Make Solaris privs code build on older systems.

Not all systems with Solaris privs have priv_basicset so factor that
out and provide backward compatibility code.  Similarly, not all have
PRIV_NET_ACCESS so wrap that in #ifdef.  Based on code from
alex at cooperi.net and djm@ with help from carson at taltos.org and
wieland at purdue.edu.

2 files changed, 36 insertions, 11 deletions

diff --git a/openbsd-compat/port-solaris.c b/openbsd-compat/port-solaris.c
index 962cd1685..e36e412d7 100644
--- a/openbsd-compat/port-solaris.c
+++ b/openbsd-compat/port-solaris.c
@@ -233,6 +233,26 @@ solaris_set_default_project(struct passwd *pw)
 #  include <priv.h>
 # endif
 
+priv_set_t *
+solaris_basic_privset(void)
+{
+        priv_set_t *pset;
+
+#ifdef HAVE_PRIV_BASICSET
+        if ((pset = priv_allocset()) == NULL) {
+                error("priv_allocset: %s", strerror(errno));
+                return NULL;
+        }
+        priv_basicset(pset);
+#else
+        if ((pset = priv_str_to_set("basic", ",", NULL)) == NULL) {
+                error("priv_str_to_set: %s", strerror(errno));
+                return NULL;
+        }
+#endif
+        return pset;
+}
+
 void
 solaris_drop_privs_pinfo_net_fork_exec(void)
 {
@@ -254,11 +274,10 @@ solaris_drop_privs_pinfo_net_fork_exec(void)
          * etc etc).
          */
 
-        if ((pset = priv_allocset()) == NULL ||
-            (npset = priv_allocset()) == NULL)
+        if ((pset = priv_allocset()) == NULL)
                 fatal("priv_allocset: %s", strerror(errno));
-
-        priv_basicset(npset);
+        if ((npset = solaris_basic_privset()) == NULL)
+                fatal("solaris_basic_privset: %s", strerror(errno));
 
         if (priv_addset(npset, PRIV_FILE_CHOWN) != 0 ||
             priv_addset(npset, PRIV_FILE_DAC_READ) != 0 ||
@@ -268,7 +287,9 @@ solaris_drop_privs_pinfo_net_fork_exec(void)
                 fatal("priv_addset: %s", strerror(errno));
 
         if (priv_delset(npset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
             priv_delset(npset, PRIV_NET_ACCESS) != 0 ||
+#endif
             priv_delset(npset, PRIV_PROC_EXEC) != 0 ||
             priv_delset(npset, PRIV_PROC_FORK) != 0 ||
             priv_delset(npset, PRIV_PROC_INFO) != 0 ||
@@ -294,14 +315,14 @@ solaris_drop_privs_root_pinfo_net(void)
 {
         priv_set_t *pset = NULL;
 
-        if ((pset = priv_allocset()) == NULL)
-                fatal("priv_allocset: %s", strerror(errno));
-
         /* Start with "basic" and drop everything we don't need. */
-        priv_basicset(pset);
+        if ((pset = solaris_basic_privset()) == NULL)
+                fatal("solaris_basic_privset: %s", strerror(errno));
 
         if (priv_delset(pset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
             priv_delset(pset, PRIV_NET_ACCESS) != 0 ||
+#endif
             priv_delset(pset, PRIV_PROC_INFO) != 0 ||
             priv_delset(pset, PRIV_PROC_SESSION) != 0)
                 fatal("priv_delset: %s", strerror(errno));
@@ -319,14 +340,15 @@ solaris_drop_privs_root_pinfo_net_exec(void)
 {
         priv_set_t *pset = NULL;
 
-        if ((pset = priv_allocset()) == NULL)
-                fatal("priv_allocset: %s", strerror(errno));
 
         /* Start with "basic" and drop everything we don't need. */
-        priv_basicset(pset);
+        if ((pset = solaris_basic_privset()) == NULL)
+                fatal("solaris_basic_privset: %s", strerror(errno));
 
         if (priv_delset(pset, PRIV_FILE_LINK_ANY) != 0 ||
+#ifdef PRIV_NET_ACCESS
             priv_delset(pset, PRIV_NET_ACCESS) != 0 ||
+#endif
             priv_delset(pset, PRIV_PROC_EXEC) != 0 ||
             priv_delset(pset, PRIV_PROC_INFO) != 0 ||
             priv_delset(pset, PRIV_PROC_SESSION) != 0)
diff --git a/openbsd-compat/port-solaris.h b/openbsd-compat/port-solaris.h
index b077e186a..3a41ea8cd 100644
--- a/openbsd-compat/port-solaris.h
+++ b/openbsd-compat/port-solaris.h
@@ -26,8 +26,11 @@ void solaris_contract_pre_fork(void);
 void solaris_contract_post_fork_child(void);
 void solaris_contract_post_fork_parent(pid_t pid);
 void solaris_set_default_project(struct passwd *);
+# ifdef USE_SOLARIS_PRIVS
+priv_set_t *solaris_basic_privset(void);
 void solaris_drop_privs_pinfo_net_fork_exec(void);
 void solaris_drop_privs_root_pinfo_net(void);
 void solaris_drop_privs_root_pinfo_net_exec(void);
+# endif /* USE_SOLARIS_PRIVS */
 
 #endif