4 This file is part of PulseAudio.
6 Copyright 2004-2006 Lennart Poettering
7 Copyright 2006 Pierre Ossman <ossman@cendio.se> for Cendio AB
9 PulseAudio is free software; you can redistribute it and/or modify
10 it under the terms of the GNU Lesser General Public License as published
11 by the Free Software Foundation; either version 2 of the License,
12 or (at your option) any later version.
14 PulseAudio is distributed in the hope that it will be useful, but
15 WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 General Public License for more details.
19 You should have received a copy of the GNU Lesser General Public License
20 along with PulseAudio; if not, write to the Free Software
21 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307
33 #include <sys/types.h>
35 #ifdef HAVE_SYS_CAPABILITY_H
36 #include <sys/capability.h>
39 #include <pulsecore/core-error.h>
41 #include <pulsecore/log.h>
45 /* Glibc <= 2.2 has broken unistd.h */
46 #if defined(linux) && (__GLIBC__ <= 2 && __GLIBC_MINOR__ <= 2)
47 int setresgid(gid_t r, gid_t e, gid_t s);
48 int setresuid(uid_t r, uid_t e, uid_t s);
53 /* Drop root rights when called SUID root */
54 void pa_drop_root(void) {
57 if (uid == 0 || geteuid() != 0)
60 pa_log_info("dropping root rights.");
62 #if defined(HAVE_SETRESUID)
63 setresuid(uid, uid, uid);
64 #elif defined(HAVE_SETREUID)
74 void pa_drop_root(void) {
79 #ifdef HAVE_SYS_CAPABILITY_H
81 /* Limit capabilities set to CAPSYS_NICE */
82 int pa_limit_caps(void) {
85 cap_value_t nice_cap = CAP_SYS_NICE;
87 /* Only drop caps when called SUID */
96 cap_set_flag(caps, CAP_EFFECTIVE, 1, &nice_cap, CAP_SET);
97 cap_set_flag(caps, CAP_PERMITTED, 1, &nice_cap, CAP_SET);
99 if (cap_set_proc(caps) < 0)
102 pa_log_info("dropped capabilities successfully.");
112 /* Drop all capabilities, effectively becoming a normal user */
113 int pa_drop_caps(void) {
117 /* Only drop caps when called SUID */
126 if (cap_set_proc(caps) < 0) {
127 pa_log("failed to drop capabilities: %s", pa_cstrerror(errno));
141 /* NOOPs in case capabilities are not available. */
142 int pa_limit_caps(void) {
146 int pa_drop_caps(void) {