diff --git a/README.md b/README.md index 011c0da..86550e9 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ # godrop - drop privileges -Godrop is a simple library to drop privileges on linux maschines. +Godrop is a simple library to drop privileges on Linux and OpenBSD maschines. See the examples directory on how to use the `Drop` and `MultiDrop` functions. diff --git a/go.mod b/go.mod index 1d3f890..a41c9af 100644 --- a/go.mod +++ b/go.mod @@ -1 +1,3 @@ module git.giftfish.de/ston1th/godrop/v2 + +require golang.org/x/sys v0.0.0-20181026144532-2772b66316d2 // indirect diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..36d0abd --- /dev/null +++ b/go.sum @@ -0,0 +1,2 @@ +golang.org/x/sys v0.0.0-20181026144532-2772b66316d2 h1:W7CqTdBJ1CmxLKe7LptKDnBYV6PHrVLiGnoyBjaG/JQ= +golang.org/x/sys v0.0.0-20181026144532-2772b66316d2/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= diff --git a/godrop.go b/godrop.go index f1cf20e..55f39ec 100644 --- a/godrop.go +++ b/godrop.go @@ -2,10 +2,11 @@ // +build go1.11 -// Package godrop provides a simple privileges dropping library +// Package godrop provides a simple library to drop privileges on Linux and OpenBSD. package godrop import ( + "errors" "fmt" "net" "os" @@ -14,10 +15,6 @@ import ( "syscall" ) -func errf(i interface{}) error { - return fmt.Errorf("godrop: %s", i) -} - // Config represents the drop config type Config struct { // User is the user to drop privileges to. @@ -43,21 +40,21 @@ func Drop(c Config, f func() (net.Listener, error)) error { func MultiDrop(c Config, f func() ([]net.Listener, error)) error { uid, err := userID(c.User) if err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } if uid == 0 { - return errf("unable to drop privileges to uid 0 (root)") + return fmt.Errorf("godrop: you can't drop privileges to uid 0 (%s)", c.User) } gid, err := groupID(c.Group) if err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } switch os.Getuid() { case 0: cmd := exec.Command(os.Args[0], os.Args[1:]...) ln, err := f() if err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } for i, v := range ln { var f *os.File @@ -69,10 +66,10 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { f, err = l.File() l.Close() default: - return errf(fmt.Sprintf("index %d listener is not type of either *net.TCPListener or *net.UnixListener", i)) + return fmt.Errorf("godrop: index %d listener is not type of either *net.TCPListener or *net.UnixListener", i) } if err != nil { - return errf(fmt.Sprintf("index %d %s", i, err)) + return fmt.Errorf("godrop: index %d %s", i, err) } cmd.ExtraFiles = append(cmd.ExtraFiles, f) } @@ -93,7 +90,7 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { } if err := cmd.Start(); err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } if c.Foreground { @@ -120,7 +117,7 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { case uid: return nil } - return errf("dropping priviledges failed") + return errors.New("godrop: dropping priviledges failed") } // GetListener returns the listener socket of file descriptor 3 @@ -131,7 +128,7 @@ func GetListener() (net.Listener, error) { // GetListenerFd returns the listener socket of the given file descriptor func GetListenerFd(fd int) (net.Listener, error) { if fd < 3 { - return nil, errf("fd is less than 3") + return nil, errors.New("godrop: fd is less than 3") } f := os.NewFile(uintptr(fd), "") defer f.Close() diff --git a/pledge.go b/pledge.go new file mode 100644 index 0000000..d0e361e --- /dev/null +++ b/pledge.go @@ -0,0 +1,14 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build !openbsd + +package godrop + +// Pledge is currently only supported on OpenBSD. +func Pledge(promises, execpromises string) error { return nil } + +// PledgePromises is currently only supported on OpenBSD. +func PledgePromises(promises string) error { return nil } + +// PledgeExecPromises is currently only supported on OpenBSD. +func PledgeExecpromises(execpromises string) error { return nil } diff --git a/pledge_openbsd.go b/pledge_openbsd.go new file mode 100644 index 0000000..7369b03 --- /dev/null +++ b/pledge_openbsd.go @@ -0,0 +1,43 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build openbsd + +package godrop + +import ( + "errors" + "golang.org/x/sys/unix" +) + +// Pledge is a wrapper for x/sys/unix Pledge. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_pledge.go for usage. +func Pledge(promises, execpromises string) (err error) { + err = unix.Pledge(promises, execpromises) + if err != nil { + err = errors.New("pledge: " + err.Error()) + } + return +} + +// PledgePromises is a wrapper for x/sys/unix PledgePromises. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_pledge.go for usage. +func PledgePromises(promises string) (err error) { + err = unix.PledgePromises(promises) + if err != nil { + err = errors.New("pledge: " + err.Error()) + } + return +} + +// PledgeExecpromises is a wrapper for x/sys/unix PledgeExecpromises. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_pledge.go for usage. +func PledgeExecpromises(execpromises string) (err error) { + err = unix.PledgeExecpromises(execpromises) + if err != nil { + err = errors.New("pledge: " + err.Error()) + } + return +} diff --git a/unveil.go b/unveil.go new file mode 100644 index 0000000..06c8c90 --- /dev/null +++ b/unveil.go @@ -0,0 +1,11 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build !openbsd + +package godrop + +// Unveil is currently only supported on OpenBSD. +func Unveil(path, flags string) error { return nil } + +// UnveilBlock is currently only supported on OpenBSD. +func UnveilBlock() error { return nil } diff --git a/unveil_openbsd.go b/unveil_openbsd.go new file mode 100644 index 0000000..c913e79 --- /dev/null +++ b/unveil_openbsd.go @@ -0,0 +1,32 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build openbsd + +package godrop + +import ( + "errors" + "golang.org/x/sys/unix" +) + +// Unveil is a wrapper for x/sys/unix Unveil. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_unveil.go for usage. +func Unveil(path, flags string) (err error) { + err = unix.Unveil(path, flags) + if err != nil { + err = errors.New("unveil: ", err.Error()) + } + return +} + +// UnveilBlock is a wrapper for x/sys/unix UnveilBlock. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_unveil.go for usage. +func UnveilBlock() (err error) { + err = unix.UnveilBlock() + if err != nil { + err = errors.New("unveil: ", err.Error()) + } + return +}