From 94c4ac621f23e55b42f10d4cba920f2c7580005e Mon Sep 17 00:00:00 2001 From: Kaz Kylheku Date: Mon, 2 May 2016 21:09:19 -0700 Subject: Implement setgid script support. TXR now notices that it's running setgid, and implements setgid logic for scripts. * sysif.c (orig_egid, real_gid, is_setgid): New static variables. (repress_privilege): Treat real and effective group ID similarly to user ID. Save them in global variables, and set the is_setgid flag. (drop_privilege): Drop setgid privilege similarly to setuid. Operate selectively: if neither setuid nor setgid is in effect, do nothing, but if just one is in effect, don't do anything for the other. (simulate_setuid): Function renamed to simulate_setuid_setgid. A small change is made here: if the fstat fails, just drop privilege, don't abort. Implement setgid operation independently of setuid. The is_setgid and is_setuid flags are manipulated here now to get the drop_privileges function to selectively drop setuid if we are running a script which is only segid, or drop setgid if we are running a setuid only script. * sysif.h (simulate_setuid): Declaration name change to simulate_setuid_setgid. * txr.c (txr_main): Follow rename of simulate_setuid. * txr.1: SETUID OPERATION section changed to SETUID/SETGID operation, and setgid description worked into the text. --- txr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'txr.c') diff --git a/txr.c b/txr.c index def35cc9..15d10168 100644 --- a/txr.c +++ b/txr.c @@ -789,7 +789,7 @@ int txr_main(int argc, char **argv) } else if (spec_file) { if (wcscmp(c_str(spec_file), L"-") != 0) { open_txr_file(spec_file, &txr_lisp_p, &spec_file_str, &parse_stream); - simulate_setuid(parse_stream); + simulate_setuid_setgid(parse_stream); } else { drop_privilege(); spec_file_str = lit("stdin"); @@ -814,7 +814,7 @@ int txr_main(int argc, char **argv) if (!equal(arg, lit("-"))) { open_txr_file(arg, &txr_lisp_p, &spec_file_str, &parse_stream); - simulate_setuid(parse_stream); + simulate_setuid_setgid(parse_stream); } else { drop_privilege(); spec_file_str = lit("stdin"); -- cgit v1.2.3