DNSCrypt/dnscrypt-proxy
1
1
Fork 0
mirror of https://github.com/DNSCrypt/dnscrypt-proxy.git synced 2024-11-10 11:44:54 +03:00
Code Issues Packages Projects Releases Wiki Activity

Drop privileges early

Browse Source 
Fixes #1265
This commit is contained in:
Frank Denis 2020-04-20 12:27:53 +02:00
parent b6b7ed3a67
commit 6f2dcb900a
2 changed files with 17 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
dnscrypt-proxy/config.go
View File

@ -16,6 +16,7 @@ import (
"time"
"github.com/BurntSushi/toml"
"github.com/facebookgo/pidfile"
"github.com/jedisct1/dlog"
stamps "github.com/jedisct1/go-dnsstamps"
netproxy "golang.org/x/net/proxy"
@ -547,6 +548,22 @@ func ConfigLoad(proxy *Proxy, flags *ConfigFlags) error {
if err := NetProbe(netprobeAddress, netprobeTimeout); err != nil {
return err
}
for _, listenAddrStr := range proxy.listenAddresses {
proxy.addDNSListener(listenAddrStr)
}
for _, listenAddrStr := range proxy.localDoHListenAddresses {
proxy.addLocalDoHListener(listenAddrStr)
}
_ = pidfile.Write()
// if 'userName' is set and we are the parent process drop privilege and exit
if len(proxy.userName) > 0 && !proxy.child {
proxy.dropPrivilege(proxy.userName, FileDescriptors)
}
if err := proxy.SystemDListeners(); err != nil {
dlog.Fatal(err)
}
if !config.OfflineMode {
if err := config.loadSources(proxy); err != nil {
return err

14
dnscrypt-proxy/proxy.go
View File

@ -200,20 +200,6 @@ func (proxy *Proxy) StartProxy() {
for _, registeredServer := range proxy.registeredServers {
proxy.serversInfo.registerServer(registeredServer.name, registeredServer.stamp)
}
for _, listenAddrStr := range proxy.listenAddresses {
proxy.addDNSListener(listenAddrStr)
}
for _, listenAddrStr := range proxy.localDoHListenAddresses {
proxy.addLocalDoHListener(listenAddrStr)
}
// if 'userName' is set and we are the parent process drop privilege and exit
if len(proxy.userName) > 0 && !proxy.child {
proxy.dropPrivilege(proxy.userName, FileDescriptors)
}
if err := proxy.SystemDListeners(); err != nil {
dlog.Fatal(err)
}
liveServers, err := proxy.serversInfo.refresh(proxy)
if liveServers > 0 {
proxy.certIgnoreTimestamp = false