From 94c4ac621f23e55b42f10d4cba920f2c7580005e Mon Sep 17 00:00:00 2001 From: Kaz Kylheku Date: Mon, 2 May 2016 21:09:19 -0700 Subject: Implement setgid script support. TXR now notices that it's running setgid, and implements setgid logic for scripts. * sysif.c (orig_egid, real_gid, is_setgid): New static variables. (repress_privilege): Treat real and effective group ID similarly to user ID. Save them in global variables, and set the is_setgid flag. (drop_privilege): Drop setgid privilege similarly to setuid. Operate selectively: if neither setuid nor setgid is in effect, do nothing, but if just one is in effect, don't do anything for the other. (simulate_setuid): Function renamed to simulate_setuid_setgid. A small change is made here: if the fstat fails, just drop privilege, don't abort. Implement setgid operation independently of setuid. The is_setgid and is_setuid flags are manipulated here now to get the drop_privileges function to selectively drop setuid if we are running a script which is only segid, or drop setgid if we are running a setuid only script. * sysif.h (simulate_setuid): Declaration name change to simulate_setuid_setgid. * txr.c (txr_main): Follow rename of simulate_setuid. * txr.1: SETUID OPERATION section changed to SETUID/SETGID operation, and setgid description worked into the text. --- sysif.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'sysif.h') diff --git a/sysif.h b/sysif.h index 99cb3ac0..093e4152 100644 --- a/sysif.h +++ b/sysif.h @@ -56,10 +56,10 @@ val stdio_fseek(FILE *, val, int whence); #if HAVE_GETEUID void repress_privilege(void); void drop_privilege(void); -void simulate_setuid(val open_script); +void simulate_setuid_setgid(val open_script); #else INLINE void repress_privilege(void) { } INLINE void drop_privilege(void) { } -INLINE void simulate_setuid(val open_script) { } +INLINE void simulate_setuid_setgid(val open_script) { } #endif void sysif_init(void); -- cgit v1.2.3