drop_uid / drop_gid support

RamseyK · RamseyK · commit f5cfdcf1dd6a · 2019-09-08T18:42:56.000-05:00
diff --git a/bin/server.config b/bin/server.config
@@ -1,4 +1,9 @@
-# Default vhost
+# Hosts to respond to (localhost/127.0.0.1 implied)
 vhost=10.0.10.86,acme.local
 port=8080
 diskpath=./htdocs
+
+# Optional - uid/gid to "drop" to with setuid/setgid after bind() so the program doesn't have to run as root
+# Default 0 because dropping to root makes no sense
+drop_uid=0
+drop_gid=0
diff --git a/src/HTTPServer.cpp b/src/HTTPServer.cpp
@@ -25,14 +25,19 @@
  * @param vhost_aliases List of hostnames the HTTP server will respond to
  * @param port Port the vhost listens on
  * @param diskpath Path to the folder the vhost serves up
+ * @param drop_uid UID to setuid to after bind().  Ignored if 0
+ * @param drop_gid GID to setgid to after bind().  Ignored if 0
  */
-HTTPServer::HTTPServer(std::vector<std::string> vhost_aliases, int port, std::string diskpath) {
+HTTPServer::HTTPServer(std::vector<std::string> vhost_aliases, int port, std::string diskpath, int drop_uid, int drop_gid) {
 	canRun = false;
 	listenSocket = INVALID_SOCKET;
 	listenPort = port;
 	kqfd = -1;
+	dropUid = drop_uid;
+	dropGid = drop_gid;
 
-	std::cout << "Primary port: " << port << ", disk path: " << diskpath.c_str() << std::endl;
+	std::cout << "Port: " << port << std::endl;
+	std::cout << "Disk path: " << diskpath.c_str() << std::endl;
 
 	// Create a resource host serving the base path ./htdocs on disk
 	ResourceHost* resHost = new ResourceHost(diskpath);
@@ -104,6 +109,21 @@ bool HTTPServer::start() {
 		return false;
 	}
 
+	// Optionally drop uid/gid if specified
+	if (dropUid != 0 && dropGid != 0) {
+		if (setgid(dropGid) == -1) {
+			std::cout << "setgid to " << dropGid << " failed!" << std::endl;
+			return false;
+		}
+		
+		if (setuid(dropUid) == -1) {
+			std::cout << "setuid to " << dropUid << " failed!" << std::endl;
+			return false;
+		}
+
+		std::cout << "Successfully dropped uid to " << dropUid << " and gid to " << dropGid << std::endl;
+	}
+
 	// Listen: Put the socket in a listening state, ready to accept connections
 	// Accept a backlog of the OS Maximum connections in the queue
 	if (listen(listenSocket, SOMAXCONN) != 0) {
diff --git a/src/HTTPServer.h b/src/HTTPServer.h
@@ -51,6 +51,8 @@ class HTTPServer {
 	int listenPort;
 	int listenSocket; // Descriptor for the listening socket
 	struct sockaddr_in serverAddr; // Structure for the server address
+	int dropUid; // setuid to this after bind()
+	int dropGid; // setgid to this after bind()
 
 	// Kqueue
 	struct timespec kqTimeout = {2, 0}; // Block for 2 seconds and 0ns at the most
@@ -86,7 +88,7 @@ class HTTPServer {
 	bool canRun;
 
 public:
-	HTTPServer(std::vector<std::string> vhost_aliases, int port, std::string diskpath);
+	HTTPServer(std::vector<std::string> vhost_aliases, int port, std::string diskpath, int drop_uid=0, int drop_gid=0);
 	~HTTPServer();
 
 	bool start();
diff --git a/src/main.cpp b/src/main.cpp
@@ -43,7 +43,8 @@ int main (int argc, const char * argv[])
 	std::map<std::string, std::string> config;
 	std::fstream cfile;
 	std::string line, key, val;
-	int epos;
+	int epos = 0;
+	int drop_uid = 0, drop_gid = 0;
 	cfile.open("server.config");
 	if (!cfile.is_open()) {
 		std::cout << "Unable to open server.config file in working directory" << std::endl;
@@ -83,6 +84,17 @@ int main (int argc, const char * argv[])
 		vhost_alias_str.erase(0, pos + delimiter.length());
 	} while (pos != std::string::npos);
 
+	// Check for optional drop_uid, drop_gid.  Ensure both are set
+	if (config.find("drop_uid") != config.end() && config.find("drop_gid") != config.end()) {
+		drop_uid = atoi(config["drop_uid"].c_str());
+		drop_gid = atoi(config["drop_gid"].c_str());
+
+		if (drop_uid == 0 || drop_gid == 0) {
+			// Both must be set, otherwise set back to 0 so we dont use
+			drop_uid = drop_gid = 0;
+		}
+	}
+
 	// Ignore SIGPIPE "Broken pipe" signals when socket connections are broken.
 	signal(SIGPIPE, handleSigPipe);
 
@@ -92,7 +104,7 @@ int main (int argc, const char * argv[])
 	signal(SIGTERM, &handleTermSig);
 
 	// Instance and start the server
-	svr = new HTTPServer(vhosts, atoi(config["port"].c_str()), config["diskpath"]);
+	svr = new HTTPServer(vhosts, atoi(config["port"].c_str()), config["diskpath"], drop_uid, drop_gid);
 	if (!svr->start()) {
 		svr->stop();
 		delete svr;
