprivs_preinit(struct zebra_privs_t *zprivs);
  94 extern void zprivs_init(struct zebra_privs_t *zprivs);
  95 /* drop all and terminate privileges */
  96 extern void zprivs_terminate(struct zebra_privs_t *);
  97 /* query for runtime uid's and gid's, eg vty needs this */
  98 extern void zprivs_get_ids(struct zprivs_ids_t *);
  99
 100 /*
 101  * Wrapper around zprivs, to be used as:
 102  *   frr_with_privs(&privs) {
 103  *     ... code ...
 104  *     if (error)
 105  *       break;         -- break can be used to get out of the block
 106  *     ... code ...
 107  *   }
 108  *
 109  * The argument to frr_with_privs() can be NULL to leave privileges as-is
 110  * (mostly useful for conditional privilege-raising, i.e.:)
 111  *   frr_with_privs(cond ? &privs : NULL) {}
 112  *
 113  * NB: The code block is always executed, regardless of whether privileges
 114  * could be raised or not, or whether NULL was given or not.  This is fully
 115  * intentional;  the user may have configured some RBAC or similar that we
 116  * are not aware of, but that allows our code to proceed without privileges.
 117  *
 118  * The point of this wrapper is to prevent accidental bugs where privileges
 119  * are elevated but then not dropped.  This can happen when, for example, a
 120  * "return", "goto" or "break" in the middle of the elevated-privilege code
 121  * skips past the privilege dropping call.
 122  *
 123  * The macro below uses variable cleanup to drop privileges as soon as the
 124  * code block is left in any way (and thus the _privs variable goes out of
 125  * scope.)  _once is just a trick to run the loop exactly once.
 126  */
 127 extern struct zebra_privs_t *_zprivs_raise(struct zebra_privs_t *privs,
 128                                            const char *funcname);
 129 extern void _zprivs_lower(struct zebra_privs_t **privs);
 130
 131 #define frr_with_privs(privs)                                               \
 132         for (struct zebra_privs_t *_once = NULL,                               \
 133                                   *_privs __attribute__(                       \
 134                                           (unused, cleanup(_zprivs_lower))) =  \
 135                                           _zprivs_raise(privs, __func__);      \
 136              _once == NULL; _once = (void *)1)
 137
 138 #ifdef __cplusplus
 139 }
 140 #endif
 141
 142 #endif /* _ZEBRA_PRIVS_H */