Changeset 34701 in vbox for trunk

Timestamp:

Dec 3, 2010 2:49:53 PM (14 years ago)

Author:

vboxsync

Message:

SUPR3HardenedMain: back out failed attempt to handle privilege updating for regular users, the attempt broke NAT ICMP in some cases

File:

• trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp (modified) (1 diff)

trunk/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp

@@ -649 +649 @@
 # elif defined(RT_OS_SOLARIS)
     /*
-     * Add net_icmpaccess privilege to permitted and effective privilege set
-     * before dropping root privileges. Leave inheritable privilege set
-     * untouched as we don't want to pass any additional privileges to
-     * subprocesses (think of VBoxSVC).
-     */
-    priv_set_t *pPrivSet = priv_allocset();
-    if (pPrivSet)
-    {
-        priv_emptyset(pPrivSet);
-        /* The inheritable privilege set contains the privileges the process
-         * would have received if it weren't marked as suid root. */
-        int rc = getppriv(PRIV_INHERITABLE, pPrivSet);
-        if (!rc)
+     * Add net_icmpaccess privilege to permitted, effective and inheritable
+     * privileges before dropping root privileges. Skip this hacky code for
+     * real root, as it removes lots of privileges due to the harcoded set.
+     */
+    if (getuid() != 0)
+    {
+        priv_set_t *pPrivSet = priv_str_to_set("basic", ",", NULL);
+        if (pPrivSet)
         {
             priv_addset(pPrivSet, PRIV_NET_ICMPACCESS);
-            rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
+            int rc = setppriv(PRIV_SET, PRIV_INHERITABLE, pPrivSet);
             if (!rc)
             {
-                rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
-                if (rc)
-                    supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
+                rc = setppriv(PRIV_SET, PRIV_PERMITTED, pPrivSet);
+                if (!rc)
+                {
+                    rc = setppriv(PRIV_SET, PRIV_EFFECTIVE, pPrivSet);
+                    if (rc)
+                        supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set effective privilege set.\n");
+                }
+                else
+                    supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
             }
             else
-                supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set permitted privilege set.\n");
+                supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to set inheritable privilege set.\n");
+
+            priv_freeset(pPrivSet);
         }
         else
-            supR3HardenedError(rc, false, "SUPR3HardenedMain: failed to get inheritable privilege set.\n");
-
-        priv_freeset(pPrivSet);
-    }
-    else
-        supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to allocate privilege set.\n");
+            supR3HardenedError(-1, false, "SUPR3HardenedMain: failed to get basic privilege set.\n");
+    }
 # endif
 }