In a C program, I have to deal with RLIMIT_NPROC
and RLIMIT_NOFILE
limits and additionally bind to a port less than 1024. I am thinking to run this under an unprivileged user since my program needs only two capabilities.
I saw here that I can set capabilities for the process and then drop root privileges using setuid()
. Now, if I fork the process that will keep the set list of capabilities with it, without root privileges, then my program will be kept running with minimal privileges.
A very rough overview of my planning:
int main()
{
int nproc,nfds,port;
/*
* set capabilities to the process
* then drop priviales
*/
setuid(getuid()); //Drop privilages to real user id
fork() //Now create a child apparantly which will be having parents set capabilties
/*Now do tasks to which the whole is being played*/
set_nproclimit(nproc);
set_nofilelimit(nfds);
do_bind_to_port(port);
return 0;
}
Here I am lacking to use any syscall to set capabilities. Any idea of such functions will be great help.
PS: I am able to assign caps through command utility setcap
and also using cap_set_file()
but i want to do this in other way because I am not every time sure about path of binary.
Some helpful proc commands to check process & sub process's status cat /proc/<PID>/task/<PID>/status
, cat /proc/<PID>/limits