-/*
+/*
* Zebra privileges header.
*
* Copyright (C) 2003 Paul Jakma.
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
* General Public License for more details.
*
- * You should have received a copy of the GNU General Public License
- * along with GNU Zebra; see the file COPYING. If not, write to the Free
- * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
- * 02111-1307, USA.
+ * You should have received a copy of the GNU General Public License along
+ * with this program; see the file COPYING; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
*/
#ifndef _ZEBRA_PRIVS_H
#define _ZEBRA_PRIVS_H
/* list of zebra capabilities */
-typedef enum
-{
- ZCAP_SETGID,
- ZCAP_SETUID,
- ZCAP_BIND,
- ZCAP_BROADCAST,
- ZCAP_ADMIN,
- ZCAP_SYS_ADMIN,
- ZCAP_RAW,
- ZCAP_CHROOT,
- ZCAP_NICE,
- ZCAP_PTRACE,
- ZCAP_DAC_OVERRIDE,
- ZCAP_READ_SEARCH,
- ZCAP_FOWNER,
- ZCAP_MAX
+typedef enum {
+ ZCAP_SETID,
+ ZCAP_BIND,
+ ZCAP_NET_ADMIN,
+ ZCAP_SYS_ADMIN,
+ ZCAP_NET_RAW,
+ ZCAP_CHROOT,
+ ZCAP_NICE,
+ ZCAP_PTRACE,
+ ZCAP_DAC_OVERRIDE,
+ ZCAP_READ_SEARCH,
+ ZCAP_FOWNER,
+ ZCAP_MAX
} zebra_capabilities_t;
-typedef enum
-{
- ZPRIVS_LOWERED,
- ZPRIVS_RAISED
+typedef enum {
+ ZPRIVS_LOWERED,
+ ZPRIVS_RAISED,
+ ZPRIVS_UNKNOWN,
} zebra_privs_current_t;
-typedef enum
-{
- ZPRIVS_RAISE,
- ZPRIVS_LOWER,
+typedef enum {
+ ZPRIVS_RAISE,
+ ZPRIVS_LOWER,
} zebra_privs_ops_t;
-struct zebra_privs_t
-{
- zebra_capabilities_t *caps_p; /* caps required for operation */
- zebra_capabilities_t *caps_i; /* caps to allow inheritance of */
- int cap_num_p; /* number of caps in arrays */
- int cap_num_i;
- char *user; /* user and group to run as */
- char *group;
- char *vty_group; /* group to chown vty socket to */
- /* methods */
- int
- (*change) (zebra_privs_ops_t); /* change privileges, 0 on success */
- zebra_privs_current_t
- (*current_state) (void); /* current privilege state */
+struct zebra_privs_t {
+ zebra_capabilities_t *caps_p; /* caps required for operation */
+ zebra_capabilities_t *caps_i; /* caps to allow inheritance of */
+ int cap_num_p; /* number of caps in arrays */
+ int cap_num_i;
+ const char *user; /* user and group to run as */
+ const char *group;
+ const char *vty_group; /* group to chown vty socket to */
+ /* methods */
+ int (*change)(zebra_privs_ops_t); /* change privileges, 0 on success */
+ zebra_privs_current_t (*current_state)(
+ void); /* current privilege state */
+ const char *raised_in_funcname;
};
-struct zprivs_ids_t
-{
- /* -1 is undefined */
- uid_t uid_priv; /* privileged uid */
- uid_t uid_normal; /* normal uid */
- gid_t gid_priv; /* privileged uid */
- gid_t gid_normal; /* normal uid */
- gid_t gid_vty; /* vty gid */
+struct zprivs_ids_t {
+ /* -1 is undefined */
+ uid_t uid_priv; /* privileged uid */
+ uid_t uid_normal; /* normal uid */
+ gid_t gid_priv; /* privileged uid */
+ gid_t gid_normal; /* normal uid */
+ gid_t gid_vty; /* vty gid */
};
- /* initialise zebra privileges */
-void zprivs_init (struct zebra_privs_t *zprivs);
- /* drop all and terminate privileges */
-void zprivs_terminate (void);
- /* query for runtime uid's and gid's, eg vty needs this */
-void zprivs_get_ids(struct zprivs_ids_t *);
+/* initialise zebra privileges */
+extern void zprivs_preinit(struct zebra_privs_t *zprivs);
+extern void zprivs_init(struct zebra_privs_t *zprivs);
+/* drop all and terminate privileges */
+extern void zprivs_terminate(struct zebra_privs_t *);
+/* query for runtime uid's and gid's, eg vty needs this */
+extern void zprivs_get_ids(struct zprivs_ids_t *);
+
+/*
+ * Wrapper around zprivs, to be used as:
+ * frr_elevate_privs(&privs) {
+ * ... code ...
+ * if (error)
+ * break; -- break can be used to get out of the block
+ * ... code ...
+ * }
+ *
+ * The argument to frr_elevate_privs() can be NULL to leave privileges as-is
+ * (mostly useful for conditional privilege-raising, i.e.:)
+ * frr_elevate_privs(cond ? &privs : NULL) {}
+ *
+ * NB: The code block is always executed, regardless of whether privileges
+ * could be raised or not, or whether NULL was given or not. This is fully
+ * intentional; the user may have configured some RBAC or similar that we
+ * are not aware of, but that allows our code to proceed without privileges.
+ *
+ * The point of this wrapper is to prevent accidental bugs where privileges
+ * are elevated but then not dropped. This can happen when, for example, a
+ * "return", "goto" or "break" in the middle of the elevated-privilege code
+ * skips past the privilege dropping call.
+ *
+ * The macro below uses variable cleanup to drop privileges as soon as the
+ * code block is left in any way (and thus the _privs variable goes out of
+ * scope.) _once is just a trick to run the loop exactly once.
+ */
+extern struct zebra_privs_t *_zprivs_raise(struct zebra_privs_t *privs,
+ const char *funcname);
+extern void _zprivs_lower(struct zebra_privs_t **privs);
+
+#define frr_elevate_privs(privs) \
+ for (struct zebra_privs_t *_once = NULL, \
+ *_privs __attribute__( \
+ (unused, cleanup(_zprivs_lower))) = \
+ _zprivs_raise(privs, __func__); \
+ _once == NULL; _once = (void *)1)
#endif /* _ZEBRA_PRIVS_H */