RepoMirrors/ceph
1
0
Fork 0
mirror of https://github.com/ceph/ceph synced 2025-02-16 07:17:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

rgw/beast: drop privileges after binding ports

Browse Source 
Fixes: http://tracker.ceph.com/issues/36041

Signed-off-by: Paul Emmerich <paul.emmerich@croit.io>
This commit is contained in:
Paul Emmerich 2018-09-25 14:25:55 +00:00
parent e01c738f1c
commit 6489566e86
2 changed files with 29 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/rgw/rgw_asio_frontend.cc
View File

@ -10,6 +10,7 @@
#include <boost/intrusive/list.hpp>
#include "common/async/shared_mutex.h"
#include "common/errno.h"
#include "rgw_asio_client.h"
#include "rgw_asio_frontend.h"
@ -293,6 +294,29 @@ tcp::endpoint parse_endpoint(boost::asio::string_view input,
return endpoint;
}
static int drop_privileges(CephContext *ctx)
{
uid_t uid = ctx->get_set_uid();
gid_t gid = ctx->get_set_gid();
std::string uid_string = ctx->get_set_uid_string();
std::string gid_string = ctx->get_set_gid_string();
if (gid && setgid(gid) != 0) {
int err = errno;
ldout(ctx, -1) << "unable to setgid " << gid << ": " << cpp_strerror(err) << dendl;
return -err;
}
if (uid && setuid(uid) != 0) {
int err = errno;
ldout(ctx, -1) << "unable to setuid " << uid << ": " << cpp_strerror(err) << dendl;
return -err;
}
if (uid && gid) {
ldout(ctx, 0) << "set uid:gid to " << uid << ":" << gid
<< " (" << uid_string << ":" << gid_string << ")" << dendl;
}
return 0;
}
int AsioFrontend::init()
{
boost::system::error_code ec;
@ -350,7 +374,7 @@ int AsioFrontend::init()
ldout(ctx(), 4) << "frontend listening on " << l.endpoint << dendl;
}
return 0;
return drop_privileges(ctx());
}
#ifdef WITH_RADOSGW_BEAST_OPENSSL

8
src/rgw/rgw_main.cc
View File

@ -206,16 +206,16 @@ int main(int argc, const char **argv)
for (list<string>::iterator iter = frontends.begin(); iter != frontends.end(); ++iter) {
string& f = *iter;
if (f.find("civetweb") != string::npos) {
// If civetweb is configured as a frontend, prevent global_init() from
if (f.find("civetweb") != string::npos || f.find("beast") != string::npos) {
// If civetweb or beast is configured as a frontend, prevent global_init() from
// dropping permissions by setting the appropriate flag.
flags |= CINIT_FLAG_DEFER_DROP_PRIVILEGES;
if (f.find("port") != string::npos) {
// check for the most common ws problems
if ((f.find("port=") == string::npos) ||
(f.find("port= ") != string::npos)) {
derr << "WARNING: civetweb frontend config found unexpected spacing around 'port' "
<< "(ensure civetweb port parameter has the form 'port=80' with no spaces "
derr << "WARNING: radosgw frontend config found unexpected spacing around 'port' "
<< "(ensure frontend port parameter has the form 'port=80' with no spaces "
<< "before or after '=')" << dendl;
}
}