FreeBSD Manual Pages
UID_WRAPPER(1) UID_WRAPPER(1) NAME uid_wrapper - A wrapper to fake privilege separation SYNOPSIS LD_PRELOAD=libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT=1 ./myapplica- tion DESCRIPTION * Allows uid switching as a normal user. * Start any application making it believe it is running as root. * Support for user/group changing in the local thread using the syscalls (like glibc). * More precisely this library intercepts seteuid and related calls, and simulates them in a manner similar to the nss_wrapper and socket_wrap- per libraries. Some projects like a file server need privilege separation to be able to switch to the connection user and do file operations. uid_wrapper convinc- ingly lies to the application letting it believe it is operating as root and even switching between UIDs and GIDs as needed. ENVIRONMENT VARIABLES UID_WRAPPER If you load the uid_wrapper and enable it with setting UID_WRAPPER=1 all setuid and setgid will work, even as a normal user. UID_WRAPPER_ROOT It is possible to start your application as fake root with setting UID_WRAPPER_ROOT=1. UID_WRAPPER_DEBUGLEVEL If you need to see what is going on in uid_wrapper itself or try to find a bug, you can enable logging support in uid_wrapper if you built it with debug symbols. * 0 = ERROR * 1 = WARNING * 2 = DEBUG * 3 = TRACE UID_WRAPPER_MYUID This environment variable can be used to tell uid_wrapper to let ge- teuid() return the real (instead of the faked) UID of the user who started the process with uid_wrapper. uid_t uid; setenv("UID_WRAPPER_MYUID", "1", 1); uid = geteuid(); unsetenv("UID_WRAPPER_MYUID"); UID_WRAPPER_DISABLE_DEEPBIND This allows you to disable deep binding in uid_wrapper. This is useful for running valgrind tools or sanitizers like (address, undefined, thread). EXAMPLE $ LD_PRELOAD=libuid_wrapper.so UID_WRAPPER=1 UID_WRAPPER_ROOT=1 id uid=0(root) gid=0(root) 0(root) WORKAROUNDS If you need to write code that behaves differently depending on whether uid_wrapper is enabled or not, for example in cases where you have to file permissions, you can predefine the uid_wrapper_enabled() function in your project as follows: bool uid_wrapper_enabled(void) { return false; } Since uid_wrapper overloads this function if enabled, you can use it in your code to detect uid_wrapper. 2015-11-03 UID_WRAPPER(1)
NAME | SYNOPSIS | DESCRIPTION | ENVIRONMENT VARIABLES | EXAMPLE | WORKAROUNDS
Want to link to this manual page? Use this URL:
<https://man.freebsd.org/cgi/man.cgi?query=uid_wrapper&sektion=1&manpath=FreeBSD+Ports+15.1.quarterly>