enoch/n2n
1
0
Fork 0
mirror of https://github.com/ntop/n2n.git synced 2024-09-19 16:41:11 +02:00
Code Issues Actions Packages Projects Releases 1 Wiki Activity

Drop privileges by default for edge nodes and add root warning

Browse Source
This commit is contained in:
emanuele-f 2019-06-19 01:14:54 +02:00
parent 636c57768f
commit b19232bc7a
2 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

23
edge.c
View File

@ -19,6 +19,8 @@
#include "n2n.h"
#ifdef WIN32
#include <sys/stat.h>
#else
#include <pwd.h>
#endif
#define N2N_NETMASK_STR_SIZE 16 /* dotted decimal 12 numbers + 3 dots */
@ -577,6 +579,9 @@ int main(int argc, char* argv[]) {
n2n_edge_t *eee; /* single instance for this program */
n2n_edge_conf_t conf; /* generic N2N edge config */
n2n_priv_config_t ec; /* config used for standalone program execution */
#ifndef WIN32
struct passwd *pw = NULL;
#endif
if(argc == 1)
help();
@ -586,9 +591,13 @@ int main(int argc, char* argv[]) {
memset(&ec, 0, sizeof(ec));
ec.mtu = DEFAULT_MTU;
ec.daemon = 1; /* By default run in daemon mode. */
#ifndef WIN32
ec.userid = 0; /* root is the only guaranteed ID */
ec.groupid = 0; /* root is the only guaranteed ID */
if(((pw = getpwnam("n2n")) != NULL) ||
((pw = getpwnam("nobody")) != NULL)) {
ec.userid = pw->pw_uid;
ec.groupid = pw->pw_gid;
}
#endif
#ifdef WIN32
@ -658,9 +667,15 @@ int main(int argc, char* argv[]) {
(signed int)ec.userid, (signed int)ec.groupid);
/* Finished with the need for root privileges. Drop to unprivileged user. */
setreuid(ec.userid, ec.userid);
setregid(ec.groupid, ec.groupid);
if((setgid(ec.groupid) != 0)
|| (setuid(ec.userid) != 0)) {
traceEvent(TRACE_ERROR, "Unable to drop privileges [%u/%s]", errno, strerror(errno));
exit(1);
}
}
if((getuid() == 0) || (getgid() == 0))
traceEvent(TRACE_WARNING, "Running as root is discouraged, check out the -u/-g options");
#endif
#ifdef __linux__

5
sn.c
View File

@ -993,6 +993,11 @@ int main(int argc, char * const argv[]) {
}
#endif /* #if defined(N2N_HAVE_DAEMON) */
#ifndef WIN32
if((getuid() == 0) || (getgid() == 0))
traceEvent(TRACE_WARNING, "Running as root is discouraged");
#endif
traceEvent(TRACE_DEBUG, "traceLevel is %d", getTraceLevel());
sss_node.sock = open_socket(sss_node.lport, 1 /*bind ANY*/);