Skip to content

Commit

Permalink
diod: log access policy
Browse files Browse the repository at this point in the history
Problem: when diod starts, it may not be clear which access policy
has been enacted.

Log it.
  • Loading branch information
garlick committed Jan 20, 2025
1 parent 06e325b commit 4684e5c
Showing 1 changed file with 26 additions and 0 deletions.
26 changes: 26 additions & 0 deletions src/cmd/diod.c
Original file line number Diff line number Diff line change
Expand Up @@ -507,6 +507,22 @@ _test_setgroups (void)
}
#endif /* USE_IMPERSONATION_LINUX */

/* Look up user name of effective uid.
* The result is only valid until the next call, and this is not thread safe.
*/
static const char *
_geteuser (void)
{
static char idstr[16];
struct passwd *pw = getpwuid (geteuid ());

if (!pw) {
snprintf (idstr, sizeof (idstr), "%d", geteuid ());
return idstr;
}
return pw->pw_name;
}

static void
_service_run (srvmode_t mode, int rfdno, int wfdno)
{
Expand Down Expand Up @@ -564,6 +580,16 @@ _service_run (srvmode_t mode, int rfdno, int wfdno)
_become_user (NULL, diod_conf_get_runasuid ());
}

/* report */
if (diod_conf_opt_runasuid ()) {
const char *user = _geteuser ();
msg ("Only %s can attach and access files as %s", user, user);
}
else if (diod_conf_get_allsquash ())
msg ("Anyone can attach and access files as %s", _geteuser ());
else
msg ("Anyone can attach and access files as themselves");

/* clear umask */
umask (0);

Expand Down

0 comments on commit 4684e5c

Please sign in to comment.