From mboxrd@z Thu Jan  1 00:00:00 1970
From: Stefan Schantl <stefan.schantl@ipfire.org>
To: development@lists.ipfire.org
Subject: [PATCH] update-ids-ruleset: Run as unprivileged user.
Date: Wed, 05 Jun 2019 18:27:10 +0200
Message-ID: <20190605162710.5130-1-stefan.schantl@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============0146784574551100573=="
List-Id: <development.lists.ipfire.org>

--===============0146784574551100573==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Check if the script has been launched as privileged user (root) and drop all
permissions by switching to the "nobody" user and group.

Signed-off-by: Stefan Schantl <stefan.schantl(a)ipfire.org>
---
 src/scripts/update-ids-ruleset | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/scripts/update-ids-ruleset b/src/scripts/update-ids-ruleset
index 956c3a1f5..dbe5b6849 100644
--- a/src/scripts/update-ids-ruleset
+++ b/src/scripts/update-ids-ruleset
@@ -20,11 +20,25 @@
 ############################################################################=
###
=20
 use strict;
+use POSIX;
=20
 require '/var/ipfire/general-functions.pl';
 require "${General::swroot}/ids-functions.pl";
 require "${General::swroot}/lang.pl";
=20
+# The user and group name as which this script should be run.
+my $run_as =3D 'nobody';
+
+# Get user and group id of the user.
+my ( $uid, $gid ) =3D ( getpwnam $run_as )[ 2, 3 ];
+
+# Check if the script currently runs as root.
+if ( $> =3D=3D 0 ) {
+	# Drop privileges and switch to the specified user and group.
+	POSIX::setgid( $gid );
+	POSIX::setuid( $uid );
+}
+
 # Check if the red device is active.
 unless (-e "${General::swroot}/red/active") {
 	# Store notice in the syslog.
--=20
2.20.1


--===============0146784574551100573==--