From 3d7adfbe0788f33a67c3ed65e12ba9d32074a674 Mon Sep 17 00:00:00 2001
From: Ade Lee <alee@redhat.com>
Date: Mon, 15 Jan 2018 15:25:36 -0500
Subject: [PATCH] Add parameter to set the uid of the invoked process

---
 src/com/redhat/nuxwdog/watchdog.cpp | 36 ++++++++++++++++++++++++++++++++++--
 src/com/redhat/nuxwdog/wdconf.cpp   |  7 +++++++
 src/com/redhat/nuxwdog/wdconf.h     |  3 ++-
 3 files changed, 43 insertions(+), 3 deletions(-)

diff --git a/src/com/redhat/nuxwdog/watchdog.cpp b/src/com/redhat/nuxwdog/watchdog.cpp
index a4d6a77..36b13e4 100644
--- a/src/com/redhat/nuxwdog/watchdog.cpp
+++ b/src/com/redhat/nuxwdog/watchdog.cpp
@@ -33,6 +33,7 @@
 #include <stdlib.h>
 #include <unistd.h>
 #include <errno.h>
+#include <cerrno>
 #include <signal.h>
 #include <fcntl.h>
 #include <pwd.h>
@@ -280,7 +281,7 @@ watchdog_exit(int status)
 
 int
 _watchdog_exec(int server_starts, char *server_exe, char *args[], 
-               char * envp[], int *spid)
+               char * envp[], int *spid, int uid)
 {
     int server_background = 0;
     char *server_out = NULL;
@@ -412,6 +413,14 @@ _watchdog_exec(int server_starts, char *server_exe, char *args[],
             free(server_context);
         }
 
+        if (uid >= 0) {
+            rv = setuid(uid);
+            if (rv != 0) {
+                watchdog_error("unable to setuid");
+                watchdog_exit(1);
+            }
+        }
+
         rv = execv(server_exe, args);
         if (rv < 0) {
 	    watchdog_error("could not execute server binary");
@@ -757,10 +766,12 @@ int main(int argc, char **argv, char **envp)
     int ver=0;
     int server_starts;
     int server_stat;
+    int uid=-1;
     char *server_exe = NULL;
     char *server_args = NULL;
     char *conffile = NULL;
     char *pch;
+    char *user = NULL;
     char *args[100];
     struct stat statbuf;
     UDS_NAME[0]=0;
@@ -833,6 +844,11 @@ int main(int argc, char **argv, char **envp)
         watchdog_exit(1);
     }
 
+    /* user */
+    if (confinfo->user) {
+       user = strdup(confinfo->user);
+    }
+
     if (detach) {
         parent_watchdog_create_signal_handlers();
 
@@ -883,6 +899,22 @@ int main(int argc, char **argv, char **envp)
         watchdog_exit(1);
     }
 
+    if (user != NULL) {
+        struct passwd *pw = getpwnam(user);
+        if (pw == NULL) {
+            sprintf(errmsgstr, "user %s does not exist", user);
+            watchdog_error(errmsgstr);
+            watchdog_exit(1);
+        }
+
+        if (chown(UDS_NAME, pw->pw_uid, pw->pw_gid) != 0) {
+            sprintf(errmsgstr, "chown failed errno %d %s", errno, strerror(errno));
+            watchdog_error(errmsgstr);
+            watchdog_exit(1);
+        }
+        uid = pw->pw_uid;
+    }
+
     for (server_starts = 0;; ++server_starts) {
 
         _watchdog_death					= 0;
@@ -895,7 +927,7 @@ int main(int argc, char **argv, char **envp)
 
         watchdog_create_signal_handlers();
 
-        rv = _watchdog_exec(server_starts, server_exe, args, envp, &server_pid);
+        rv = _watchdog_exec(server_starts, server_exe, args, envp, &server_pid, uid);
 
         if (server_pid < 0) {
             // exec failed:  kill parent if it's still waiting
diff --git a/src/com/redhat/nuxwdog/wdconf.cpp b/src/com/redhat/nuxwdog/wdconf.cpp
index 95603c9..2d50575 100644
--- a/src/com/redhat/nuxwdog/wdconf.cpp
+++ b/src/com/redhat/nuxwdog/wdconf.cpp
@@ -158,6 +158,9 @@ _watchdog_parse_conffile(char *conffile,
         if (!strcasecmp(name, "ChildSecurity")) {
             info->childSecurity = atoi(value);
         }
+        if (!strcasecmp(name, "User")) {
+            info->user = strdup(value);
+        }
         if (line != NULL) {
             free(line);
             line = NULL;
@@ -227,5 +230,9 @@ watchdog_confinfo_free(watchdog_conf_info_t *info)
         free(info->childPidFile);
     }
 
+    if (info->user) {
+        free(info->user);
+    }
+
     free(info);
 }
diff --git a/src/com/redhat/nuxwdog/wdconf.h b/src/com/redhat/nuxwdog/wdconf.h
index bb2e7b1..94f02e3 100644
--- a/src/com/redhat/nuxwdog/wdconf.h
+++ b/src/com/redhat/nuxwdog/wdconf.h
@@ -36,7 +36,8 @@ typedef struct watchdog_conf_info_t {
     char            *exeContext;       /* selinux type context */
     char            *pidFile;          /* pidFile */
     char            *childPidFile;     /* child pid file */
-    int             childSecurity;     /* enforce child security */    
+    int             childSecurity;     /* enforce child security */
+    char            *user;             /* user to execute the process as */
 } watchdog_conf_info_t;
 
 watchdog_conf_info_t *watchdog_parse(char *conf_file);
-- 
2.14.3