diff options
| -rw-r--r-- | apt-pkg/contrib/fileutl.cc | 17 | ||||
| -rw-r--r-- | apt-pkg/contrib/fileutl.h | 3 | ||||
| -rw-r--r-- | cmdline/apt-dump-solver.cc | 2 | ||||
| -rw-r--r-- | cmdline/apt-internal-solver.cc | 3 |
4 files changed, 25 insertions, 0 deletions
diff --git a/apt-pkg/contrib/fileutl.cc b/apt-pkg/contrib/fileutl.cc index 1ba4674e5..da81edbcc 100644 --- a/apt-pkg/contrib/fileutl.cc +++ b/apt-pkg/contrib/fileutl.cc @@ -47,6 +47,7 @@ #include <signal.h> #include <errno.h> #include <glob.h> +#include <pwd.h> #include <set> #include <algorithm> @@ -2050,3 +2051,19 @@ bool Rename(std::string From, std::string To) } return true; } + +bool DropPrivs() +{ + if (getuid() != 0) + return true; + + const std::string nobody = _config->Find("APT::User::Nobody", "nobody"); + struct passwd *pw = getpwnam(nobody.c_str()); + if (pw == NULL) + return _error->Warning("No user %s, can not drop rights", nobody.c_str()); + if (setgid(pw->pw_gid) != 0) + return _error->Errno("setgid", "Failed to setgid"); + if (setuid(pw->pw_uid) != 0) + return _error->Errno("setuid", "Failed to setuid"); + return true; +} diff --git a/apt-pkg/contrib/fileutl.h b/apt-pkg/contrib/fileutl.h index cc1a98eae..683c04157 100644 --- a/apt-pkg/contrib/fileutl.h +++ b/apt-pkg/contrib/fileutl.h @@ -191,6 +191,9 @@ pid_t ExecFork(std::set<int> keep_fds); void MergeKeepFdsFromConfiguration(std::set<int> &keep_fds); bool ExecWait(pid_t Pid,const char *Name,bool Reap = false); +// process releated +bool DropPrivs(); + // File string manipulators std::string flNotDir(std::string File); std::string flNotFile(std::string File); diff --git a/cmdline/apt-dump-solver.cc b/cmdline/apt-dump-solver.cc index 04e13bde9..424764b3c 100644 --- a/cmdline/apt-dump-solver.cc +++ b/cmdline/apt-dump-solver.cc @@ -40,6 +40,8 @@ int main(int argc,const char *argv[]) /*{{{*/ ShowHelp(); return 0; } + // we really don't need anything + DropPrivs(); FILE* input = fdopen(STDIN_FILENO, "r"); FILE* output = fopen("/tmp/dump.edsp", "w"); diff --git a/cmdline/apt-internal-solver.cc b/cmdline/apt-internal-solver.cc index e4cdf6381..0cac12da2 100644 --- a/cmdline/apt-internal-solver.cc +++ b/cmdline/apt-internal-solver.cc @@ -74,6 +74,9 @@ int main(int argc,const char *argv[]) /*{{{*/ {'o',"option",0,CommandLine::ArbItem}, {0,0,0,0}}; + // we really don't need anything + DropPrivs(); + CommandLine CmdL(Args,_config); if (pkgInitConfig(*_config) == false || CmdL.Parse(argc,argv) == false) { |