%%
Configuration: KeyPairs
- | { fprintf(stderr, "%s: no settings, proceeding with defaults\n", config); }
+ | { if (!silent) fprintf(stderr, "%s: no settings, proceeding with defaults\n", config); }
;
KeyPairs: KeyPairs KeyPair
switch ($1)
{
case TYPE_SGROUP:
+ if (myconfig->shed_gid != (gid_t)-1)
+ break;
+
myconfig->shed_group = strdup($3);
if ((gr = getgrnam($3)) != NULL)
- myconfig->shed_gid = gr->gr_gid;
+ {
+ myconfig->shed_gid = gr->gr_gid;
+ if (!silent)
+ fprintf(stderr, "%s:%d: suggest replacing 'shed_group = \"%s\"' line with 'shed_gid = %d'\n",
+ config, line, $3, gr->gr_gid);
+ }
else
- fprintf(stderr, "%s: no such group '%s'\n", config, $3);
+ {
+ if (!silent)
+ fprintf(stderr, "%s: no such group '%s'\n", config, $3);
+ }
break;
case TYPE_SUSER:
+ if (myconfig->shed_uid != (uid_t)-1)
+ break;
+
if (!strcmp($3, "root"))
{
fprintf(stderr, "%s: I refuse to run as root! Aborting.\n", config);
if ((usr = getpwnam($3)) != NULL)
{
if (usr->pw_uid != 0)
+ {
myconfig->shed_uid = usr->pw_uid;
+ if (!silent)
+ fprintf(stderr, "%s:%d: suggest replacing 'shed_user = \"%s\"' line with 'shed_uid = %d'\n",
+ config, line, $3, usr->pw_uid);
+ }
else
{
fprintf(stderr, "%s: I refuse to run as %s (uid 0!) Aborting.\n", config, $3);
}
}
else
- fprintf(stderr, "%s: no such user '%s'\n", config, $3);
+ {
+ if (!silent)
+ fprintf(stderr, "%s: no such user '%s'\n", config, $3);
+ }
break;
case TYPE_PATH_CHROOT:
switch ($1)
{
case TYPE_SUID:
- if (!myconfig->shed_user)
+ if (!silent && myconfig->shed_uid != (uid_t)-1 && myconfig->shed_uid != $3)
+ fprintf(stderr, "%s:%d: 'shed_uid = %lu' entry overrides old setting %d\n",
+ config, line, $3, myconfig->shed_uid);
+
+ /* Naive user protection - do not allow running as user root */
+ if ($3 == 0)
{
- /* Naive user protection - do not allow running as user root */
- if ($3 == 0)
- {
- fprintf(stderr, "%s: I refuse to run as uid 0 (root)! Aborting.\n", config);
- graceful_exit(1);
- }
- myconfig->shed_uid = $3;
+ fprintf(stderr, "%s: I refuse to run as uid 0 (root)! Aborting.\n", config);
+ graceful_exit(1);
}
-
+
+ myconfig->shed_uid = $3;
break;
case TYPE_SGID:
- if (!myconfig->shed_group)
- {
- myconfig->shed_gid = $3;
- }
-
+ if (!silent && myconfig->shed_gid != (gid_t)-1 && myconfig->shed_gid != $3)
+ fprintf(stderr, "%s:%d: 'shed_gid = %lu' entry overrides old setting %d\n",
+ config, line, $3, myconfig->shed_gid);
+
+ myconfig->shed_gid = $3;
break;
case TYPE_MAX:
void yyerror(char const* s)
{
- fprintf(stderr, "%s: couldn't parse \"%s\" at line %d, column %d: %s\n", config, yytext, line, col, s);
+ if (!silent)
+ fprintf(stderr, "%s: couldn't parse \"%s\" at line %d, column %d: %s\n", config, yytext, line, col, s);
}
-/* This is a sample dgamelaunch configuration file. Comments like this as
- well as bash-style comments are allowed in this configuration file. Each
- configuration option will be explained along with its default value. */
+# This is a sample dgamelaunch configuration file. Only bash-style comments
+# are allowed, such as this. Each configuration option will be explained
+# along with its default value.
+
+# The following two options are fairly insecure. They will force us to
+# load the password/group database into memory while still having root
+# privileges. Replace them with shed_uid/shed_gid entries as soon as
+# possible if you decide to use them. dgamelaunch will inform you of
+# the uids/gids corresponding to your choices when it loads.
+#
+# Note that shed_uid and shed_gid will always take precedence over
+# shed_user and shed_group if they are specified.
# shed_user: username to shed privileges to
shed_user = "games"
-
# shed_group: group name to shed privileges to
shed_group = "games"
-# Alternatively, you may use the respective gids/uids. This is for Debian:
+# Preferably, you may use the respective gids/uids. This is for Debian:
shed_uid = 5
shed_gid = 60
-# Note that shed_user and shed_group will always take precedence over
-# shed_uid and shed_gid.
-
# Max amount of registered users to allow.
maxusers = 64000