diff --git a/cmd/fpkg/main.go b/cmd/fpkg/main.go index 8075ba1..62ad7cd 100644 --- a/cmd/fpkg/main.go +++ b/cmd/fpkg/main.go @@ -40,7 +40,7 @@ func main() { // early init argv0 check, skips root check and duplicate PR_SET_DUMPABLE init0.TryArgv0() - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Printf("cannot set SUID_DUMP_DISABLE: %s", err) // not fatal: this program runs as the privileged user } diff --git a/internal/app/init/main.go b/internal/app/init/main.go index bf9ecba..33678c4 100644 --- a/internal/app/init/main.go +++ b/internal/app/init/main.go @@ -28,7 +28,7 @@ func Main() { fmsg.Prepare("init") // setting this prevents ptrace - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err) } @@ -64,7 +64,7 @@ func Main() { } // die with parent - if err := internal.PR_SET_PDEATHSIG__SIGKILL(); err != nil { + if err := internal.SetPdeathsig(syscall.SIGKILL); err != nil { log.Fatalf("prctl(PR_SET_PDEATHSIG, SIGKILL): %v", err) } diff --git a/internal/app/shim/main.go b/internal/app/shim/main.go index 5e32a9f..d1bd819 100644 --- a/internal/app/shim/main.go +++ b/internal/app/shim/main.go @@ -29,7 +29,7 @@ func Main() { fmsg.Prepare("shim") // setting this prevents ptrace - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Fatalf("cannot set SUID_DUMP_DISABLE: %s", err) } diff --git a/internal/prctl.go b/internal/prctl.go index 857371b..ae8392a 100644 --- a/internal/prctl.go +++ b/internal/prctl.go @@ -2,17 +2,22 @@ package internal import "syscall" -func PR_SET_DUMPABLE__SUID_DUMP_DISABLE() error { +const ( + SUID_DUMP_DISABLE = iota + SUID_DUMP_USER +) + +func SetDumpable(dumpable uintptr) error { // linux/sched/coredump.h - if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, 0, 0); errno != 0 { + if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_DUMPABLE, dumpable, 0); errno != 0 { return errno } return nil } -func PR_SET_PDEATHSIG__SIGKILL() error { - if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(syscall.SIGKILL), 0); errno != 0 { +func SetPdeathsig(sig syscall.Signal) error { + if _, _, errno := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_PDEATHSIG, uintptr(sig), 0); errno != 0 { return errno } diff --git a/main.go b/main.go index 9a47b2f..d4fc3d9 100644 --- a/main.go +++ b/main.go @@ -44,7 +44,7 @@ func main() { // early init argv0 check, skips root check and duplicate PR_SET_DUMPABLE init0.TryArgv0() - if err := internal.PR_SET_DUMPABLE__SUID_DUMP_DISABLE(); err != nil { + if err := internal.SetDumpable(internal.SUID_DUMP_DISABLE); err != nil { log.Printf("cannot set SUID_DUMP_DISABLE: %s", err) // not fatal: this program runs as the privileged user }