Privilege.cpp

/*
** libutil++
** $Id: Privilege.cpp 1805 2016-12-01 19:16:37Z sella $
** Copyright (c) 2011-2016 Digital Genesis, LLC. All Rights Reserved.
** Released under the LGPL Version 2.1 License.
** http://www.digitalgenesis.com
*/

static const char rcsid[] __attribute__((used)) = "$Id: Privilege.cpp 1805 2016-12-01 19:16:37Z sella $";

#include "Privilege.h"

#include <string.h>
#include <pwd.h>
#include <grp.h>
#include <sys/prctl.h>

using namespace sella::util;

Privilege::Privilege() throw () : uid(-1), gid(-1) {
        ouid = getuid();
        ogid = getgid();

        capabilities = cap_get_proc();
}

Privilege::Privilege(const Privilege &other) :
        ouid(other.ouid),
        uid(other.uid),
        ogid(other.ogid),
        gid(other.gid)
{
        capabilities = cap_get_proc();
}

Privilege::~Privilege() {
        clear();

        cap_free(capabilities);
}

Privilege& Privilege::operator=(const Privilege &other) throw () {
        if (this != &other) {
                this->ouid = other.ouid;
                this->uid = other.uid;
                this->ogid = other.ogid;
                this->gid = other.gid;
        }

        return *this;
}

void Privilege::applyIdentity(void) const throw (PrivilegeException) {
        if (prctl(PR_SET_KEEPCAPS, 1L)) { /* Retain set capabilities. */
                THROW(PrivilegeException, "Failed to retain capabilities");
        }

        if ((signed) gid != -1) {
                if (setgid(gid) != 0) {
                        THROW(PrivilegeException, "Failed to set gid to %d", gid);
                }
        }

        if ((signed) uid != -1) {
                if (setuid(uid) != 0) {
                        THROW(PrivilegeException, "Failed to set uid to %d", uid);
                }
        }
}

void Privilege::applyEffectiveIdentity(void) const throw (PrivilegeException) {
        if ((signed) gid != -1) {
                if (setegid(gid) != 0) {
                        THROW(PrivilegeException, "Failed to set effective gid to %d", gid);
                }
        }

        if ((signed) uid != -1) {
                if (seteuid(uid) != 0) {
                        THROW(PrivilegeException, "Failed to set effective uid to %d", uid);
                }
        }
}

void Privilege::restoreIdentity(void) const throw (PrivilegeException) {
        if (setgid(ogid) != 0) {
                THROW(PrivilegeException, "Failed to restore original gid of %d", ogid);
        }

        if (setuid(ouid) != 0) {
                THROW(PrivilegeException, "Failed to restore original uid of %d", ouid);
        }
}

void Privilege::restoreEffectiveIdentity(void) const throw (PrivilegeException) {
        if (setegid(ogid) != 0) {
                THROW(PrivilegeException, "Failed to restore original effective gid of %d", ogid);
        }

        if (seteuid(ouid) != 0) {
                THROW(PrivilegeException, "Failed to restore original effective uid of %d", ouid);
        }
}

void Privilege::setUID(uid_t &uid, bool setGID) throw (PrivilegeException) {
        struct passwd pw, *p;
        char buf[200];

        if (getpwuid_r(uid, &pw, buf, sizeof(buf), &p) != 0) {
                THROW2(PrivilegeException, "getpwuid_r");
        }

        this->uid = uid;

        if (setGID) {
                this->gid = pw.pw_gid;
        }
}

void Privilege::setUID(const std::string &user, bool setGID) throw (PrivilegeException) {
        struct passwd pw, *p;
        char buf[200];

        if (getpwnam_r(user.c_str(), &pw, buf, sizeof(buf), &p) != 0) {
                THROW2(PrivilegeException, "getpwnam_r");
        }

        this->uid = pw.pw_uid;

        if (setGID) {
                this->gid = pw.pw_gid;
        }
}

void Privilege::setGID(gid_t &gid) throw () {
        this->gid = gid;
}

void Privilege::setGID(const std::string &group) throw (PrivilegeException) {
        struct group gr, *g;
        char buf[200];

        if (getgrnam_r(group.c_str(), &gr, buf, sizeof(buf), &g) != 0) {
                THROW2(PrivilegeException, "getgrnam_r");
        }

        this->gid = gr.gr_gid;
}

const uid_t& Privilege::getUID(void) const throw () {
        return this->uid;
}

const uid_t Privilege::getCurrentUID(void) const throw () {
        return getuid();
}

const uid_t Privilege::getEffectiveUID(void) const throw () {
        return geteuid();
}

const uid_t& Privilege::getOriginalUID(void) const throw () {
        return this->ouid;
}

const gid_t& Privilege::getGID(void) const throw () {
        return this->gid;
}

const gid_t Privilege::getCurrentGID(void) const throw () {
        return getgid();
}

const gid_t Privilege::getEffectiveGID(void) const throw () {
        return getegid();
}

const gid_t& Privilege::getOriginalGID(void) const throw () {
        return this->ogid;
}

bool Privilege::isRoot(void) const throw () {
        return (getEffectiveUID() == 0);
}

bool Privilege::isRootGroup(void) const throw () {
        return (getEffectiveGID() == 0);
}

bool Privilege::wasRoot(void) const throw () {
        return (getOriginalUID() == 0);
}

bool Privilege::wasRootGroup(void) const throw () {
        return (getOriginalGID() == 0);
}

void Privilege::clear(void) throw () {
        this->uid = -1;
        this->gid = -1;
}

bool Privilege::setAll(void) throw () {
        return false;
}

void Privilege::applyCapabilities(bool retain) const throw (PrivilegeException) {
        if (retain) {
                if (prctl(PR_SET_KEEPCAPS, 1L)) { /* Retain set capabilities. */
                        THROW(PrivilegeException, "Failed to retain capabilities");
                }
        }

        if (cap_set_proc(this->capabilities) == -1) {
                THROW(PrivilegeException, "Failed to apply capabilities");
        }
}

void Privilege::clearRetain(void) const throw (PrivilegeException) {
        if (prctl(PR_SET_KEEPCAPS, 0L)) {
                THROW(PrivilegeException, "Failed to retain capabilities");
        }
}

bool Privilege::setCapability(cap_value_t cap) throw () {
        cap_value_t capability[1] = { cap };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setChown(void) throw () {
        cap_value_t capability[1] = { CAP_CHOWN };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSetGid(void) throw () {
        cap_value_t capability[1] = { CAP_SETGID };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSetUid(void) throw () {
        cap_value_t capability[1] = { CAP_SETUID };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setProcessCapability(void) throw () {
        cap_value_t capability[1] = { CAP_SETPCAP };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setLinuxImmutable(void) throw () {
        cap_value_t capability[1] = { CAP_LINUX_IMMUTABLE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setNetBroadcast(void) throw () {
        cap_value_t capability[1] = { CAP_NET_BROADCAST };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setNetAdmin(void) throw () {
        cap_value_t capability[1] = { CAP_NET_ADMIN };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setIPCOwner(void) throw () {
        cap_value_t capability[1] = { CAP_IPC_OWNER };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysModule(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_MODULE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysProcessTrace(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_PTRACE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysProcessAccount(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_PACCT };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysAdmin(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_ADMIN };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysBoot(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_BOOT };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysTime(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_TIME };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysTTYConfig(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_TTY_CONFIG };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setMakeNode(void) throw () {
        cap_value_t capability[1] = { CAP_MKNOD };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setLease(void) throw () {
        cap_value_t capability[1] = { CAP_LEASE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setAuditWrite(void) throw () {
        cap_value_t capability[1] = { CAP_AUDIT_WRITE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setAuditControl(void) throw () {
        cap_value_t capability[1] = { CAP_AUDIT_CONTROL };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSetFileCapability(void) throw () {
        cap_value_t capability[1] = { CAP_SETFCAP };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setMACOverride(void) throw () {
        cap_value_t capability[1] = { CAP_MAC_OVERRIDE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setMACAdmin(void) throw () {
        cap_value_t capability[1] = { CAP_MAC_ADMIN };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSyslog(void) throw () {
        cap_value_t capability[1] = { CAP_SYSLOG };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setWakeAlarm(void) throw () {
        cap_value_t capability[1] = { CAP_WAKE_ALARM };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setBlockSuspend(void) throw () {
        cap_value_t capability[1] = { CAP_BLOCK_SUSPEND };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setDACOverride(void) throw () {
        cap_value_t capability[1] = { CAP_DAC_OVERRIDE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setDACReadSearch(void) throw () {
        cap_value_t capability[1] = { CAP_DAC_READ_SEARCH };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setFileOwner(void) throw () {
        cap_value_t capability[1] = { CAP_FOWNER };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setFileSetId(void) throw () {
        cap_value_t capability[1] = { CAP_FSETID };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setIPCLock(void) throw () {
        cap_value_t capability[1] = { CAP_IPC_LOCK };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setKill(void) throw () {
        cap_value_t capability[1] = { CAP_KILL };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setNetBindService(void) throw () {
        cap_value_t capability[1] = { CAP_NET_BIND_SERVICE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setNetRaw(void) throw () {
        cap_value_t capability[1] = { CAP_NET_RAW };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSetUID(void) throw () {
        cap_value_t capability[1] = { CAP_SETUID };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysChroot(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_CHROOT };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysNice(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_NICE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysRawIO(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_RAWIO };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::setSysResource(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_RESOURCE };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::clearAll(void) throw () {
        if (cap_clear(this->capabilities) == -1) {
                return false;
        }

        return true;
}

bool Privilege::clearCapability(cap_value_t cap) throw () {
        cap_value_t capability[1] = { cap };

        return setFlags(capability, 1, CAP_SET);
}

bool Privilege::clearChown(void) throw () {
        cap_value_t capability[1] = { CAP_CHOWN };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearIPCLock(void) throw () {
        cap_value_t capability[1] = { CAP_IPC_LOCK };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearKill(void) throw () {
        cap_value_t capability[1] = { CAP_KILL };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearNetBindService(void) throw () {
        cap_value_t capability[1] = { CAP_NET_BIND_SERVICE };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearNetRaw(void) throw () {
        cap_value_t capability[1] = { CAP_NET_RAW };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearSetUID(void) throw () {
        cap_value_t capability[1] = { CAP_SETUID };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearSysChroot(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_CHROOT };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearSysNice(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_NICE };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearSysRawIO(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_RAWIO };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::clearSysResource(void) throw () {
        cap_value_t capability[1] = { CAP_SYS_RESOURCE };

        return setFlags(capability, 1, CAP_CLEAR);
}

bool Privilege::hasNone(void) const throw () {
        return false;
}

bool Privilege::hasCapability(cap_value_t cap) const throw () {
        cap_flag_value_t value;

        if (!getFlag(cap, value)) {
                return false;
        }

        return (value == CAP_SET);
}

bool Privilege::hasChown(void) const throw () {
        return hasCapability(CAP_CHOWN);
}

bool Privilege::hasIPCLock(void) const throw () {
        return false;
}

bool Privilege::hasKill(void) const throw () {
        return false;
}

bool Privilege::hasNetBindService(void) const throw () {
        return false;
}

bool Privilege::hasNetRaw(void) const throw () {
        return false;
}

bool Privilege::hasSetUID(void) const throw () {
        return false;
}

bool Privilege::hasSysChroot(void) const throw () {
        return false;
}

bool Privilege::hasSysNice(void) const throw () {
        return hasCapability(CAP_SYS_NICE);
}

bool Privilege::hasSysRawIO(void) const throw () {
        return false;
}

bool Privilege::hasSysResource(void) const throw () {
        return false;
}

const Privilege::shared Privilege::shared_ptr(void) throw () {
        return std::make_shared<Privilege>();
}

bool Privilege::setFlags(cap_value_t capability[], int ncap, cap_flag_value_t value) throw () {
        if (cap_set_flag(this->capabilities, CAP_EFFECTIVE, ncap, capability, value) == -1) {
                return false;
        }

        if (cap_set_flag(this->capabilities, CAP_PERMITTED, ncap, capability, value) == -1) {
                return false;
        }

        if (cap_set_flag(this->capabilities, CAP_INHERITABLE, ncap, capability, value) == -1) {
                return false;
        }

        return true;
}

bool Privilege::getFlag(cap_value_t capability, cap_flag_value_t &value) const throw () {
        if (cap_get_flag(capabilities, capability, CAP_EFFECTIVE, &value) == -1) {
                return false;
        }

        return true;
}

/*
** vim: noet ts=3 sw=3
*/