diff options
| -rw-r--r-- | cmd/fpkg/main.go | 2 | ||||
| -rw-r--r-- | internal/app/init/main.go | 4 | ||||
| -rw-r--r-- | internal/app/shim/main.go | 2 | ||||
| -rw-r--r-- | internal/prctl.go | 13 | ||||
| -rw-r--r-- | main.go | 2 |
5 files changed, 14 insertions, 9 deletions
diff --git a/cmd/fpkg/main.go b/cmd/fpkg/main.go index 8075ba16..62ad7cd8 100644 --- a/cmd/fpkg/main.go +++ b/cmd/fpkg/main.go @@ -40,7 +40,7 @@ func main() { // early init argv0 check, skips root check and duplicate PR_SET_DUMPABLE init0.TryArgv0() - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Printf("cannot set SUID_DUMP_DISABLE: %s", err) // not fatal: this program runs as the privileged user } diff --git a/internal/app/init/main.go b/internal/app/init/main.go index bf9ecbae..33678c4e 100644 --- a/internal/app/init/main.go +++ b/internal/app/init/main.go @@ -28,7 +28,7 @@ func Main() { fmsg.Prepare("init") // setting this prevents ptrace - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err) } @@ -64,7 +64,7 @@ func Main() { } // die with parent - if err := internal.PR_SET_PDEATHSIG__SIGKILL(); err != nil { + if err := internal.SetPdeathsig(syscall.SIGKILL); err != nil { log.Fatalf("prctl(PR_SET_PDEATHSIG, SIGKILL): %v", err) } diff --git a/internal/app/shim/main.go b/internal/app/shim/main.go index 5e32a9fa..d1bd8198 100644 --- a/internal/app/shim/main.go +++ b/internal/app/shim/main.go @@ -29,7 +29,7 @@ func Main() { fmsg.Prepare("shim") // setting this prevents ptrace - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err) } diff --git a/internal/prctl.go b/internal/prctl.go index 857371b5..ae8392a6 100644 --- a/internal/prctl.go +++ b/internal/prctl.go @@ -2,17 +2,22 @@ package internal import "syscall" -func PR_SET_DUMPABLE__SUID_DUMP_DISABLE() error { +const ( + SUID_DUMP_DISABLE = iota + SUID_DUMP_USER +) + +func SetDumpable(dumpable uintptr) error { // linux/sched/coredump.h - if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, 0, 0); errno != 0 { + if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 { return errno } return nil } -func PR_SET_PDEATHSIG__SIGKILL() error { - if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0); errno != 0 { +func SetPdeathsig(sig syscall.Signal) error { + if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(sig), 0); errno != 0 { return errno } @@ -44,7 +44,7 @@ func main() { // early init argv0 check, skips root check and duplicate PR_SET_DUMPABLE init0.TryArgv0() - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Printf("cannot set SUID_DUMP_DISABLE: %s", err) // not fatal: this program runs as the privileged user } |