lib/priv-set.c

   1 /* Query, remove, or restore a Solaris privilege.
   2
   3    Copyright (C) 2009-2017 Free Software Foundation, Inc.
   4
   5    This program is free software: you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation; either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  17
  18    Written by David Bartley.  */
  19
  20 #include <config.h>
  21
  22 #define PRIV_SET_INLINE _GL_EXTERN_INLINE
  23
  24 #include "priv-set.h"
  25
  26 #if HAVE_GETPPRIV && HAVE_PRIV_H
  27
  28 # include <errno.h>
  29 # include <stdbool.h>
  30 # include <priv.h>
  31
  32 /* Holds a (cached) copy of the effective set.  */
  33 static priv_set_t *eff_set;
  34
  35 /* Holds a set of privileges that we have removed.  */
  36 static priv_set_t *rem_set;
  37
  38 static bool initialized;
  39
  40 static int
  41 priv_set_initialize (void)
  42 {
  43   if (! initialized)
  44     {
  45       eff_set = priv_allocset ();
  46       if (!eff_set)
  47         {
  48           return -1;
  49         }
  50       rem_set = priv_allocset ();
  51       if (!rem_set)
  52         {
  53           priv_freeset (eff_set);
  54           return -1;
  55         }
  56       if (getppriv (PRIV_EFFECTIVE, eff_set) != 0)
  57         {
  58           priv_freeset (eff_set);
  59           priv_freeset (rem_set);
  60           return -1;
  61         }
  62       priv_emptyset (rem_set);
  63       initialized = true;
  64     }
  65
  66   return 0;
  67 }
  68
  69
  70 /* Check if priv is in the effective set.
  71    Returns 1 if priv is a member and 0 if not.
  72    Returns -1 on error with errno set appropriately.  */
  73 int
  74 priv_set_ismember (const char *priv)
  75 {
  76   if (! initialized && priv_set_initialize () != 0)
  77     return -1;
  78
  79   return priv_ismember (eff_set, priv);
  80 }
  81
  82
  83 /* Try to remove priv from the effective set.
  84    Returns 0 if priv was removed.
  85    Returns -1 on error with errno set appropriately.  */
  86 int
  87 priv_set_remove (const char *priv)
  88 {
  89   if (! initialized && priv_set_initialize () != 0)
  90     return -1;
  91
  92   if (priv_ismember (eff_set, priv))
  93     {
  94       /* priv_addset/priv_delset can only fail if priv is invalid, which is
  95          checked above by the priv_ismember call.  */
  96       priv_delset (eff_set, priv);
  97       if (setppriv (PRIV_SET, PRIV_EFFECTIVE, eff_set) != 0)
  98         {
  99           priv_addset (eff_set, priv);
 100           return -1;
 101         }
 102       priv_addset (rem_set, priv);
 103     }
 104   else
 105     {
 106       errno = EINVAL;
 107       return -1;
 108     }
 109
 110   return 0;
 111 }
 112
 113
 114 /* Try to restore priv to the effective set.
 115    Returns 0 if priv was re-added to the effective set (after being previously
 116    removed by a call to priv_set_remove).
 117    Returns -1 on error with errno set appropriately.  */
 118 int
 119 priv_set_restore (const char *priv)
 120 {
 121   if (! initialized && priv_set_initialize () != 0)
 122     return -1;
 123
 124   if (priv_ismember (rem_set, priv))
 125     {
 126       /* priv_addset/priv_delset can only fail if priv is invalid, which is
 127          checked above by the priv_ismember call.  */
 128       priv_addset (eff_set, priv);
 129       if (setppriv (PRIV_SET, PRIV_EFFECTIVE, eff_set) != 0)
 130         {
 131           priv_delset (eff_set, priv);
 132           return -1;
 133         }
 134       priv_delset (rem_set, priv);
 135     }
 136   else
 137     {
 138       errno = EINVAL;
 139       return -1;
 140     }
 141
 142   return 0;
 143 }
 144
 145 #endif