| 444 | } |
| 445 | |
| 446 | void |
| 447 | IPCSocketServer::late_check_peer_credentials(int peedFd, TSRPCHandlerOptions const &options, swoc::Errata &errata) const |
| 448 | { |
| 449 | // For privileged calls, ensure we have caller credentials and that the caller is privileged. |
| 450 | auto ecode = [](UnauthorizedErrorCode c) -> std::error_code { |
| 451 | return std::error_code(static_cast<unsigned>(c), std::generic_category()); |
| 452 | }; |
| 453 | |
| 454 | if (has_peereid() && options.auth.restricted) { |
| 455 | uid_t euid = -1; |
| 456 | gid_t egid = -1; |
| 457 | if (get_peereid(peedFd, &euid, &egid) == -1) { |
| 458 | errata.assign(ecode(UnauthorizedErrorCode::PEER_CREDENTIALS_ERROR)) |
| 459 | .note("Error getting peer credentials: {}", swoc::bwf::Errno{}); |
| 460 | } else if (euid != 0 && euid != geteuid()) { |
| 461 | errata.assign(ecode(UnauthorizedErrorCode::PERMISSION_DENIED)) |
| 462 | .note("Denied privileged API access for uid={} gid={}", euid, egid); |
| 463 | } |
| 464 | } |
| 465 | } |
| 466 | |
| 467 | } // namespace rpc::comm |
| 468 |
nothing calls this directly
no test coverage detected