diff options
author | Lennart Poettering <lennart@poettering.net> | 2004-09-23 22:42:49 +0000 |
---|---|---|
committer | Lennart Poettering <lennart@poettering.net> | 2004-09-23 22:42:49 +0000 |
commit | ed36241085da8f797adf7d70ab702fee10e8cba0 (patch) | |
tree | 9380bc0993a72ba998e51d62b6e08033cb462fc2 /polyp/caps.c | |
parent | 8176b3a1ba5020e0639f648a7f41f79f54cbcac2 (diff) |
allow high priority scheduling only for users in group "realtime"
git-svn-id: file:///home/lennart/svn/public/pulseaudio/trunk@238 fefdeb5f-60dc-0310-8127-8f9354f1896f
Diffstat (limited to 'polyp/caps.c')
-rw-r--r-- | polyp/caps.c | 26 |
1 files changed, 16 insertions, 10 deletions
diff --git a/polyp/caps.c b/polyp/caps.c index db00c604..258e13e4 100644 --- a/polyp/caps.c +++ b/polyp/caps.c @@ -36,14 +36,19 @@ #include "caps.h" void pa_drop_root(void) { - if (getuid() != 0 && geteuid() == 0) { - pa_log(__FILE__": Started SUID root, dropping root rights.\n"); - setuid(getuid()); - seteuid(getuid()); - } + uid_t uid = getuid(); + + if (uid == 0 || geteuid() != 0) + return; + + pa_log(__FILE__": dropping root rights.\n"); + + setuid(uid); + seteuid(uid); } #ifdef HAVE_SYS_CAPABILITY_H + int pa_limit_caps(void) { int r = -1; cap_t caps; @@ -53,14 +58,15 @@ int pa_limit_caps(void) { assert(caps); cap_clear(caps); + cap_set_flag(caps, CAP_EFFECTIVE, 1, &nice_cap, CAP_SET); cap_set_flag(caps, CAP_PERMITTED, 1, &nice_cap, CAP_SET); if (cap_set_proc(caps) < 0) goto fail; - pa_log(__FILE__": Started SUID root, capabilities limited.\n"); - + pa_log(__FILE__": dropped capabilities successfully.\n"); + r = 0; fail: @@ -78,10 +84,10 @@ int pa_drop_caps(void) { cap_clear(caps); - if (cap_set_proc(caps) < 0) + if (cap_set_proc(caps) < 0) { + pa_log(__FILE__": failed to drop capabilities: %s\n", strerror(errno)); goto fail; - - pa_drop_root(); + } r = 0; |