totpm 0.1.2

A TPM-backed command line TOTP/2FA client, using fprintd for user presence verification.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

#[link(name = "c")]
extern "C" {
    fn setresuid(ruid: u32, euid: u32, suid: u32) -> u32;
    fn getuid() -> u32;
    fn getgid() -> u32;
    fn geteuid() -> u32;
    fn seteuid(uid: u32) -> u32;
    fn setegid(uid: u32) -> u32;
}

/// Set all UIDs to our real UID, dropping any SUID-acquired privileges.
/// Returns true if dropping privileges succeeded, otherwise false.
pub fn drop_privileges() -> bool {
    log::info!("permanently dropping privileges");
    unsafe {
        let euid = geteuid();

        // Drop privileges
        let gid = getgid();
        let uid = getuid();
        setegid(gid);
        setresuid(uid, uid, uid);
        
        // Ensure we can't change back to our old EUID
        seteuid(euid);
        geteuid() == uid
    }
}

/// Temporarily assume our real UID as our effective UID.
pub fn with_uid_as_euid<T, F: FnOnce() -> T>(f: F) -> T {
    unsafe {
        let uid = getuid();
        let euid = geteuid();
        log::info!("setting euid to {} (was {})", uid, euid);
        seteuid(uid);
        let result = f();
        log::info!("restoring euid to {} (was {})", euid, uid);
        seteuid(euid);
        result
    }
}

pub fn is_root() -> bool {
    unsafe {
        getuid() == 0
    }
}

pub fn is_effective_user(uid: u32) -> bool {
    unsafe {
        geteuid() == uid
    }
}