core: check suid/sgid dynamically instead of checking file
All checks were successful
Build and test / check (push) Successful in 1m41s
Build and test / test (push) Successful in 3m5s
Build and test / check-license (push) Successful in 5m56s
Build and test / docs (push) Successful in 5m29s
Build and test / build (push) Successful in 3m9s

This commit is contained in:
2025-12-04 20:29:44 +09:00
parent eeef8bd546
commit 222941509d
4 changed files with 17 additions and 25 deletions

View File

@@ -16,7 +16,7 @@ use futures_util::StreamExt;
use crate::{
core::{
bootstrap::bootstrap_server_connection_and_drop_privileges,
common::{ASCII_BANNER, KIND_REGARDS, executable_is_suid_or_sgid},
common::{ASCII_BANNER, KIND_REGARDS, executing_in_suid_sgid_mode},
protocol::{Response, create_client_to_server_message_stream},
},
server::{command::ServerArgs, landlock::landlock_restrict_server},
@@ -151,7 +151,7 @@ fn main() -> anyhow::Result<()> {
fn handle_dynamic_completion() -> anyhow::Result<Option<()>> {
if std::env::var_os("COMPLETE").is_some() {
#[cfg(feature = "suid-sgid-mode")]
if executable_is_suid_or_sgid()? {
if executing_in_suid_sgid_mode()? {
use crate::core::bootstrap::drop_privs;
drop_privs()?
}
@@ -202,7 +202,7 @@ fn handle_server_command(args: &Args) -> anyhow::Result<Option<()>> {
match args.command {
Command::Server(ref command) => {
assert!(
!executable_is_suid_or_sgid()?,
!executing_in_suid_sgid_mode()?,
"The executable should not be SUID or SGID when running the server manually"
);