src/communication/security-server-comm.c
/* Authenticate peer that it's really security server.
 * Check UID that is root
 */
Authenticate peer that it's really security server.
Check UID that is root
Authenticate peer that it ' s really security server . Check UID that is root
int authenticate_server(int sockfd)
{
	int retval;
	struct ucred cr;
	unsigned int cl = sizeof(cr);
	if(getsockopt(sockfd, SOL_SOCKET, SO_PEERCRED, &cr, &cl) != 0)
	{
		retval = SECURITY_SERVER_ERROR_SOCKET;
		SEC_SVR_DBG("%s", "getsockopt() failed");
		goto error;
	}
	if(cr.uid != 0)
	{
		retval = SECURITY_SERVER_ERROR_AUTHENTICATION_FAILED;
		SEC_SVR_DBG("Peer is not root: uid=%d", cr.uid);
		goto error;
	}
	else
		retval = SECURITY_SERVER_SUCCESS;
error:
	return retval;
}
int authenticate_server ( int sockfd ) { int retval ; struct ucred cr ; unsigned int cl = sizeof ( cr ) ; if ( getsockopt ( sockfd , SOL_SOCKET , SO_PEERCRED , & cr , & cl ) != 0 ) { retval = SECURITY_SERVER_ERROR_SOCKET ; SEC_SVR_DBG ( " " , " " ) ; goto error ; } if ( cr . uid != 0 ) { retval = SECURITY_SERVER_ERROR_AUTHENTICATION_FAILED ; SEC_SVR_DBG ( " " , cr . uid ) ; goto error ; } else retval = SECURITY_SERVER_SUCCESS ; error : return retval ; }
Authenticate peer that it's really security server.
Authenticate peer that it ' s really security server .
/*	char *cmdline = NULL;*/ /* get socket peer credential */ /* Security server must run as root */ /* Read command line of the PID from proc fs */ /* This is commented out because non root process cannot read link of /proc/pid/exe */ /*	cmdline = read_cmdline_from_proc(cr.pid);

	if(strcmp(cmdline, SECURITY_SERVER_DAEMON_PATH) != 0)
	{
		retval = SECURITY_SERVER_ERROR_AUTHENTICATION_FAILED;
		SEC_SVR_DBG("Cmdline is different. auth failed. cmdline=%s", cmdline);
	}
	else
	{
		retval = SECURITY_SERVER_SUCCESS;
		SEC_SVR_DBG("Server authenticatd. %s, sockfd=%d", cmdline, sockfd);
	}
*/ /*	if(cmdline != NULL)
		free(cmdline);
*/