Attachment #390180 for bug #528774

Lines 185-190 public: Link Here

(-)a/include/znc/znc.h (+3 lines)
185		185
186	static void DumpConfig(const CConfig* Config);	186	static void DumpConfig(const CConfig* Config);
187		187
		188	void SetSystemWideConfig(bool systemWideConfig);
		189
188	private:	190	private:
189	CFile* InitPidFile();	191	CFile* InitPidFile();
190	bool DoRehash(CString& sError);	192	bool DoRehash(CString& sError);
Lines 229-234 protected: Link Here
229	unsigned int m_uiConnectPaused;	231	unsigned int m_uiConnectPaused;
230	TCacheMap<CString> m_sConnectThrottle;	232	TCacheMap<CString> m_sConnectThrottle;
231	bool m_bProtectWebSessions;	233	bool m_bProtectWebSessions;
		234	bool m_bSystemWideConfig;
232	};	235	};
233		236
234	#endif // !_ZNC_H	237	#endif // !_ZNC_H

Lines 16-21 Link Here

(-)a/src/main.cpp (-2 / +40 lines)
16		16
17	#include <znc/znc.h>	17	#include <znc/znc.h>
18	#include <signal.h>	18	#include <signal.h>
		19	#include <sys/types.h>
		20	#include <pwd.h>
		21	#include <grp.h>
19		22
20	#if defined(HAVE_LIBSSL) && defined(HAVE_PTHREAD)	23	#if defined(HAVE_LIBSSL) && defined(HAVE_PTHREAD)
21	#include <znc/Threads.h>	24	#include <znc/Threads.h>
Lines 109-114 static const struct option g_LongOpts[] = { Link Here
109	{ "makepass", no_argument, 0, 's' },	112	{ "makepass", no_argument, 0, 's' },
110	{ "makepem", no_argument, 0, 'p' },	113	{ "makepem", no_argument, 0, 'p' },
111	{ "datadir", required_argument, 0, 'd' },	114	{ "datadir", required_argument, 0, 'd' },
		115	{ "system-wide-config-as", required_argument, 0, 'S' },
112	{ 0, 0, 0, 0 }	116	{ 0, 0, 0, 0 }
113	};	117	};
114		118
Lines 192-197 int main(int argc, char** argv) { Link Here
192	bool bMakeConf = false;	196	bool bMakeConf = false;
193	bool bMakePass = false;	197	bool bMakePass = false;
194	bool bAllowRoot = false;	198	bool bAllowRoot = false;
		199	bool bSystemWideConfig = false;
		200	CString sSystemWideConfigUser = "znc";
195	bool bForeground = false;	201	bool bForeground = false;
196	#ifdef ALWAYS_RUN_IN_FOREGROUND	202	#ifdef ALWAYS_RUN_IN_FOREGROUND
197	bForeground = true;	203	bForeground = true;
Lines 200-206 int main(int argc, char** argv) { Link Here
200	bool bMakePem = false;	206	bool bMakePem = false;
201	#endif	207	#endif
202		208
203	while ((iArg = getopt_long(argc, argv, "hvnrcspd:Df", g_LongOpts, &iOptIndex)) != -1) {	209	while ((iArg = getopt_long(argc, argv, "hvnrcspd:DfS", g_LongOpts, &iOptIndex)) != -1) {
204	switch (iArg) {	210	switch (iArg) {
205	case 'h':	211	case 'h':
206	GenerateHelp(argv[0]);	212	GenerateHelp(argv[0]);
Lines 218-223 int main(int argc, char** argv) { Link Here
218	case 'c':	224	case 'c':
219	bMakeConf = true;	225	bMakeConf = true;
220	break;	226	break;
		227	case 'S':
		228	bSystemWideConfig = true;
		229	sSystemWideConfigUser = optarg;
		230	break;
221	case 's':	231	case 's':
222	bMakePass = true;	232	bMakePass = true;
223	break;	233	break;
Lines 252-261 int main(int argc, char** argv) { Link Here
252	return 1;	262	return 1;
253	}	263	}
254		264
		265	if (bSystemWideConfig && getuid() == 0) {
		266	struct passwd *pwd;
		267
		268	pwd = getpwnam(sSystemWideConfigUser.c_str());
		269	if (pwd == NULL) {
		270	CUtils::PrintError("Daemon user not found.");
		271	return 1;
		272	}
		273
		274	if ((long) pwd->pw_uid == 0) {
		275	CUtils::PrintError("Please define a daemon user other than root.");
		276	return 1;
		277	}
		278	if (setgroups(0, NULL) != 0) {
		279	CUtils::PrintError("setgroups: Unable to clear supplementary group IDs");
		280	return 1;
		281	}
		282	if (setgid((long) pwd->pw_gid) != 0) {
		283	CUtils::PrintError("setgid: Unable to drop group privileges");
		284	return 1;
		285	}
		286	if (setuid((long) pwd->pw_uid) != 0) {
		287	CUtils::PrintError("setuid: Unable to drop user privileges");
		288	return 1;
		289	}
		290	}
		291
255	CZNC::CreateInstance();	292	CZNC::CreateInstance();
256		293
257	CZNC* pZNC = &CZNC::Get();	294	CZNC* pZNC = &CZNC::Get();
258	pZNC->InitDirs(((argc) ? argv[0] : ""), sDataDir);	295	pZNC->InitDirs(((argc) ? argv[0] : ""), sDataDir);
		296	pZNC->SetSystemWideConfig(bSystemWideConfig);
259		297
260	#ifdef HAVE_LIBSSL	298	#ifdef HAVE_LIBSSL
261	if (bMakePem) {	299	if (bMakePem) {
Lines 304-310 int main(int argc, char** argv) { Link Here
304	CUtils::PrintStatus(true, "");	342	CUtils::PrintStatus(true, "");
305	}	343	}
306		344
307	if (isRoot()) {	345	if (isRoot() && !bSystemWideConfig) {
308	CUtils::PrintError("You are running ZNC as root! Don't do that! There are not many valid");	346	CUtils::PrintError("You are running ZNC as root! Don't do that! There are not many valid");
309	CUtils::PrintError("reasons for this and it can, in theory, cause great damage!");	347	CUtils::PrintError("reasons for this and it can, in theory, cause great damage!");
310	if (!bAllowRoot) {	348	if (!bAllowRoot) {

Lines 55-60 CZNC::CZNC() { Link Here

(-)a/src/znc.cpp (-1 / +6 lines)
55	m_sConnectThrottle.SetTTL(30000);	55	m_sConnectThrottle.SetTTL(30000);
56	m_pLockFile = NULL;	56	m_pLockFile = NULL;
57	m_bProtectWebSessions = true;	57	m_bProtectWebSessions = true;
		58	m_bSystemWideConfig = false;
58	m_uDisabledSSLProtocols = Csock::EDP_SSL;	59	m_uDisabledSSLProtocols = Csock::EDP_SSL;
59	m_sSSLProtocols = "";	60	m_sSSLProtocols = "";
60	}	61	}
Lines 856-862 bool CZNC::WriteNewConfig(const CString& sConfigFile) { Link Here
856	CUtils::PrintMessage("");	857	CUtils::PrintMessage("");
857		858
858	File.UnLock();	859	File.UnLock();
859	return bFileOpen && CUtils::GetBoolInput("Launch ZNC now?", true);	860	return bFileOpen && !m_bSystemWideConfig && CUtils::GetBoolInput("Launch ZNC now?", true);
860	}	861	}
861		862
862	void CZNC::BackupConfigOnce(const CString& sSuffix) {	863	void CZNC::BackupConfigOnce(const CString& sSuffix) {
Lines 1966-1968 void CZNC::LeakConnectQueueTimer(CConnectQueueTimer *pTimer) { Link Here
1966	bool CZNC::WaitForChildLock() {	1967	bool CZNC::WaitForChildLock() {
1967	return m_pLockFile && m_pLockFile->ExLock();	1968	return m_pLockFile && m_pLockFile->ExLock();
1968	}	1969	}
		1970
		1971	void CZNC::SetSystemWideConfig(bool systemWideConfig) {
		1972	m_bSystemWideConfig = systemWideConfig;
		1973	}

Return to bug 528774