about summary refs log tree commit diff
path: root/src/libutil/util.cc
diff options
context:
space:
mode:
authorGraham Christensen <graham@grahamc.com>2019-05-11T20·35-0400
committerGraham Christensen <graham@grahamc.com>2019-05-12T17·17-0400
commitb4a05edbfe49f87555fd284dfb0d6c56ed43217d (patch)
tree447fd9d1be15f15f1cb0c8020b63b95acb74933b /src/libutil/util.cc
parentdde8eeb39ae9fb73011462c74e5fa6405e432147 (diff)
runProgram: support gid, uid, chdir
Diffstat (limited to 'src/libutil/util.cc')
-rw-r--r--src/libutil/util.cc15
1 files changed, 13 insertions, 2 deletions
diff --git a/src/libutil/util.cc b/src/libutil/util.cc
index 0f4d3d92b866..55b9144f314e 100644
--- a/src/libutil/util.cc
+++ b/src/libutil/util.cc
@@ -16,6 +16,7 @@
 #include <future>
 
 #include <fcntl.h>
+#include <grp.h>
 #include <limits.h>
 #include <pwd.h>
 #include <sys/ioctl.h>
@@ -914,8 +915,8 @@ void killUser(uid_t uid)
 
 /* Wrapper around vfork to prevent the child process from clobbering
    the caller's stack frame in the parent. */
-pid_t doFork(bool allowVfork, std::function<void()> fun) __attribute__((noinline));
-pid_t doFork(bool allowVfork, std::function<void()> fun)
+static pid_t doFork(bool allowVfork, std::function<void()> fun) __attribute__((noinline));
+static pid_t doFork(bool allowVfork, std::function<void()> fun)
 {
 #ifdef __linux__
     pid_t pid = allowVfork ? vfork() : fork();
@@ -1025,6 +1026,16 @@ void runProgram2(const RunOptions & options)
         if (source && dup2(in.readSide.get(), STDIN_FILENO) == -1)
             throw SysError("dupping stdin");
 
+        //if (options.chdir && chdir((*options.chdir).c_str()) == -1)
+        //    throw SysError("chdir failed");
+        if (options.gid && setgid(*options.gid) == -1)
+            throw SysError("setgid failed");
+        /* Drop all other groups if we're setgid. */
+        if (options.gid && setgroups(0, 0) == -1)
+            throw SysError("setgroups failed");
+        if (options.uid && setuid(*options.uid) == -1)
+            throw SysError("setuid failed");
+
         Strings args_(options.args);
         args_.push_front(options.program);