From 23731a3702508e1184cd9986f21c7523e7cd78f8 Mon Sep 17 00:00:00 2001 From: ston1th Date: Thu, 20 Sep 2018 00:14:13 +0200 Subject: [PATCH 1/6] bugfix --- godrop.go | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/godrop.go b/godrop.go index 894cb23..f1cf20e 100644 --- a/godrop.go +++ b/godrop.go @@ -10,6 +10,7 @@ import ( "net" "os" "os/exec" + "os/signal" "syscall" ) @@ -86,12 +87,9 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { } if c.Foreground { - cmd.SysProcAttr.Setctty = true cmd.Stdin = os.Stdin cmd.Stdout = os.Stdout cmd.Stderr = os.Stderr - } else { - cmd.SysProcAttr.Noctty = true } if err := cmd.Start(); err != nil { @@ -99,6 +97,21 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { } if c.Foreground { + go func() { + term := make(chan os.Signal) + signal.Notify(term, syscall.SIGHUP, syscall.SIGINT, syscall.SIGTERM, syscall.SIGQUIT) + sigs := make(chan os.Signal) + signal.Notify(sigs, syscall.SIGSTOP, syscall.SIGCONT, syscall.SIGUSR1, syscall.SIGUSR2) + for { + select { + case sig := <-term: + cmd.Process.Signal(sig) + return + case sig := <-sigs: + cmd.Process.Signal(sig) + } + } + }() _ = cmd.Wait() os.Exit(int(cmd.ProcessState.Sys().(syscall.WaitStatus))) } From 089d8d16c8902848caad1b1d45300b0bb289214f Mon Sep 17 00:00:00 2001 From: ston1th Date: Fri, 26 Oct 2018 16:52:08 +0200 Subject: [PATCH 2/6] added pledge and unveil support --- README.md | 2 +- go.mod | 2 ++ go.sum | 2 ++ godrop.go | 25 +++++++++++-------------- pledge.go | 14 ++++++++++++++ pledge_openbsd.go | 43 +++++++++++++++++++++++++++++++++++++++++++ unveil.go | 11 +++++++++++ unveil_openbsd.go | 32 ++++++++++++++++++++++++++++++++ 8 files changed, 116 insertions(+), 15 deletions(-) create mode 100644 go.sum create mode 100644 pledge.go create mode 100644 pledge_openbsd.go create mode 100644 unveil.go create mode 100644 unveil_openbsd.go diff --git a/README.md b/README.md index 011c0da..86550e9 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ # godrop - drop privileges -Godrop is a simple library to drop privileges on linux maschines. +Godrop is a simple library to drop privileges on Linux and OpenBSD maschines. See the examples directory on how to use the `Drop` and `MultiDrop` functions. diff --git a/go.mod b/go.mod index 1d3f890..a41c9af 100644 --- a/go.mod +++ b/go.mod @@ -1 +1,3 @@ module git.giftfish.de/ston1th/godrop/v2 + +require golang.org/x/sys v0.0.0-20181026144532-2772b66316d2 // indirect diff --git a/go.sum b/go.sum new file mode 100644 index 0000000..36d0abd --- /dev/null +++ b/go.sum @@ -0,0 +1,2 @@ +golang.org/x/sys v0.0.0-20181026144532-2772b66316d2 h1:W7CqTdBJ1CmxLKe7LptKDnBYV6PHrVLiGnoyBjaG/JQ= +golang.org/x/sys v0.0.0-20181026144532-2772b66316d2/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= diff --git a/godrop.go b/godrop.go index f1cf20e..55f39ec 100644 --- a/godrop.go +++ b/godrop.go @@ -2,10 +2,11 @@ // +build go1.11 -// Package godrop provides a simple privileges dropping library +// Package godrop provides a simple library to drop privileges on Linux and OpenBSD. package godrop import ( + "errors" "fmt" "net" "os" @@ -14,10 +15,6 @@ import ( "syscall" ) -func errf(i interface{}) error { - return fmt.Errorf("godrop: %s", i) -} - // Config represents the drop config type Config struct { // User is the user to drop privileges to. @@ -43,21 +40,21 @@ func Drop(c Config, f func() (net.Listener, error)) error { func MultiDrop(c Config, f func() ([]net.Listener, error)) error { uid, err := userID(c.User) if err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } if uid == 0 { - return errf("unable to drop privileges to uid 0 (root)") + return fmt.Errorf("godrop: you can't drop privileges to uid 0 (%s)", c.User) } gid, err := groupID(c.Group) if err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } switch os.Getuid() { case 0: cmd := exec.Command(os.Args[0], os.Args[1:]...) ln, err := f() if err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } for i, v := range ln { var f *os.File @@ -69,10 +66,10 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { f, err = l.File() l.Close() default: - return errf(fmt.Sprintf("index %d listener is not type of either *net.TCPListener or *net.UnixListener", i)) + return fmt.Errorf("godrop: index %d listener is not type of either *net.TCPListener or *net.UnixListener", i) } if err != nil { - return errf(fmt.Sprintf("index %d %s", i, err)) + return fmt.Errorf("godrop: index %d %s", i, err) } cmd.ExtraFiles = append(cmd.ExtraFiles, f) } @@ -93,7 +90,7 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { } if err := cmd.Start(); err != nil { - return errf(err) + return errors.New("godrop: " + err.Error()) } if c.Foreground { @@ -120,7 +117,7 @@ func MultiDrop(c Config, f func() ([]net.Listener, error)) error { case uid: return nil } - return errf("dropping priviledges failed") + return errors.New("godrop: dropping priviledges failed") } // GetListener returns the listener socket of file descriptor 3 @@ -131,7 +128,7 @@ func GetListener() (net.Listener, error) { // GetListenerFd returns the listener socket of the given file descriptor func GetListenerFd(fd int) (net.Listener, error) { if fd < 3 { - return nil, errf("fd is less than 3") + return nil, errors.New("godrop: fd is less than 3") } f := os.NewFile(uintptr(fd), "") defer f.Close() diff --git a/pledge.go b/pledge.go new file mode 100644 index 0000000..d0e361e --- /dev/null +++ b/pledge.go @@ -0,0 +1,14 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build !openbsd + +package godrop + +// Pledge is currently only supported on OpenBSD. +func Pledge(promises, execpromises string) error { return nil } + +// PledgePromises is currently only supported on OpenBSD. +func PledgePromises(promises string) error { return nil } + +// PledgeExecPromises is currently only supported on OpenBSD. +func PledgeExecpromises(execpromises string) error { return nil } diff --git a/pledge_openbsd.go b/pledge_openbsd.go new file mode 100644 index 0000000..7369b03 --- /dev/null +++ b/pledge_openbsd.go @@ -0,0 +1,43 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build openbsd + +package godrop + +import ( + "errors" + "golang.org/x/sys/unix" +) + +// Pledge is a wrapper for x/sys/unix Pledge. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_pledge.go for usage. +func Pledge(promises, execpromises string) (err error) { + err = unix.Pledge(promises, execpromises) + if err != nil { + err = errors.New("pledge: " + err.Error()) + } + return +} + +// PledgePromises is a wrapper for x/sys/unix PledgePromises. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_pledge.go for usage. +func PledgePromises(promises string) (err error) { + err = unix.PledgePromises(promises) + if err != nil { + err = errors.New("pledge: " + err.Error()) + } + return +} + +// PledgeExecpromises is a wrapper for x/sys/unix PledgeExecpromises. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_pledge.go for usage. +func PledgeExecpromises(execpromises string) (err error) { + err = unix.PledgeExecpromises(execpromises) + if err != nil { + err = errors.New("pledge: " + err.Error()) + } + return +} diff --git a/unveil.go b/unveil.go new file mode 100644 index 0000000..06c8c90 --- /dev/null +++ b/unveil.go @@ -0,0 +1,11 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build !openbsd + +package godrop + +// Unveil is currently only supported on OpenBSD. +func Unveil(path, flags string) error { return nil } + +// UnveilBlock is currently only supported on OpenBSD. +func UnveilBlock() error { return nil } diff --git a/unveil_openbsd.go b/unveil_openbsd.go new file mode 100644 index 0000000..c913e79 --- /dev/null +++ b/unveil_openbsd.go @@ -0,0 +1,32 @@ +// Copyright (C) 2018 Marius Schellenberger + +// +build openbsd + +package godrop + +import ( + "errors" + "golang.org/x/sys/unix" +) + +// Unveil is a wrapper for x/sys/unix Unveil. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_unveil.go for usage. +func Unveil(path, flags string) (err error) { + err = unix.Unveil(path, flags) + if err != nil { + err = errors.New("unveil: ", err.Error()) + } + return +} + +// UnveilBlock is a wrapper for x/sys/unix UnveilBlock. +// +// See https://go.googlesource.com/sys/+/master/unix/openbsd_unveil.go for usage. +func UnveilBlock() (err error) { + err = unix.UnveilBlock() + if err != nil { + err = errors.New("unveil: ", err.Error()) + } + return +} From ec32483e7f69d9c5600a66a99fba4e37ad5560c4 Mon Sep 17 00:00:00 2001 From: ston1th Date: Fri, 26 Oct 2018 16:54:12 +0200 Subject: [PATCH 3/6] fixed typo --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 86550e9..bcd5479 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,5 @@ # godrop - drop privileges -Godrop is a simple library to drop privileges on Linux and OpenBSD maschines. +Godrop is a simple library to drop privileges on Linux and OpenBSD. See the examples directory on how to use the `Drop` and `MultiDrop` functions. From 3e528ceb3f460f3691054e3551272ea7d078cd50 Mon Sep 17 00:00:00 2001 From: ston1th Date: Fri, 26 Oct 2018 17:02:28 +0200 Subject: [PATCH 4/6] unveil bugfix --- unveil_openbsd.go | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/unveil_openbsd.go b/unveil_openbsd.go index c913e79..f32d630 100644 --- a/unveil_openbsd.go +++ b/unveil_openbsd.go @@ -15,7 +15,7 @@ import ( func Unveil(path, flags string) (err error) { err = unix.Unveil(path, flags) if err != nil { - err = errors.New("unveil: ", err.Error()) + err = errors.New("unveil: " + err.Error()) } return } @@ -26,7 +26,7 @@ func Unveil(path, flags string) (err error) { func UnveilBlock() (err error) { err = unix.UnveilBlock() if err != nil { - err = errors.New("unveil: ", err.Error()) + err = errors.New("unveil: " + err.Error()) } return } From 77230f5240d853785717947c9f934c0adb78870b Mon Sep 17 00:00:00 2001 From: ston1th Date: Sat, 8 Oct 2022 16:59:34 +0200 Subject: [PATCH 5/6] update dependencies --- LICENSE | 2 +- go.mod | 4 +++- go.sum | 4 ++-- godrop.go | 3 ++- lookup.go | 3 ++- lookup_test.go | 2 +- pledge.go | 3 ++- pledge_openbsd.go | 3 ++- unveil.go | 3 ++- unveil_openbsd.go | 3 ++- 10 files changed, 19 insertions(+), 11 deletions(-) diff --git a/LICENSE b/LICENSE index 2bb060c..aa39852 100644 --- a/LICENSE +++ b/LICENSE @@ -1,4 +1,4 @@ -Copyright (C) 2017 Marius Schellenberger +Copyright (C) 2022 Marius Schellenberger All rights reserved. Redistribution and use in source and binary forms, with or without diff --git a/go.mod b/go.mod index a41c9af..54387f6 100644 --- a/go.mod +++ b/go.mod @@ -1,3 +1,5 @@ module git.giftfish.de/ston1th/godrop/v2 -require golang.org/x/sys v0.0.0-20181026144532-2772b66316d2 // indirect +go 1.19 + +require golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 diff --git a/go.sum b/go.sum index 36d0abd..e04231f 100644 --- a/go.sum +++ b/go.sum @@ -1,2 +1,2 @@ -golang.org/x/sys v0.0.0-20181026144532-2772b66316d2 h1:W7CqTdBJ1CmxLKe7LptKDnBYV6PHrVLiGnoyBjaG/JQ= -golang.org/x/sys v0.0.0-20181026144532-2772b66316d2/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= +golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 h1:AzgQNqF+FKwyQ5LbVrVqOcuuFB67N47F9+htZYH0wFM= +golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= diff --git a/godrop.go b/godrop.go index 55f39ec..37c7e75 100644 --- a/godrop.go +++ b/godrop.go @@ -1,5 +1,6 @@ -// Copyright (C) 2018 Marius Schellenberger +// Copyright (C) 2022 Marius Schellenberger +//go:build go1.11 // +build go1.11 // Package godrop provides a simple library to drop privileges on Linux and OpenBSD. diff --git a/lookup.go b/lookup.go index 2d0e1a9..725dc82 100644 --- a/lookup.go +++ b/lookup.go @@ -1,5 +1,6 @@ -// Copyright (C) 2018 Marius Schellenberger +// Copyright (C) 2022 Marius Schellenberger +//go:build go1.11 // +build go1.11 package godrop diff --git a/lookup_test.go b/lookup_test.go index bdcf7bd..49d2a78 100644 --- a/lookup_test.go +++ b/lookup_test.go @@ -1,4 +1,4 @@ -// Copyright (C) 2018 Marius Schellenberger +// Copyright (C) 2022 Marius Schellenberger package godrop diff --git a/pledge.go b/pledge.go index d0e361e..8c97aba 100644 --- a/pledge.go +++ b/pledge.go @@ -1,5 +1,6 @@ -// Copyright (C) 2018 Marius Schellenberger +// Copyright (C) 2022 Marius Schellenberger +//go:build !openbsd // +build !openbsd package godrop diff --git a/pledge_openbsd.go b/pledge_openbsd.go index 7369b03..0af656a 100644 --- a/pledge_openbsd.go +++ b/pledge_openbsd.go @@ -1,5 +1,6 @@ -// Copyright (C) 2018 Marius Schellenberger +// Copyright (C) 2022 Marius Schellenberger +//go:build openbsd // +build openbsd package godrop diff --git a/unveil.go b/unveil.go index 06c8c90..412851b 100644 --- a/unveil.go +++ b/unveil.go @@ -1,5 +1,6 @@ -// Copyright (C) 2018 Marius Schellenberger +// Copyright (C) 2022 Marius Schellenberger +//go:build !openbsd // +build !openbsd package godrop diff --git a/unveil_openbsd.go b/unveil_openbsd.go index f32d630..f1e4bbc 100644 --- a/unveil_openbsd.go +++ b/unveil_openbsd.go @@ -1,5 +1,6 @@ -// Copyright (C) 2018 Marius Schellenberger +// Copyright (C) 2022 Marius Schellenberger +//go:build openbsd // +build openbsd package godrop From b2f6d0d478f061ffb31effecfa38201a16527f3d Mon Sep 17 00:00:00 2001 From: ston1th Date: Mon, 19 Aug 2024 20:37:21 +0200 Subject: [PATCH 6/6] use latest sys --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 54387f6..c939651 100644 --- a/go.mod +++ b/go.mod @@ -2,4 +2,4 @@ module git.giftfish.de/ston1th/godrop/v2 go 1.19 -require golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 +require golang.org/x/sys v0.24.0 diff --git a/go.sum b/go.sum index e04231f..d88e7bd 100644 --- a/go.sum +++ b/go.sum @@ -1,2 +1,2 @@ -golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875 h1:AzgQNqF+FKwyQ5LbVrVqOcuuFB67N47F9+htZYH0wFM= -golang.org/x/sys v0.0.0-20221006211917-84dc82d7e875/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.24.0 h1:Twjiwq9dn6R1fQcyiK+wQyHWfaz/BJB+YIpzU/Cv3Xg= +golang.org/x/sys v0.24.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=