83d119
--- arpwatch-2.1a10/arpwatch.c	Sat Oct 14 05:07:35 2000
83d119
+++ arpwatch-2.1a10/arpwatch.c	Sun Jun 10 16:22:57 2001
83d119
@@ -62,7 +62,7 @@
83d119
 #include <string.h>
83d119
 #include <syslog.h>
83d119
 #include <unistd.h>
83d119
-
83d119
+#include <pwd.h>
83d119
 #include <pcap.h>
83d119
 
83d119
 #include "gnuc.h"
83d119
@@ -141,6 +141,25 @@
83d119
 int	sanity_fddi(struct fddi_header *, struct ether_arp *, int);
83d119
 __dead	void usage(void) __attribute__((volatile));
83d119
 
83d119
+void dropprivileges(const char* user)
83d119
+{
83d119
+	struct passwd* pw;
83d119
+	pw = getpwnam( user );
83d119
+	if ( pw ) {
83d119
+		if ( initgroups(pw->pw_name, NULL) != 0 || setgid(pw->pw_gid) != 0 ||
83d119
+				 setuid(pw->pw_uid) != 0 ) {
83d119
+			syslog(LOG_ERR, "Couldn't change to '%.32s' uid=%d gid=%d", user,
83d119
+						 pw->pw_uid, pw->pw_gid);
83d119
+			exit(1);
83d119
+		}
83d119
+	}
83d119
+	else {
83d119
+		syslog(LOG_ERR, "Couldn't find user '%.32s' in /etc/passwd", user);
83d119
+		exit(1);
83d119
+	}
83d119
+	syslog(LOG_DEBUG, "Running as uid=%d gid=%d", getuid(), getgid());
83d119
+}
83d119
+
83d119
 int
83d119
 main(int argc, char **argv)
83d119
 {
83d119
@@ -153,6 +172,7 @@
83d119
 	register char *interface, *rfilename;
83d119
 	struct bpf_program code;
83d119
 	char errbuf[PCAP_ERRBUF_SIZE];
83d119
+	char* serveruser = NULL;
83d119
 
83d119
 	if (argv[0] == NULL)
83d119
 		prog = "arpwatch";
83d119
@@ -170,7 +190,7 @@
83d119
 	interface = NULL;
83d119
 	rfilename = NULL;
83d119
 	pd = NULL;
83d119
-	while ((op = getopt(argc, argv, "df:i:n:Nr:")) != EOF)
83d119
+	while ((op = getopt(argc, argv, "df:i:n:Nr:u:")) != EOF)
83d119
 		switch (op) {
83d119
 
83d119
 		case 'd':
83d119
@@ -202,6 +222,16 @@
83d119
 			rfilename = optarg;
83d119
 			break;
83d119
 
83d119
+		case 'u':
83d119
+			if ( optarg ) {
83d119
+				serveruser = strdup(optarg);
83d119
+			}
83d119
+			else {
83d119
+				fprintf(stderr, "%s: Need username after -u\n", prog);
83d119
+				usage();
83d119
+			}
83d119
+			break;
83d119
+
83d119
 		default:
83d119
 			usage();
83d119
 		}
83d119
@@ -283,8 +313,11 @@
83d119
 	 * Revert to non-privileged user after opening sockets
83d119
 	 * (not needed on most systems).
83d119
 	 */
83d119
-	setgid(getgid());
83d119
-	setuid(getuid());
83d119
+	/*setgid(getgid());*/
83d119
+	/*setuid(getuid());*/
83d119
+	if ( serveruser ) {
83d119
+		dropprivileges( serveruser );
83d119
+	}
83d119
 
83d119
 	/* Must be ethernet or fddi */
83d119
 	linktype = pcap_datalink(pd);
83d119
@@ -751,6 +784,6 @@
83d119
 
83d119
 	(void)fprintf(stderr, "Version %s\n", version);
83d119
 	(void)fprintf(stderr, "usage: %s [-dN] [-f datafile] [-i interface]"
83d119
-	    " [-n net[/width]] [-r file]\n", prog);
83d119
+	    " [-n net[/width]] [-r file] [-u username]\n", prog);
83d119
 	exit(1);
83d119
 }