1 // SPDX-License-Identifier: GPL-2.0-or-later
3 * Zebra privileges header.
5 * Copyright (C) 2003 Paul Jakma.
13 #include "lib/queue.h"
19 /* list of zebra capabilities */
35 } zebra_capabilities_t
;
41 } zebra_privs_current_t
;
48 struct zebra_privs_refs_t
{
49 STAILQ_ENTRY(zebra_privs_refs_t
) entry
;
52 const char *raised_in_funcname
;
55 struct zebra_privs_t
{
56 zebra_capabilities_t
*caps_p
; /* caps required for operation */
57 zebra_capabilities_t
*caps_i
; /* caps to allow inheritance of */
58 int cap_num_p
; /* number of caps in arrays */
61 /* Mutex and counter used to avoid race conditions in multi-threaded
62 * processes. If privs status is process-wide, we need to
63 * control changes to the privilege status among threads.
64 * If privs changes are per-thread, we need to be able to
67 pthread_mutex_t mutex
;
68 struct zebra_privs_refs_t process_refs
;
70 STAILQ_HEAD(thread_refs_q
, zebra_privs_refs_t
) thread_refs
;
72 const char *user
; /* user and group to run as */
74 const char *vty_group
; /* group to chown vty socket to */
76 int (*change
)(zebra_privs_ops_t
); /* change privileges, 0 on success */
77 zebra_privs_current_t (*current_state
)(
78 void); /* current privilege state */
83 uid_t uid_priv
; /* privileged uid */
84 uid_t uid_normal
; /* normal uid */
85 gid_t gid_priv
; /* privileged uid */
86 gid_t gid_normal
; /* normal uid */
87 gid_t gid_vty
; /* vty gid */
90 extern struct zebra_privs_t
*lib_privs
;
92 /* initialise zebra privileges */
93 extern void zprivs_preinit(struct zebra_privs_t
*zprivs
);
94 extern void zprivs_init(struct zebra_privs_t
*zprivs
);
95 /* drop all and terminate privileges */
96 extern void zprivs_terminate(struct zebra_privs_t
*);
97 /* query for runtime uid's and gid's, eg vty needs this */
98 extern void zprivs_get_ids(struct zprivs_ids_t
*);
101 * Wrapper around zprivs, to be used as:
102 * frr_with_privs(&privs) {
105 * break; -- break can be used to get out of the block
109 * The argument to frr_with_privs() can be NULL to leave privileges as-is
110 * (mostly useful for conditional privilege-raising, i.e.:)
111 * frr_with_privs(cond ? &privs : NULL) {}
113 * NB: The code block is always executed, regardless of whether privileges
114 * could be raised or not, or whether NULL was given or not. This is fully
115 * intentional; the user may have configured some RBAC or similar that we
116 * are not aware of, but that allows our code to proceed without privileges.
118 * The point of this wrapper is to prevent accidental bugs where privileges
119 * are elevated but then not dropped. This can happen when, for example, a
120 * "return", "goto" or "break" in the middle of the elevated-privilege code
121 * skips past the privilege dropping call.
123 * The macro below uses variable cleanup to drop privileges as soon as the
124 * code block is left in any way (and thus the _privs variable goes out of
125 * scope.) _once is just a trick to run the loop exactly once.
127 extern struct zebra_privs_t
*_zprivs_raise(struct zebra_privs_t
*privs
,
128 const char *funcname
);
129 extern void _zprivs_lower(struct zebra_privs_t
**privs
);
131 #define frr_with_privs(privs) \
132 for (struct zebra_privs_t *_once = NULL, \
133 *_privs __attribute__( \
134 (unused, cleanup(_zprivs_lower))) = \
135 _zprivs_raise(privs, __func__); \
136 _once == NULL; _once = (void *)1)
142 #endif /* _ZEBRA_PRIVS_H */