aquatic: add setting for dropping privileges after opening sockets

aquatic/Cargo.toml

@@ -23,6 +23,7 @@ mimalloc = { version = "0.1", default-features = false }
 mio = { version = "0.7", features = ["udp", "os-poll", "os-util"] }
 net2 = "0.2"
 parking_lot = "0.10"
+privdrop = "0.3"
 rand = { version = "0.7", features = ["small_rng"] }
 serde = { version = "1", features = ["derive"] }
 

aquatic/src/lib/config.rs

@@ -17,6 +17,7 @@ pub struct Config {
     pub handlers: HandlerConfig,
     pub statistics: StatisticsConfig,
     pub cleaning: CleaningConfig,
+    pub privileges: PrivilegeConfig,
 }
 
 
@@ -80,6 +81,18 @@ pub struct CleaningConfig {
 }
 
 
+#[derive(Clone, Debug, Serialize, Deserialize)]
+#[serde(default)]
+pub struct PrivilegeConfig {
+    /// Chroot and switch user after binding to sockets
+    pub drop_privileges: bool,
+    /// Chroot to this path
+    pub chroot_path: String,
+    /// User to switch to after chrooting
+    pub user: String,
+}
+
+
 impl Default for Config {
     fn default() -> Self {
         Self {
@@ -89,6 +102,7 @@ impl Default for Config {
             handlers: HandlerConfig::default(),
             statistics: StatisticsConfig::default(),
             cleaning: CleaningConfig::default(),
+            privileges: PrivilegeConfig::default(),
         }
     }
 }
@@ -136,3 +150,14 @@ impl Default for CleaningConfig {
         }
     }
 }
+
+
+impl Default for PrivilegeConfig {
+    fn default() -> Self {
+        Self {
+            drop_privileges: false,
+            chroot_path: ".".to_string(),
+            user: "nobody".to_string(),
+        }
+    }
+}

aquatic/src/lib/lib.rs

@@ -1,7 +1,9 @@
+use std::sync::{Arc, atomic::{AtomicUsize, Ordering}};
 use std::time::Duration;
 use std::thread::Builder;
 
 use crossbeam_channel::unbounded;
+use privdrop::PrivDrop;
 
 pub mod common;
 pub mod config;
@@ -35,11 +37,14 @@ pub fn run(config: Config){
         ).expect("spawn request worker");
     }
 
+    let num_bound_sockets = Arc::new(AtomicUsize::new(0));
+
     for i in 0..config.socket_workers {
         let state = state.clone();
         let config = config.clone();
         let request_sender = request_sender.clone();
         let response_receiver = response_receiver.clone();
+        let num_bound_sockets = num_bound_sockets.clone();
 
         Builder::new().name(format!("socket-{:02}", i + 1)).spawn(move ||
             network::run_socket_worker(
@@ -48,6 +53,7 @@ pub fn run(config: Config){
                 i,
                 request_sender,
                 response_receiver,
+                num_bound_sockets,
             )
         ).expect("spawn socket worker");
     }
@@ -67,6 +73,24 @@ pub fn run(config: Config){
         ).expect("spawn statistics thread");
     }
 
+    if config.privileges.drop_privileges {
+        loop {
+            let sockets = num_bound_sockets.load(Ordering::SeqCst);
+
+            if sockets == config.socket_workers {
+                PrivDrop::default()
+                    .chroot(config.privileges.chroot_path)
+                    .user(config.privileges.user)
+                    .apply()
+                    .expect("drop privileges");
+
+                break;
+            }
+
+            ::std::thread::sleep(Duration::from_millis(10));
+        }
+    }
+
     loop {
         ::std::thread::sleep(Duration::from_secs(config.cleaning.interval));
 

aquatic/src/lib/network.rs

@@ -1,4 +1,4 @@
-use std::sync::atomic::Ordering;
+use std::sync::{Arc, atomic::{AtomicUsize, Ordering}};
 use std::io::{Cursor, ErrorKind};
 use std::net::SocketAddr;
 use std::time::Duration;
@@ -23,6 +23,7 @@ pub fn run_socket_worker(
     token_num: usize,
     request_sender: Sender<(Request, SocketAddr)>,
     response_receiver: Receiver<(Response, SocketAddr)>,
+    num_bound_sockets: Arc<AtomicUsize>,
 ){
     let mut buffer = [0u8; MAX_PACKET_SIZE];
 
@@ -34,6 +35,8 @@ pub fn run_socket_worker(
     poll.registry()
         .register(&mut socket, Token(token_num), interests)
         .unwrap();
+    
+    num_bound_sockets.fetch_add(1, Ordering::SeqCst);
 
     let mut events = Events::with_capacity(config.network.poll_event_capacity);