From patchwork Thu Jun 6 02:27:10 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Schantl X-Patchwork-Id: 2283 Return-Path: Received: from mail01.ipfire.org (mail01.i.ipfire.org [172.28.1.200]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mail01.ipfire.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by web07.i.ipfire.org (Postfix) with ESMTPS id 237E28C9E69 for ; Wed, 5 Jun 2019 17:27:47 +0100 (BST) Received: from mail01.i.ipfire.org (localhost [IPv6:::1]) by mail01.ipfire.org (Postfix) with ESMTP id 45JvN22M6Xz50MDk; Wed, 5 Jun 2019 17:27:46 +0100 (BST) Received: from tuxedo.stevee (212095005054.public.telering.at [212.95.5.54]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mail01.ipfire.org (Postfix) with ESMTPSA id 45JvMz2wGjz5ND5r; Wed, 5 Jun 2019 17:27:43 +0100 (BST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ipfire.org; s=201904rsa; t=1559752063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=yj+o5E8LxrJyNVHAT1r7IOL2jDql2mB2S0nmwO0I51A=; b=vndYgkFeulzhhmpA2G5Q2zn9J/uFcUZfEU9iwLF4VmqlWNG0rICDOU5i/+XgpZ91x5+kO9 wZ9tDcIJk+ARtu9imvqkVNWAWk86QJzTYOnQKFmls7MKbuGTdbW0vq45jJcb4WDAAgxQO6 KlldrQBaycO2tWhmDoQYkUD8/3pgh9gFwzwlnbaEdXKS/3jfEQbQZPYk34ifDTAG6EexwS CDw4+lm4gjuXt0nFwHsvlVzzCQJGMMcVlLBnEEtLg3xeDrYwibDnfVJyiX+3nKVNapWx4P 2E7hPev9sFQmTTQW4eaIpVazbp6wjRwXW6Le4nLXrL03XBu8e9A1dkGppTlqsw== DKIM-Signature: v=1; a=ed25519-sha256; c=relaxed/relaxed; d=ipfire.org; s=201904ed25519; t=1559752063; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=yj+o5E8LxrJyNVHAT1r7IOL2jDql2mB2S0nmwO0I51A=; b=dk3CwOVz0xh3KvQXLti5fNuagnIIWD+ThvAuriPgq1tdRKOmdoAadyhyQN2SSzvR2RaLB1 T/E/9Y3l4BkXTeDA== From: Stefan Schantl To: development@lists.ipfire.org Subject: [PATCH] update-ids-ruleset: Run as unprivileged user. Date: Wed, 5 Jun 2019 18:27:10 +0200 Message-Id: <20190605162710.5130-1-stefan.schantl@ipfire.org> X-Mailer: git-send-email 2.20.1 MIME-Version: 1.0 Authentication-Results: mail01.ipfire.org; auth=pass smtp.auth=stevee smtp.mailfrom=stefan.schantl@ipfire.org X-BeenThere: development@lists.ipfire.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: IPFire development talk List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: development-bounces@lists.ipfire.org Sender: "Development" X-Spam: Yes Check if the script has been launched as privileged user (root) and drop all permissions by switching to the "nobody" user and group. Signed-off-by: Stefan Schantl --- src/scripts/update-ids-ruleset | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset index 956c3a1f5..dbe5b6849 100644 --- a/src/scripts/update-ids-ruleset +++ b/src/scripts/update-ids-ruleset @@ -20,11 +20,25 @@ ############################################################################### use strict; +use POSIX; require '/var/ipfire/general-functions.pl'; require "${General::swroot}/ids-functions.pl"; require "${General::swroot}/lang.pl"; +# The user and group name as which this script should be run. +my $run_as = 'nobody'; + +# Get user and group id of the user. +my ( $uid, $gid ) = ( getpwnam $run_as )[ 2, 3 ]; + +# Check if the script currently runs as root. +if ( $> == 0 ) { + # Drop privileges and switch to the specified user and group. + POSIX::setgid( $gid ); + POSIX::setuid( $uid ); +} + # Check if the red device is active. unless (-e "${General::swroot}/red/active") { # Store notice in the syslog.