bastionguard_privhelper.cpp File Reference

Go to the source code of this file.

Classes
struct	anonymous_namespace{bastionguard_privhelper.cpp}::CallerIdentity

Namespaces
namespace	anonymous_namespace{bastionguard_privhelper.cpp}

Functions
bool	anonymous_namespace{bastionguard_privhelper.cpp}::parse_uid (const char *value, uid_t &out)
CallerIdentity	anonymous_namespace{bastionguard_privhelper.cpp}::resolve_caller_identity ()
bool	anonymous_namespace{bastionguard_privhelper.cpp}::runtime_dir_is_safe (uid_t uid, const std::string &path)
bool	anonymous_namespace{bastionguard_privhelper.cpp}::drop_to_caller (const CallerIdentity &caller)
std::vector< char * >	anonymous_namespace{bastionguard_privhelper.cpp}::make_exec_argv (const std::vector< std::string > &args)
bool	anonymous_namespace{bastionguard_privhelper.cpp}::run_as_caller (const CallerIdentity &caller, const std::vector< std::string > &args, std::string *output=nullptr)
std::string	anonymous_namespace{bastionguard_privhelper.cpp}::find_pw_cli ()
bool	anonymous_namespace{bastionguard_privhelper.cpp}::is_decimal_id (const std::string &value)
std::vector< std::string >	anonymous_namespace{bastionguard_privhelper.cpp}::parse_video_node_ids (const std::string &listing)
bool	anonymous_namespace{bastionguard_privhelper.cpp}::set_pipewire_camera_state (const CallerIdentity &caller, bool disabled)
bool	anonymous_namespace{bastionguard_privhelper.cpp}::is_video_device_name (const std::string &name)
bool	anonymous_namespace{bastionguard_privhelper.cpp}::ensure_state_directory ()
int	anonymous_namespace{bastionguard_privhelper.cpp}::open_video_device (int dev_dir_fd, const std::string &name, struct stat &st)
bool	anonymous_namespace{bastionguard_privhelper.cpp}::block_v4l2_devices ()
bool	anonymous_namespace{bastionguard_privhelper.cpp}::restore_legacy_v4l2_modes ()
bool	anonymous_namespace{bastionguard_privhelper.cpp}::restore_v4l2_devices ()
int	main (int argc, char *argv[])

Variables
constexpr const char *	anonymous_namespace{bastionguard_privhelper.cpp}::kStateDir = "/run/bastionguard"
constexpr const char *	anonymous_namespace{bastionguard_privhelper.cpp}::kStateFile = "/run/bastionguard/camera-device-modes"
constexpr std::size_t	anonymous_namespace{bastionguard_privhelper.cpp}::kMaxPipewireOutput = 1024U * 1024U

Function Documentation

main()

int main	(	int	argc,
		char *	argv[] )

Definition at line 537 of file bastionguard_privhelper.cpp.

{
    const uid_t real_uid = getuid();
    const uid_t effective_uid = geteuid();
    const CallerIdentity caller = resolve_caller_identity();
 
    // A setuid installation is explicitly unsupported. Privilege must be
    // granted by pkexec/sudo so the authorization step remains visible.
    if (effective_uid == 0 && real_uid != 0) {
        std::cerr << "[Privacy] Refusing setuid execution; use pkexec or sudo\n";
        return 11;
    }
 
    clearenv();
    setenv("PATH", "/usr/sbin:/usr/bin:/sbin:/bin", 1);
 
    if (effective_uid != 0) {
        std::cerr << "[Privacy] This helper must be executed as root via pkexec or sudo\n";
        return 10;
    }
 
    if (argc != 2) {
        std::cerr << "Usage: " << argv[0] << " block|unblock\n";
        return 1;
    }
 
    const std::string action(argv[1]);
 
    if (action == "block") {
        if (set_pipewire_camera_state(caller, true))
            return 0;
        return block_v4l2_devices() ? 0 : 5;
    }
 
    if (action == "unblock") {
        const bool pipewire_ok = set_pipewire_camera_state(caller, false);
        const bool v4l2_ok = restore_v4l2_devices();
        return (pipewire_ok || v4l2_ok) ? 0 : 5;
    }
 
    std::cerr << "[Privacy] Invalid command: " << action << "\n";
    return 2;
}

References anonymous_namespace{bastionguard_privhelper.cpp}::block_v4l2_devices(), main(), anonymous_namespace{bastionguard_privhelper.cpp}::resolve_caller_identity(), anonymous_namespace{bastionguard_privhelper.cpp}::restore_v4l2_devices(), and anonymous_namespace{bastionguard_privhelper.cpp}::set_pipewire_camera_state().