support of PKCS#11 init arguments required by NSS softoken, patch contributed by...

[strongswan.git] / src / pluto / plutomain.c

diff --git a/src/pluto/plutomain.c b/src/pluto/plutomain.c
index 09f8c61..a5bf827 100644 (file)
--- a/src/pluto/plutomain.c
+++ b/src/pluto/plutomain.c
@@ -29,6 +29,8 @@
 #include <resolv.h>
 #include <arpa/nameser.h>      /* missing from <resolv.h> on old systems */
 #include <sys/queue.h>
+#include <linux/capability.h>
+#include <sys/prctl.h>
 
 #include <freeswan.h>
 
@@ -64,6 +66,11 @@
 #include "nat_traversal.h"
 #include "virtual.h"
 
+/* on some distros, a capset() definition is missing */
+#ifdef NO_CAPSET_DEFINED
+extern int capset(cap_user_header_t hdrp, const cap_user_data_t datap);
+#endif /* NO_CAPSET_DEFINED */
+
 static void
 usage(const char *mess)
 {
@@ -81,7 +88,7 @@ usage(const char *mess)
            " [--nocrsend]"
            " \\\n\t"
            "[--strictcrlpolicy]"
-           " [--crlcheckinterval]"
+           " [--crlcheckinterval <interval>]"
            " [--cachecrls]"
            " [--uniqueids]"
            " \\\n\t"
@@ -97,7 +104,8 @@ usage(const char *mess)
            " \\\n\t"
            "[--adns <pathname>]"
            "[--pkcs11module <path>]"
-           "[--pkcs11keepstate"
+           "[--pkcs11keepstate]"
+           "[--pkcs11initargs <string>]"
 #ifdef DEBUG
            " \\\n\t"
            "[--debug-none]"
@@ -210,6 +218,11 @@ bool pkcs11_keep_state = FALSE;
 /* by default pluto does not allow pkcs11 proxy access via whack */
 bool pkcs11_proxy = FALSE;
 
+/* argument string to pass to PKCS#11 module.
+ * Not used for compliant modules, just for NSS softoken
+ */
+static const char *pkcs11_init_args = NULL;
+
 int
 main(int argc, char **argv)
 {
@@ -221,6 +234,8 @@ main(int argc, char **argv)
     bool force_keepalive = FALSE;
     char *virtual_private = NULL;
     int lockfd;
+    struct __user_cap_header_struct hdr;
+    struct __user_cap_data_struct data;
 
     /* handle arguments */
     for (;;)
@@ -254,6 +269,7 @@ main(int argc, char **argv)
 #endif /* !USE_LWRES */
            { "pkcs11module", required_argument, NULL, 'm' },
            { "pkcs11keepstate", no_argument, NULL, 'k' },
+           { "pkcs11initargs", required_argument, NULL, 'z' },
            { "pkcs11proxy", no_argument, NULL, 'y' },
            { "nat_traversal", no_argument, NULL, '1' },
            { "keep_alive", required_argument, NULL, '2' },
@@ -423,6 +439,10 @@ main(int argc, char **argv)
            pkcs11_proxy = TRUE;
            continue;
 
+       case 'z':       /* --pkcs11initargs */
+           pkcs11_init_args = optarg;
+           continue;
+
 #ifdef DEBUG
        case 'N':       /* --debug-none */
            base_debugging = DBG_NONE;
@@ -584,7 +604,7 @@ main(int argc, char **argv)
 
     init_nat_traversal(nat_traversal, keep_alive, force_keepalive, nat_t_spf);
     init_virtual_ip(virtual_private);
-    scx_init(pkcs11_module_path);   /* load and initialize PKCS #11 module */
+    scx_init(pkcs11_module_path, pkcs11_init_args);   /* load and initialize PKCS #11 module */
     xauth_init();                  /* load and initialize XAUTH module */
     init_rnd_pool();
     init_secret();
@@ -596,6 +616,26 @@ main(int argc, char **argv)
     init_id();
     init_fetch();
 
+    /* drop unneeded capabilities and change UID/GID */
+    hdr.version = _LINUX_CAPABILITY_VERSION;
+    hdr.pid = 0;
+    data.effective = data.permitted = 1<<CAP_NET_ADMIN | 1<<CAP_NET_BIND_SERVICE;
+    data.inheritable = 0;
+
+    prctl(PR_SET_KEEPCAPS, 1);
+
+#   if IPSEC_GID
+       setgid(IPSEC_GID);
+#   endif
+#   if IPSEC_UID
+       setuid(IPSEC_UID);
+#   endif
+    if (capset(&hdr, &data))
+    {
+       plog("unable to drop root privileges");
+       abort();
+    }
+
     /* loading X.509 CA certificates */
     load_authcerts("CA cert", CA_CERT_PATH, AUTH_CA);
     /* loading X.509 AA certificates */