|
 |
ea9e61 |
--- arpwatch-2.1a10/arpwatch.c Sat Oct 14 05:07:35 2000
|
|
|
ea9e61 |
+++ arpwatch-2.1a10/arpwatch.c Sun Jun 10 16:22:57 2001
|
|
|
ea9e61 |
@@ -62,7 +62,7 @@
|
|
|
ea9e61 |
#include <string.h>
|
|
|
ea9e61 |
#include <syslog.h>
|
|
|
ea9e61 |
#include <unistd.h>
|
|
|
ea9e61 |
-
|
|
|
ea9e61 |
+#include <pwd.h>
|
|
|
ea9e61 |
#include <pcap.h>
|
|
|
ea9e61 |
|
|
|
ea9e61 |
#include "gnuc.h"
|
|
|
ea9e61 |
@@ -141,6 +141,25 @@
|
|
|
ea9e61 |
int sanity_fddi(struct fddi_header *, struct ether_arp *, int);
|
|
|
ea9e61 |
__dead void usage(void) __attribute__((volatile));
|
|
|
ea9e61 |
|
|
|
ea9e61 |
+void dropprivileges(const char* user)
|
|
|
ea9e61 |
+{
|
|
|
ea9e61 |
+ struct passwd* pw;
|
|
|
ea9e61 |
+ pw = getpwnam( user );
|
|
|
ea9e61 |
+ if ( pw ) {
|
|
|
ea9e61 |
+ if ( initgroups(pw->pw_name, NULL) != 0 || setgid(pw->pw_gid) != 0 ||
|
|
|
ea9e61 |
+ setuid(pw->pw_uid) != 0 ) {
|
|
|
ea9e61 |
+ syslog(LOG_ERR, "Couldn't change to '%.32s' uid=%d gid=%d", user,
|
|
|
ea9e61 |
+ pw->pw_uid, pw->pw_gid);
|
|
|
ea9e61 |
+ exit(1);
|
|
|
ea9e61 |
+ }
|
|
|
ea9e61 |
+ }
|
|
|
ea9e61 |
+ else {
|
|
|
ea9e61 |
+ syslog(LOG_ERR, "Couldn't find user '%.32s' in /etc/passwd", user);
|
|
|
ea9e61 |
+ exit(1);
|
|
|
ea9e61 |
+ }
|
|
|
ea9e61 |
+ syslog(LOG_DEBUG, "Running as uid=%d gid=%d", getuid(), getgid());
|
|
|
ea9e61 |
+}
|
|
|
ea9e61 |
+
|
|
|
ea9e61 |
int
|
|
|
ea9e61 |
main(int argc, char **argv)
|
|
|
ea9e61 |
{
|
|
|
ea9e61 |
@@ -153,6 +172,7 @@
|
|
|
ea9e61 |
register char *interface, *rfilename;
|
|
|
ea9e61 |
struct bpf_program code;
|
|
|
ea9e61 |
char errbuf[PCAP_ERRBUF_SIZE];
|
|
|
ea9e61 |
+ char* serveruser = NULL;
|
|
|
ea9e61 |
|
|
|
ea9e61 |
if (argv[0] == NULL)
|
|
|
ea9e61 |
prog = "arpwatch";
|
|
|
ea9e61 |
@@ -170,7 +190,7 @@
|
|
|
ea9e61 |
interface = NULL;
|
|
|
ea9e61 |
rfilename = NULL;
|
|
|
ea9e61 |
pd = NULL;
|
|
|
ea9e61 |
- while ((op = getopt(argc, argv, "df:i:n:Nr:")) != EOF)
|
|
|
ea9e61 |
+ while ((op = getopt(argc, argv, "df:i:n:Nr:u:")) != EOF)
|
|
|
ea9e61 |
switch (op) {
|
|
|
ea9e61 |
|
|
|
ea9e61 |
case 'd':
|
|
|
ea9e61 |
@@ -202,6 +222,16 @@
|
|
|
ea9e61 |
rfilename = optarg;
|
|
|
ea9e61 |
break;
|
|
|
ea9e61 |
|
|
|
ea9e61 |
+ case 'u':
|
|
|
ea9e61 |
+ if ( optarg ) {
|
|
|
ea9e61 |
+ serveruser = strdup(optarg);
|
|
|
ea9e61 |
+ }
|
|
|
ea9e61 |
+ else {
|
|
|
ea9e61 |
+ fprintf(stderr, "%s: Need username after -u\n", prog);
|
|
|
ea9e61 |
+ usage();
|
|
|
ea9e61 |
+ }
|
|
|
ea9e61 |
+ break;
|
|
|
ea9e61 |
+
|
|
|
ea9e61 |
default:
|
|
|
ea9e61 |
usage();
|
|
|
ea9e61 |
}
|
|
|
ea9e61 |
@@ -283,8 +313,11 @@
|
|
|
ea9e61 |
* Revert to non-privileged user after opening sockets
|
|
|
ea9e61 |
* (not needed on most systems).
|
|
|
ea9e61 |
*/
|
|
|
ea9e61 |
- setgid(getgid());
|
|
|
ea9e61 |
- setuid(getuid());
|
|
|
ea9e61 |
+ /*setgid(getgid());*/
|
|
|
ea9e61 |
+ /*setuid(getuid());*/
|
|
|
ea9e61 |
+ if ( serveruser ) {
|
|
|
ea9e61 |
+ dropprivileges( serveruser );
|
|
|
ea9e61 |
+ }
|
|
|
ea9e61 |
|
|
|
ea9e61 |
/* Must be ethernet or fddi */
|
|
|
ea9e61 |
linktype = pcap_datalink(pd);
|
|
|
ea9e61 |
@@ -751,6 +784,6 @@
|
|
|
ea9e61 |
|
|
|
ea9e61 |
(void)fprintf(stderr, "Version %s\n", version);
|
|
|
ea9e61 |
(void)fprintf(stderr, "usage: %s [-dN] [-f datafile] [-i interface]"
|
|
|
ea9e61 |
- " [-n net[/width]] [-r file]\n", prog);
|
|
|
ea9e61 |
+ " [-n net[/width]] [-r file] [-u username]\n", prog);
|
|
|
ea9e61 |
exit(1);
|
|
|
ea9e61 |
}
|