411daeaa53
The setuid/setgid syscalls requires root capabilities but if the kernel supports unprivileged user namespace then the child process has the full set of capabilities in the new namespace, then we can allow setting "user" and "group" in such cases (this is a common security use case). Tests were added to ensure user gets meaningful error messages for uid/gid mapping misconfigurations.
31 lines
690 B
C
31 lines
690 B
C
/*
|
|
* Copyright (C) Igor Sysoev
|
|
* Copyright (C) NGINX, Inc.
|
|
*/
|
|
|
|
#ifndef _NXT_CREDENTIAL_H_INCLUDED_
|
|
#define _NXT_CREDENTIAL_H_INCLUDED_
|
|
|
|
|
|
typedef uid_t nxt_uid_t;
|
|
typedef gid_t nxt_gid_t;
|
|
|
|
typedef struct {
|
|
const char *user;
|
|
nxt_uid_t uid;
|
|
nxt_gid_t base_gid;
|
|
nxt_uint_t ngroups;
|
|
nxt_gid_t *gids;
|
|
} nxt_credential_t;
|
|
|
|
|
|
NXT_EXPORT nxt_int_t nxt_credential_get(nxt_task_t *task, nxt_mp_t *mp,
|
|
nxt_credential_t *uc, const char *group);
|
|
NXT_EXPORT nxt_int_t nxt_credential_setuid(nxt_task_t *task,
|
|
nxt_credential_t *uc);
|
|
NXT_EXPORT nxt_int_t nxt_credential_setgids(nxt_task_t *task,
|
|
nxt_credential_t *uc);
|
|
|
|
|
|
#endif /* _NXT_CREDENTIAL_H_INCLUDED_ */
|