user-util: add new helper fully_set_uid_gid()

Usually when we do setresuid() we also do setesgid() and setgroups().
Let's add a common helper that does all three, and use it everywhere.
This commit is contained in:
Lennart Poettering
2023-12-06 22:11:38 +01:00
parent eb981a5b9b
commit 6498a0c2cc
7 changed files with 32 additions and 54 deletions
+14 -5
View File
@@ -661,17 +661,26 @@ int get_shell(char **ret) {
return path_simplify_alloc(e, ret);
}
int reset_uid_gid(void) {
int fully_set_uid_gid(uid_t uid, gid_t gid, const gid_t supplementary_gids[], size_t n_supplementary_gids) {
int r;
r = maybe_setgroups(0, NULL);
assert(supplementary_gids || n_supplementary_gids == 0);
/* Sets all UIDs and all GIDs to the specified ones. Drops all auxiliary GIDs */
r = maybe_setgroups(n_supplementary_gids, supplementary_gids);
if (r < 0)
return r;
if (setresgid(0, 0, 0) < 0)
return -errno;
if (gid_is_valid(gid))
if (setresgid(gid, gid, gid) < 0)
return -errno;
return RET_NERRNO(setresuid(0, 0, 0));
if (uid_is_valid(uid))
if (setresuid(uid, uid, uid) < 0)
return -errno;
return 0;
}
int take_etc_passwd_lock(const char *root) {
+4 -1
View File
@@ -57,7 +57,10 @@ int getgroups_alloc(gid_t** gids);
int get_home_dir(char **ret);
int get_shell(char **ret);
int reset_uid_gid(void);
int fully_set_uid_gid(uid_t uid, gid_t gid, const gid_t supplementary_gids[], size_t n_supplementary_gids);
static inline int reset_uid_gid(void) {
return fully_set_uid_gid(0, 0, NULL, 0);
}
int take_etc_passwd_lock(const char *root);