X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fresolve%2Fresolved.c;h=53f09db73baaf20eac2ae6a65189d9564f454bcb;hb=b9e7a9d870ac41d4db954edd52a1f5dd7d153389;hp=82f43d68031b398116215974c71d34e9a8a88a9f;hpb=091a364c802e34a58f3260c9cb5db9b75c62215c;p=elogind.git diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c index 82f43d680..53f09db73 100644 --- a/src/resolve/resolved.c +++ b/src/resolve/resolved.c @@ -25,9 +25,13 @@ #include "resolved.h" #include "mkdir.h" +#include "capability.h" int main(int argc, char *argv[]) { _cleanup_manager_free_ Manager *m = NULL; + const char *user = "systemd-resolve"; + uid_t uid; + gid_t gid; int r; log_set_target(LOG_TARGET_AUTO); @@ -42,11 +46,25 @@ int main(int argc, char *argv[]) { goto out; } + r = get_user_creds(&user, &uid, &gid, NULL, NULL); + if (r < 0) { + log_error("Cannot resolve user name %s: %s", user, strerror(-r)); + goto out; + } + /* Always create the directory where resolv.conf will live */ - r = mkdir_label("/run/systemd/network", 0755); - if (r < 0) + r = mkdir_safe_label("/run/systemd/resolve", 0755, uid, gid); + if (r < 0) { log_error("Could not create runtime directory: %s", strerror(-r)); + goto out; + } + + r = drop_privileges(uid, gid, 0); + if (r < 0) + goto out; + + assert_se(sigprocmask_many(SIG_BLOCK, SIGTERM, SIGINT, -1) == 0); r = manager_new(&m); if (r < 0) {