You've already forked coredns-powerdns-api-wrapper
47 lines
1.4 KiB
Go
47 lines
1.4 KiB
Go
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
// Copyright (C) 2026 Bryan Joshua Pedini
|
|
|
|
package main
|
|
|
|
import (
|
|
"log/slog"
|
|
"os"
|
|
"syscall"
|
|
)
|
|
|
|
// dropPrivileges irrevocably drops from root to PUID/PGID before any
|
|
// listener, goroutine, or DB connection is created. If already unprivileged
|
|
// (dev runs), it skips the drop and logs a warning. Any failure to drop or
|
|
// verify the drop is fatal — this process must never serve traffic as root.
|
|
func dropPrivileges(logger *slog.Logger, puid, pgid int) {
|
|
if os.Getuid() != 0 {
|
|
logger.Warn("already running unprivileged, skipping privilege drop", "uid", os.Getuid(), "gid", os.Getgid())
|
|
return
|
|
}
|
|
|
|
if err := syscall.Setgroups([]int{}); err != nil {
|
|
logger.Error("failed to clear supplementary groups", "error", err)
|
|
os.Exit(1)
|
|
}
|
|
if err := syscall.Setgid(pgid); err != nil {
|
|
logger.Error("failed to setgid", "gid", pgid, "error", err)
|
|
os.Exit(1)
|
|
}
|
|
if err := syscall.Setuid(puid); err != nil {
|
|
logger.Error("failed to setuid", "uid", puid, "error", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
if os.Getuid() != puid || os.Getgid() != pgid {
|
|
logger.Error("privilege drop verification failed", "want_uid", puid, "got_uid", os.Getuid(), "want_gid", pgid, "got_gid", os.Getgid())
|
|
os.Exit(1)
|
|
}
|
|
|
|
if err := syscall.Setuid(0); err == nil {
|
|
logger.Error("re-escalation to root succeeded, this must never happen")
|
|
os.Exit(1)
|
|
}
|
|
|
|
logger.Info("privileges dropped", "uid", os.Getuid(), "gid", os.Getgid())
|
|
}
|