diff --git a/src/libmain/setuid-common.hh b/src/libmain/setuid-common.hh deleted file mode 100644 index a3e840996..000000000 --- a/src/libmain/setuid-common.hh +++ /dev/null @@ -1,22 +0,0 @@ -/* Code shared between libmain and nix-setuid-helper. */ - -extern char * * environ; - - -namespace nix { - - -void setuidCleanup() -{ - /* Don't trust the environment. */ - environ = 0; - - /* Make sure that file descriptors 0, 1, 2 are open. */ - for (int fd = 0; fd <= 2; ++fd) { - struct stat st; - if (fstat(fd, &st) == -1) abort(); - } -} - - -} diff --git a/src/libmain/shared.cc b/src/libmain/shared.cc index fa72ca5bc..d7fb24019 100644 --- a/src/libmain/shared.cc +++ b/src/libmain/shared.cc @@ -14,9 +14,6 @@ #include -#include "setuid-common.hh" - - namespace nix { diff --git a/src/libutil/util.cc b/src/libutil/util.cc index b152dc8f4..fb6411408 100644 --- a/src/libutil/util.cc +++ b/src/libutil/util.cc @@ -17,6 +17,9 @@ #include "util.hh" +extern char * * environ; + + namespace nix { @@ -818,6 +821,19 @@ void quickExit(int status) } +void setuidCleanup() +{ + /* Don't trust the environment. */ + environ = 0; + + /* Make sure that file descriptors 0, 1, 2 are open. */ + for (int fd = 0; fd <= 2; ++fd) { + struct stat st; + if (fstat(fd, &st) == -1) abort(); + } +} + + ////////////////////////////////////////////////////////////////////// diff --git a/src/libutil/util.hh b/src/libutil/util.hh index b850ee798..8f79ec9be 100644 --- a/src/libutil/util.hh +++ b/src/libutil/util.hh @@ -237,6 +237,10 @@ string runProgram(Path program); Cygwin, _exit() doesn't seem to do the right thing.) */ void quickExit(int status); +/* Common initialisation for setuid programs: clear the environment, + sanitize file handles 0, 1 and 2. */ +void setuidCleanup(); + /* User interruption. */ diff --git a/src/nix-setuid-helper/main.cc b/src/nix-setuid-helper/main.cc index dc0b2cd6c..26cdc73b7 100644 --- a/src/nix-setuid-helper/main.cc +++ b/src/nix-setuid-helper/main.cc @@ -12,11 +12,12 @@ #include "util.hh" -#include "../libmain/setuid-common.hh" - using namespace nix; +extern char * * environ; + + /* Recursively change the ownership of `path' to user `uidTo' and group `gidTo'. `path' must currently be owned by user `uidFrom', or, if `uidFrom' is -1, by group `gidFrom'. */