diff options
| -rw-r--r-- | man/strongswan.conf.5.in | 6 | ||||
| -rw-r--r-- | src/charon-nm/charon-nm.c | 25 | ||||
| -rw-r--r-- | src/charon/charon.c | 23 |
3 files changed, 42 insertions, 12 deletions
diff --git a/man/strongswan.conf.5.in b/man/strongswan.conf.5.in index 065bb1c4d..fd8e2f216 100644 --- a/man/strongswan.conf.5.in +++ b/man/strongswan.conf.5.in @@ -174,6 +174,9 @@ used certificates. Maximum size (in bytes) of a sent fragment when using the proprietary IKEv1 fragmentation extension. .TP +.BR charon.group +Name of the group the daemon changes to after startup +.TP .BR charon.half_open_timeout " [30]" Timeout in seconds for connecting IKE_SAs (also see IKE_SA_INIT DROPPING). .TP @@ -317,6 +320,9 @@ Section to define syslog loggers, see LOGGER CONFIGURATION .TP .BR charon.threads " [16]" Number of worker threads in charon +.TP +.BR charon.user +Name of the user the daemon changes to after startup .SS charon.plugins subsection .TP .BR charon.plugins.android_log.loglevel " [1]" diff --git a/src/charon-nm/charon-nm.c b/src/charon-nm/charon-nm.c index 8e44589e5..9ce6dbaeb 100644 --- a/src/charon-nm/charon-nm.c +++ b/src/charon-nm/charon-nm.c @@ -29,6 +29,17 @@ #include <nm/nm_backend.h> /** + * Default user and group + */ +#ifndef IPSEC_USER +#define IPSEC_USER NULL +#endif + +#ifndef IPSEC_GROUP +#define IPSEC_GROUP NULL +#endif + +/** * Hook in library for debugging messages */ extern void (*dbg) (debug_t group, level_t level, char *fmt, ...); @@ -121,18 +132,20 @@ static void segv_handler(int signal) */ static bool lookup_uid_gid() { -#ifdef IPSEC_USER - if (!lib->caps->resolve_uid(lib->caps, IPSEC_USER)) + char *name; + + name = lib->settings->get_str(lib->settings, "charon-nm.user", + IPSEC_USER); + if (name && !lib->caps->resolve_uid(lib->caps, name)) { return FALSE; } -#endif -#ifdef IPSEC_GROUP - if (!lib->caps->resolve_gid(lib->caps, IPSEC_GROUP)) + name = lib->settings->get_str(lib->settings, "charon-nm.group", + IPSEC_GROUP); + if (name && !lib->caps->resolve_gid(lib->caps, name)) { return FALSE; } -#endif return TRUE; } diff --git a/src/charon/charon.c b/src/charon/charon.c index 8a8d0122c..340f852cd 100644 --- a/src/charon/charon.c +++ b/src/charon/charon.c @@ -44,6 +44,17 @@ #define PID_FILE IPSEC_PIDDIR "/charon.pid" /** + * Default user and group + */ +#ifndef IPSEC_USER +#define IPSEC_USER NULL +#endif + +#ifndef IPSEC_GROUP +#define IPSEC_GROUP NULL +#endif + +/** * Global reference to PID file (required to truncate, if undeletable) */ static FILE *pidfile = NULL; @@ -148,18 +159,18 @@ static void run() */ static bool lookup_uid_gid() { -#ifdef IPSEC_USER - if (!lib->caps->resolve_uid(lib->caps, IPSEC_USER)) + char *name; + + name = lib->settings->get_str(lib->settings, "charon.user", IPSEC_USER); + if (name && !lib->caps->resolve_uid(lib->caps, name)) { return FALSE; } -#endif -#ifdef IPSEC_GROUP - if (!lib->caps->resolve_gid(lib->caps, IPSEC_GROUP)) + name = lib->settings->get_str(lib->settings, "charon.group", IPSEC_GROUP); + if (name && !lib->caps->resolve_gid(lib->caps, name)) { return FALSE; } -#endif #ifdef ANDROID lib->caps->set_uid(lib->caps, AID_VPN); #endif |