proxmox-mirrors/pve-common
1
0
Fork 0
mirror of https://git.proxmox.com/git/pve-common synced 2025-07-27 13:13:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Daemon: new option to change user/group (setuid/setgid)

Browse Source
This commit is contained in:
Dietmar Maurer 2015-01-02 14:06:46 +01:00
parent 9403080a44
commit c4ad45cf20
1 changed files with 22 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
data/PVE/Daemon.pm
View File

@ -12,9 +12,12 @@ package PVE::Daemon;
# * handle worker processes (option 'max_workers') # * handle worker processes (option 'max_workers')
# * allow to restart while workers are still runningl # * allow to restart while workers are still runningl
# (option 'leave_children_open_on_reload') # (option 'leave_children_open_on_reload')
# * run as different user using setuid/setgid
use strict; use strict;
use warnings; use warnings;
use English;
use PVE::SafeSyslog; use PVE::SafeSyslog;
use PVE::INotify; use PVE::INotify;
@ -427,11 +430,30 @@ sub new {
$self->{$opt} = $value; $self->{$opt} = $value;
} elsif ($opt eq 'leave_children_open_on_reload') { } elsif ($opt eq 'leave_children_open_on_reload') {
$self->{$opt} = $value; $self->{$opt} = $value;
} elsif ($opt eq 'setgid') {
$self->{$opt} = $value;
} elsif ($opt eq 'setuid') {
$self->{$opt} = $value;
} else { } else {
die "unknown daemon option '$opt'\n"; die "unknown daemon option '$opt'\n";
} }
} }
if (my $gidstr = $self->{setgid}) {
my $gid = getgrnam($gidstr) || die "getgrnam failed - $!\n";
POSIX::setgid($gid) || die "setgid $gid failed - $!\n";
$EGID = "$gid $gid"; # this calls setgroups
# just to be sure
die "detected strange gid\n" if !($GID eq "$gid $gid" && $EGID eq "$gid $gid");
}
if (my $uidstr = $self->{setuid}) {
my $uid = getpwnam($uidstr) || die "getpwnam failed - $!\n";
POSIX::setuid($uid) || die "setuid $uid failed - $!\n";
# just to be sure
die "detected strange uid\n" if !($UID == $uid && $EUID == $uid);
}
if ($restart && $self->{max_workers}) { if ($restart && $self->{max_workers}) {
if (my $wpids = $ENV{PVE_DAEMON_WORKER_PIDS}) { if (my $wpids = $ENV{PVE_DAEMON_WORKER_PIDS}) {
foreach my $pid (split(':', $wpids)) { foreach my $pid (split(':', $wpids)) {