lib/priv-set.c

   1 /* Query, remove, or restore a Solaris privilege.
   2
   3    Copyright (C) 2009-2024 Free Software Foundation, Inc.
   4
   5    This program is free software: you can redistribute it and/or modify
   6    it under the terms of the GNU General Public License as published by
   7    the Free Software Foundation, either version 3 of the License, or
   8    (at your option) any later version.
   9
  10    This program is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13    GNU General Public License for more details.
  14
  15    You should have received a copy of the GNU General Public License
  16    along with this program.  If not, see <https://www.gnu.org/licenses/>.
  17
  18    Written by David Bartley.  */
  19
  20 #include <config.h>
  21
  22 #define PRIV_SET_INLINE _GL_EXTERN_INLINE
  23
  24 #include "priv-set.h"
  25
  26 #if HAVE_GETPPRIV && HAVE_PRIV_H
  27
  28 # include <errno.h>
  29 # include <priv.h>
  30
  31 /* Holds a (cached) copy of the effective set.  */
  32 static priv_set_t *eff_set;
  33
  34 /* Holds a set of privileges that we have removed.  */
  35 static priv_set_t *rem_set;
  36
  37 static bool initialized;
  38
  39 static int
  40 priv_set_initialize (void)
  41 {
  42   if (! initialized)
  43     {
  44       eff_set = priv_allocset ();
  45       if (!eff_set)
  46         {
  47           return -1;
  48         }
  49       rem_set = priv_allocset ();
  50       if (!rem_set)
  51         {
  52           priv_freeset (eff_set);
  53           return -1;
  54         }
  55       if (getppriv (PRIV_EFFECTIVE, eff_set) != 0)
  56         {
  57           priv_freeset (eff_set);
  58           priv_freeset (rem_set);
  59           return -1;
  60         }
  61       priv_emptyset (rem_set);
  62       initialized = true;
  63     }
  64
  65   return 0;
  66 }
  67
  68
  69 /* Check if priv is in the effective set.
  70    Returns 1 if priv is a member and 0 if not.
  71    Returns -1 on error with errno set appropriately.  */
  72 int
  73 priv_set_ismember (const char *priv)
  74 {
  75   if (! initialized && priv_set_initialize () != 0)
  76     return -1;
  77
  78   return priv_ismember (eff_set, priv);
  79 }
  80
  81
  82 /* Try to remove priv from the effective set.
  83    Returns 0 if priv was removed.
  84    Returns -1 on error with errno set appropriately.  */
  85 int
  86 priv_set_remove (const char *priv)
  87 {
  88   if (! initialized && priv_set_initialize () != 0)
  89     return -1;
  90
  91   if (priv_ismember (eff_set, priv))
  92     {
  93       /* priv_addset/priv_delset can only fail if priv is invalid, which is
  94          checked above by the priv_ismember call.  */
  95       priv_delset (eff_set, priv);
  96       if (setppriv (PRIV_SET, PRIV_EFFECTIVE, eff_set) != 0)
  97         {
  98           priv_addset (eff_set, priv);
  99           return -1;
 100         }
 101       priv_addset (rem_set, priv);
 102     }
 103   else
 104     {
 105       errno = EINVAL;
 106       return -1;
 107     }
 108
 109   return 0;
 110 }
 111
 112
 113 /* Try to restore priv to the effective set.
 114    Returns 0 if priv was re-added to the effective set (after being previously
 115    removed by a call to priv_set_remove).
 116    Returns -1 on error with errno set appropriately.  */
 117 int
 118 priv_set_restore (const char *priv)
 119 {
 120   if (! initialized && priv_set_initialize () != 0)
 121     return -1;
 122
 123   if (priv_ismember (rem_set, priv))
 124     {
 125       /* priv_addset/priv_delset can only fail if priv is invalid, which is
 126          checked above by the priv_ismember call.  */
 127       priv_addset (eff_set, priv);
 128       if (setppriv (PRIV_SET, PRIV_EFFECTIVE, eff_set) != 0)
 129         {
 130           priv_delset (eff_set, priv);
 131           return -1;
 132         }
 133       priv_delset (rem_set, priv);
 134     }
 135   else
 136     {
 137       errno = EINVAL;
 138       return -1;
 139     }
 140
 141   return 0;
 142 }
 143
 144 #endif