diff -upk.orig tcptraceroute-1.5beta7.orig/Makefile.am tcptraceroute-1.5beta7/Makefile.am

--- tcptraceroute-1.5beta7.orig/Makefile.am	2004-12-27 23:57:56 +0000

+++ tcptraceroute-1.5beta7/Makefile.am	2005-01-03 16:48:23 +0000

@@ -1,5 +1,5 @@

 bin_PROGRAMS = tcptraceroute

-tcptraceroute_SOURCES = main.c datalink.c util.c probe.c capture.c

+tcptraceroute_SOURCES = main.c datalink.c util.c probe.c capture.c droppriv.c

 man_MANS = tcptraceroute.1

 docdir = $(datadir)/doc/tcptraceroute

diff -upk.orig tcptraceroute-1.5beta7.orig/configure.ac tcptraceroute-1.5beta7/configure.ac

--- tcptraceroute-1.5beta7.orig/configure.ac	2004-12-28 03:40:54 +0000

+++ tcptraceroute-1.5beta7/configure.ac	2005-01-03 16:44:57 +0000

@@ -24,6 +24,7 @@ AC_CHECK_FUNC(gethostbyname, ,[AC_CHECK_

 AC_CHECK_FUNC(socket, ,[AC_CHECK_LIB(socket, socket)])

 AC_CHECK_FUNC(connect, ,[AC_CHECK_LIB(inet, connect)])

 AC_CHECK_FUNC(inet_aton, ,[AC_CHECK_LIB(resolv, inet_aton)])

+AC_CHECK_LIB(cap, cap_from_text, ,[AC_MSG_ERROR([cannot find libcap])])

 AC_ARG_WITH(pcap, [],

 	[

diff -upk.orig tcptraceroute-1.5beta7.orig/droppriv.c tcptraceroute-1.5beta7/droppriv.c

--- tcptraceroute-1.5beta7.orig/droppriv.c	1970-01-01 00:00:00 +0000

+++ tcptraceroute-1.5beta7/droppriv.c	2006-03-29 16:36:08 +0000

@@ -0,0 +1,101 @@

+#ifdef HAVE_CONFIG_H

+# include "config.h"

+#endif

+

+#include <stdlib.h>

+#include <error.h>

+#include <errno.h>

+#include <unistd.h>

+#include <pwd.h>

+#include <grp.h>

+

+#include <sys/capability.h>

+#include <sys/prctl.h>

+

+#include "droppriv.h"

+

+uid_t user_uid = -1;

+

+void

+priv_minimize(void)

+{

+	const char *dir = "/var/resolv";

+	cap_t   caps;

+	uid_t   uid;

+	gid_t   gid;

+

+	user_uid = getuid();

+	if (user_uid && geteuid())

+		return;

+

+	if (setgroups(0, NULL) < 0)

+		error(EXIT_FAILURE, errno, "setgroups");

+

+	if (prctl(PR_SET_KEEPCAPS, 1))

+		error(EXIT_FAILURE, errno, "prctl PR_SET_KEEPCAPS failed");

+

+	if (user_uid == 0)

+	{

+		const char user[] = "iputils";

+		struct passwd *pw = getpwnam(user);

+

+		if (!pw)

+			error(EXIT_FAILURE, 0, "lookup of user \"%s\" failed",

+			      user);

+

+		gid = pw->pw_gid;

+		uid = pw->pw_uid;

+		endpwent();

+

+		if (uid == 0)

+			error(EXIT_FAILURE, 0,

+			      "user \"%s\" shouldn't be root", user);

+	} else

+	{

+		uid = user_uid;

+		gid = getgid();

+	}

+

+	if (chroot(dir) < 0 || chdir("/") < 0)

+		error(EXIT_FAILURE, errno, "chroot to \"%s\" failed", dir);

+

+	if (setgid(gid) < 0)

+		error(EXIT_FAILURE, errno, "setgid");

+

+	caps = cap_from_text

+		("cap_setuid,cap_net_raw,cap_net_bind_service=ep");

+	if (!caps)

+		error(EXIT_FAILURE, errno, "cap_from_text failed");

+

+	if (cap_set_proc(caps) < 0)

+		error(EXIT_FAILURE, errno, "cap_set_proc failed");

+

+	cap_free(caps);

+

+	if (setreuid(uid, uid) < 0)

+		error(EXIT_FAILURE, errno, "setreuid");

+

+	caps = cap_from_text("cap_net_raw,cap_net_bind_service=ep");

+	if (!caps)

+		error(EXIT_FAILURE, errno, "cap_from_text failed");

+

+	if (cap_set_proc(caps) < 0)

+		error(EXIT_FAILURE, errno, "cap_set_proc failed");

+

+	cap_free(caps);

+}

+

+void

+priv_drop(void)

+{

+	cap_t   caps;

+

+	caps = cap_from_text("all-ep");

+	if (!caps)

+		error(EXIT_FAILURE, errno, "cap_from_text failed");

+

+	if (cap_set_proc(caps) < 0)

+		error(EXIT_FAILURE, errno, "cap_set_proc failed");

+

+	cap_free(caps);

+}

diff -upk.orig tcptraceroute-1.5beta7.orig/droppriv.h tcptraceroute-1.5beta7/droppriv.h

--- tcptraceroute-1.5beta7.orig/droppriv.h	1970-01-01 00:00:00 +0000

+++ tcptraceroute-1.5beta7/droppriv.h	2005-01-03 16:44:57 +0000

@@ -0,0 +1,12 @@

+#ifndef TCPTRACEROUTE_DROPPRIV_H__

+#define TCPTRACEROUTE_DROPPRIV_H__

+

+#include <sys/types.h>

+

+extern void priv_minimize(void);

+extern void priv_drop(void);

+

+extern uid_t user_uid;

+

+#endif /* TCPTRACEROUTE_DROPPRIV_H__ */

+

diff -upk.orig tcptraceroute-1.5beta7.orig/main.c tcptraceroute-1.5beta7/main.c

--- tcptraceroute-1.5beta7.orig/main.c	2006-03-29 16:28:44 +0000

+++ tcptraceroute-1.5beta7/main.c	2006-03-29 16:34:22 +0000

@@ -21,6 +21,7 @@

  */

 #include "tcptraceroute.h"

+#include "droppriv.h"

 /* globals */

 u_long dst_ip, src_ip, isn;

@@ -249,6 +250,8 @@ int main(int argc, char **argv)

 	char *optstring, *s;

 	int op, i, exitcode;

+	priv_minimize();

+

 	src_ip	= 0;

 	src_prt = 0;

 	dst_prt	= DEFAULT_PORT;

@@ -449,7 +452,7 @@ int main(int argc, char **argv)

 			case 'P': /* ARG */

 				o_forceport = 1;

 			case 'p': /* ARG */

-				if (getuid()) fatal("Sorry, must be root to use -p\n");

+				if (user_uid) fatal("Sorry, must be root to use -p\n");

 				src_prt = checknumericarg();

 				debug("src_prt set to %d\n", src_prt);

 				break;

@@ -465,7 +468,7 @@ int main(int argc, char **argv)

 				break;

 			case 's': /* ARG */

-				if (getuid()) fatal("Sorry, must be root to use -s\n");

+				if (user_uid) fatal("Sorry, must be root to use -s\n");

 				src = optarg;

 				break;

@@ -527,13 +530,10 @@ int main(int argc, char **argv)

 			show_usage("Invalid number of arguments");

 	}

-	if (getuid() & geteuid())

-		fatal("Got root?\n");

-

 	initlibnet();

 	defaults();

 	initcapture();

-	setuid(getuid());

+	priv_drop();

 	exitcode = trace();

 #if (LIBNET_API_VERSION >= 110)

 	libnet_destroy(libnet_context);