Changeset 34445 in vbox for trunk/src/VBox/HostDrivers/Support

Timestamp:

Nov 29, 2010 10:09:02 AM (14 years ago)

Author:

vboxsync

Message:

SUPR3HardenedMain: attempt to properly fix the updating of privileges on Solaris

File:

• trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp

@@ -649 +649 @@
 # elif defined(RT_OS_SOLARIS)
     /*
-     * Add net_icmpaccess privilege to permitted, effective and inheritable
-     * privileges before dropping root privileges. Skip this hacky code for
-     * real root, as it removes lots of privileges due to the harcoded set.
-     */
-    if (getuid() != 0)
-    {
-        priv_set_t *pPrivSet = priv_str_to_set("basic", ",", NULL);
-        if (pPrivSet)
+     * Add net_icmpaccess privilege to permitted and effective privilege set
+     * before dropping root privileges. Leave inheritable privilege set
+     * untouched as we don't want to pass any additional privileges to
+     * subprocesses (think of VBoxSVC).
+     */
+    priv_set_t *pPrivSet = priv_allocset();
+    if (pPrivSet)
+    {
+        priv_emptyset(pPrivSet);
+        /* The inheritable privilege set contains the privileges the process
+         * would have received if it weren't marked as suid root. */
+        int rc = getppriv(PRIV_SET, PRIV_INHERITABLE, pPrivSet);
+        if (!rc)
         {
             priv_addset(pPrivSet, PRIV_NET_ICMPACCESS);
-            int rc = setppriv(PRIV_SET, PRIV_INHERITABLE, pPrivSet);
+            rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
             if (!rc)
             {
-                rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
-                if (!rc)
-                {
-                    rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
-                    if (rc)
-                        supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
-                }
-                else
-                    supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
+                rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
+                if (rc)
+                    supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
             }
             else
-                supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set inheritable privilege set.\n");
-
-            priv_freeset(pPrivSet);
+                supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
         }
         else
-            supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to get basic privilege set.\n");
-    }
+            supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to get inheritable privilege set.\n");
+
+        priv_freeset(pPrivSet);
+    }
+    else
+        supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to allocate privilege set.\n");
 # endif
 }