--- arpwatch.c 2005-10-06 13:27:16.000000000 +0200 +++ arpwatch.c.oden 2005-10-06 13:26:39.000000000 +0200 @@ -62,6 +62,7 @@ #include <string.h> #include <syslog.h> #include <unistd.h> +#include <pwd.h> #include <pcap.h> @@ -141,6 +142,25 @@ int sanity_fddi(struct fddi_header *, struct ether_arp *, int); __dead void usage(void) __attribute__((volatile)); +void dropprivileges(const char* user) +{ + struct passwd* pw; + pw = getpwnam( user ); + if ( pw ) { + if ( initgroups(pw->pw_name, NULL) != 0 || setgid(pw->pw_gid) != 0 || + setuid(pw->pw_uid) != 0 ) { + syslog(LOG_ERR, "Couldn't change to '%.32s' uid=%d gid=%d", user, + pw->pw_uid, pw->pw_gid); + exit(1); + } + } + else { + syslog(LOG_ERR, "Couldn't find user '%.32s' in /etc/passwd", user); + exit(1); + } + syslog(LOG_DEBUG, "Running as uid=%d gid=%d", getuid(), getgid()); +} + int main(int argc, char **argv) { @@ -153,6 +173,7 @@ register char *interface, *rfilename; struct bpf_program code; char errbuf[PCAP_ERRBUF_SIZE]; + char* serveruser = NULL; if (argv[0] == NULL) prog = "arpwatch"; @@ -170,7 +191,7 @@ interface = NULL; rfilename = NULL; pd = NULL; - while ((op = getopt(argc, argv, "df:i:n:wNr:")) != EOF) + while ((op = getopt(argc, argv, "df:i:n:wNr:u:")) != EOF) switch (op) { case 'd': @@ -206,6 +227,16 @@ rfilename = optarg; break; + case 'u': + if ( optarg ) { + serveruser = strdup(optarg); + } + else { + fprintf(stderr, "%s: Need username after -u\n", prog); + usage(); + } + break; + default: usage(); } @@ -294,8 +325,11 @@ * Revert to non-privileged user after opening sockets * (not needed on most systems). */ - setgid(getgid()); - setuid(getuid()); + /*setgid(getgid());*/ + /*setuid(getuid());*/ + if ( serveruser ) { + dropprivileges( serveruser ); + } /* Must be ethernet or fddi */ linktype = pcap_datalink(pd); @@ -762,6 +796,6 @@ (void)fprintf(stderr, "Version %s\n", version); (void)fprintf(stderr, "usage: %s [-dNw] [-f datafile] [-i interface]" - " [-n net[/width]] [-r file]\n", prog); + " [-n net[/width]] [-r file] [-u username]\n", prog); exit(1); }