summaryrefslogtreecommitdiff
path: root/lib/privs.h
blob: 46d614e0087b0f393d29a1e9b316232a0041ac03 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
/* 
 * Zebra privileges header.
 *
 * Copyright (C) 2003 Paul Jakma.
 *
 * This file is part of GNU Zebra.
 *
 * GNU Zebra is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License as published by the
 * Free Software Foundation; either version 2, or (at your option) any
 * later version.
 *
 * GNU Zebra is distributed in the hope that it will be useful, but
 * WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with GNU Zebra; see the file COPYING.  If not, write to the Free
 * Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
 * 02111-1307, USA.  
 */

#ifndef _ZEBRA_PRIVS_H
#define _ZEBRA_PRIVS_H

/* list of zebra capabilities */
typedef enum 
{
  ZCAP_SETID,
  ZCAP_BIND,
  ZCAP_NET_ADMIN,
  ZCAP_SYS_ADMIN,
  ZCAP_NET_RAW,
  ZCAP_CHROOT,
  ZCAP_NICE,
  ZCAP_PTRACE,
  ZCAP_DAC_OVERRIDE,
  ZCAP_READ_SEARCH,
  ZCAP_FOWNER,
  ZCAP_MAX
} zebra_capabilities_t;

typedef enum
{
  ZPRIVS_LOWERED,
  ZPRIVS_RAISED,
  ZPRIVS_UNKNOWN,
} zebra_privs_current_t;

typedef enum
{
  ZPRIVS_RAISE,
  ZPRIVS_LOWER,
} zebra_privs_ops_t;

struct zebra_privs_t
{
  zebra_capabilities_t *caps_p;       /* caps required for operation */
  zebra_capabilities_t *caps_i;       /* caps to allow inheritance of */
  int cap_num_p;                      /* number of caps in arrays */
  int cap_num_i;                    
  const char *user;                   /* user and group to run as */
  const char *group;
  const char *vty_group;              /* group to chown vty socket to */
  /* methods */
  int 
    (*change) (zebra_privs_ops_t);    /* change privileges, 0 on success */
  zebra_privs_current_t 
    (*current_state) (void);          /* current privilege state */
};

struct zprivs_ids_t
{
  /* -1 is undefined */
  uid_t uid_priv;                     /* privileged uid */
  uid_t uid_normal;                   /* normal uid */
  gid_t gid_priv;                     /* privileged uid */
  gid_t gid_normal;                   /* normal uid */
  gid_t gid_vty;                      /* vty gid */
};

  /* initialise zebra privileges */
extern void zprivs_init (struct zebra_privs_t *zprivs);
  /* drop all and terminate privileges */ 
extern void zprivs_terminate (struct zebra_privs_t *);
  /* query for runtime uid's and gid's, eg vty needs this */
extern void zprivs_get_ids(struct zprivs_ids_t *);

#endif /* _ZEBRA_PRIVS_H */