c_cpp Solaris权限代码段

Posted 2021-05-14

#include <stdlib.h>
#include <stdio.h>
#include <priv.h>
#include <sys/priv.h>
#include <errno.h>

int main(void) {
    priv_ptype_t which;
    priv_set_t *set;
    int rc = 0;

    which = PRIV_EFFECTIVE;

    set = (priv_allocset());
    if ((rc = getppriv(which, set)) == -1) {
        printf("Failed getppriv: %d\n", rc);
    };

    (priv_ismember(set, PRIV_PROC_EXEC)) ? \
    printf("can exec(2)\n") : printf("cannot exec(2)\n");

    (priv_ismember(set, PRIV_FILE_READ)) ? \
    printf("can read\n") : printf("cannot read\n");

    (priv_ismember(set, PRIV_FILE_WRITE)) ? \
    printf("can write\n") : printf("cannot write\n");

    (priv_ismember(set, PRIV_FILE_DAC_READ)) ? \
    printf("can read DAC\n") : printf("cannot read DAC\n");

    if ((rc = priv_addset(set, PRIV_FILE_DAC_READ)) == -1) {
        printf("Failed priv_addset: %d\n", rc);
    } else {
        printf("Will try to add PRIV_FILE_DAC_READ\n");
    };
    

    (priv_ismember(set, PRIV_FILE_DAC_READ)) ? \
    printf("DAC now added to set\n") : \
    printf("DAC not added to set\n");

    
    // This should remove file write privilege.
    priv_delset(set, PRIV_FILE_WRITE);

    (priv_ismember(set, PRIV_FILE_WRITE)) ? \
    printf("can write\n") : printf("cannot write\n");

    // This should fail when run as normal user, but with sudo
    // should be successful.
    if ((rc = setppriv(PRIV_ON, which, set)) == -1) {
        printf("Failed setppriv: %d | error=%d\n", rc, errno);
    };
}