From a9fea6fee334f7968fdaca363e5e8cd0a8448fc4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Juhani=20Krekel=C3=A4?= <juhani@krekelä.fi>
Date: Fri, 5 Jul 2019 14:49:18 +0300
Subject: [PATCH] Drop privs when possible

---
 ethertype-dump.c | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/ethertype-dump.c b/ethertype-dump.c
index 27c4fa2..95063d5 100644
--- a/ethertype-dump.c
+++ b/ethertype-dump.c
@@ -1,3 +1,4 @@
+#define _GNU_SOURCE
 #include <arpa/inet.h>
 #include <assert.h>
 #include <err.h>
@@ -30,6 +31,20 @@ void format_mac(const unsigned char binary_address[6], char formatted[18]) {
 	formatted[17] = '\0';
 }
 
+void drop_privileges(void) {
+	uid_t uid = getuid();
+	gid_t gid = getgid();
+
+	errno = 0;
+	if (setresgid(gid, gid, gid) == -1) {
+		err(1, "setresgid");
+	}
+	errno = 0;
+	if (setresuid(uid, uid, uid) == -1) {
+		err(1, "setresuid");
+	}
+}
+
 int main(int argc, char **argv) {
 	if (argc != 2) {
 		fprintf(stderr, "Usage: %s interface\n", argv[0]);
@@ -43,6 +58,9 @@ int main(int argc, char **argv) {
 		err(1, "socket");
 	}
 
+	// Only creating the socket requires root privs
+	drop_privileges();
+
 	// Find the index of the network interface
 	struct ifreq ifr;
 	strncpy(ifr.ifr_name, argv[1], IFNAMSIZ);