diff --git a/README.md b/README.md index 149afa8..065ab40 100644 --- a/README.md +++ b/README.md @@ -7,6 +7,18 @@ $ make $ ./voidf ``` +## setuid/setgid support + +The application supports temporary privilege escalation via setuid/setgid bits. It uses the privilege only to scan `/dev/input/*` folder and open the selected input device. After that it lowers its privilege down to its real uid/gid and continues to function like a regular user application. + +### setuid example + +``` +# cp voidf /usr/local/bin +# chown root:root /usr/local/bin/voidf +# chmod 4755 /usr/local/bin/voidf +``` + ## References - https://github.com/freedesktop-unofficial-mirror/evtest/blob/b8343ec1124da18bdabcc04809a8731b9e39295d/evtest.c diff --git a/main.c b/main.c index 3020281..dedfcad 100644 --- a/main.c +++ b/main.c @@ -9,6 +9,7 @@ #include #include #include +#include #include @@ -216,6 +217,9 @@ void popups_new(const char *text) int main() { + uid_t ruid = getuid(); + gid_t rgid = getgid(); + const size_t devices_size = scan_devices(devices, DEVICES_CAPACITY); printf("Found %lu devices\n", devices_size); @@ -247,15 +251,18 @@ int main() printf("File path of the Device: %s\n", filename); - int fd = open(filename, O_RDONLY); + int fd = open(filename, O_RDONLY | O_NONBLOCK); if (fd < 0) { - fprintf(stderr, "ERROR: Could not open file %s\n", filename); + fprintf(stderr, "ERROR: Could not open file %s: %s\n", filename, strerror(errno)); exit(1); } - { - int flags = fcntl(fd, F_GETFL, 0); - fcntl(fd, F_SETFL, flags | O_NONBLOCK); + if (seteuid(ruid) < 0) { + fprintf(stderr, "WARNING: Could not set Effective UID to the real one: %s\n", strerror(errno)); + } + + if (setegid(rgid) < 0) { + fprintf(stderr, "WARNING: Could not set Effective GID to the real one: %s\n", strerror(errno)); } if (SDL_Init(SDL_INIT_VIDEO) < 0) {