Changeset 34364 in vbox for trunk/src/VBox/HostDrivers/Support

Timestamp:

Nov 25, 2010 1:35:13 PM (14 years ago)

Author:

vboxsync

Message:

SUPR3HardenedMain: on Solaris don't touch the privilege set for the real root user

File:

• trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp

@@ -649 +649 @@
 # elif defined(RT_OS_SOLARIS)
     /*
-     * Add net_icmpaccess privilege to permitted, effective and inheritable privileges
-     * before dropping root privileges.
-     */
-    priv_set_t *pPrivSet = priv_str_to_set("basic", ",", NULL);
-    if (pPrivSet)
-    {
-        priv_addset(pPrivSet, PRIV_NET_ICMPACCESS);
-        int rc = setppriv(PRIV_SET, PRIV_INHERITABLE, pPrivSet);
-        if (!rc)
+     * Add net_icmpaccess privilege to permitted, effective and inheritable
+     * privileges before dropping root privileges. Skip this hacky code for
+     * real root, as it removes lots of privileges due to the harcoded set.
+     */
+    if (getuid() != 0)
+    {
+        priv_set_t *pPrivSet = priv_str_to_set("basic", ",", NULL);
+        if (pPrivSet)
         {
-            rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
+            priv_addset(pPrivSet, PRIV_NET_ICMPACCESS);
+            int rc = setppriv(PRIV_SET, PRIV_INHERITABLE, pPrivSet);
             if (!rc)
             {
-                rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
-                if (rc)
-                    supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
+                rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
+                if (!rc)
+                {
+                    rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
+                    if (rc)
+                        supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
+                }
+                else
+                    supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
             }
             else
-                supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
+                supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set inheritable privilege set.\n");
+
+            priv_freeset(pPrivSet);
         }
         else
-            supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set inheritable privilege set.\n");
-
-        priv_freeset(pPrivSet);
-    }
-    else
-        supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to get basic privilege set.\n");
-
+            supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to get basic privilege set.\n");
+    }
 # endif
 }