| 423 | */ |
| 424 | |
| 425 | int |
| 426 | setusercontext(login_cap_t *lc, const struct passwd *pwd, uid_t uid, unsigned int flags) |
| 427 | { |
| 428 | rlim_t p; |
| 429 | mode_t mymask; |
| 430 | login_cap_t *llc = NULL; |
| 431 | struct rtprio rtp; |
| 432 | int error; |
| 433 | |
| 434 | if (lc == NULL) { |
| 435 | if (pwd != NULL && (lc = login_getpwclass(pwd)) != NULL) |
| 436 | llc = lc; /* free this when we're done */ |
| 437 | } |
| 438 | |
| 439 | if (flags & LOGIN_SETPATH) |
| 440 | pathvars[0].def = uid ? _PATH_DEFPATH : _PATH_STDPATH; |
| 441 | |
| 442 | /* we need a passwd entry to set these */ |
| 443 | if (pwd == NULL) |
| 444 | flags &= ~(LOGIN_SETGROUP | LOGIN_SETLOGIN | LOGIN_SETMAC); |
| 445 | |
| 446 | /* Set the process priority */ |
| 447 | if (flags & LOGIN_SETPRIORITY) { |
| 448 | p = login_getcapnum(lc, "priority", LOGIN_DEFPRI, LOGIN_DEFPRI); |
| 449 | |
| 450 | if (p > PRIO_MAX) { |
| 451 | rtp.type = RTP_PRIO_IDLE; |
| 452 | p -= PRIO_MAX + 1; |
| 453 | rtp.prio = p > RTP_PRIO_MAX ? RTP_PRIO_MAX : p; |
| 454 | if (rtprio(RTP_SET, 0, &rtp)) |
| 455 | syslog(LOG_WARNING, "rtprio '%s' (%s): %m", |
| 456 | pwd ? pwd->pw_name : "-", |
| 457 | lc ? lc->lc_class : LOGIN_DEFCLASS); |
| 458 | } else if (p < PRIO_MIN) { |
| 459 | rtp.type = RTP_PRIO_REALTIME; |
| 460 | p -= PRIO_MIN - RTP_PRIO_MAX; |
| 461 | rtp.prio = p < RTP_PRIO_MIN ? RTP_PRIO_MIN : p; |
| 462 | if (rtprio(RTP_SET, 0, &rtp)) |
| 463 | syslog(LOG_WARNING, "rtprio '%s' (%s): %m", |
| 464 | pwd ? pwd->pw_name : "-", |
| 465 | lc ? lc->lc_class : LOGIN_DEFCLASS); |
| 466 | } else { |
| 467 | if (setpriority(PRIO_PROCESS, 0, (int)p) != 0) |
| 468 | syslog(LOG_WARNING, "setpriority '%s' (%s): %m", |
| 469 | pwd ? pwd->pw_name : "-", |
| 470 | lc ? lc->lc_class : LOGIN_DEFCLASS); |
| 471 | } |
| 472 | } |
| 473 | |
| 474 | /* Setup the user's group permissions */ |
| 475 | if (flags & LOGIN_SETGROUP) { |
| 476 | if (setgid(pwd->pw_gid) != 0) { |
| 477 | syslog(LOG_ERR, "setgid(%lu): %m", (u_long)pwd->pw_gid); |
| 478 | login_close(llc); |
| 479 | return (-1); |
| 480 | } |
| 481 | if (initgroups(pwd->pw_name, pwd->pw_gid) == -1) { |
| 482 | syslog(LOG_ERR, "initgroups(%s,%lu): %m", pwd->pw_name, |
no test coverage detected