From 699f821e12c8793b8cc313312eac384223028b61 Mon Sep 17 00:00:00 2001
From: Archana Shinde <archana.m.shinde@intel.com>
Date: Thu, 13 Oct 2022 17:35:43 -0700
Subject: [PATCH] utils: Add function to drop priveleges

This function is meant to be used before operations
such as accessing network to make sure those operations
are not performed as a privilged user.

Fixes: #5331

Signed-off-by: Archana Shinde <archana.m.shinde@intel.com>
---
 src/tools/kata-ctl/Cargo.toml   |  2 ++
 src/tools/kata-ctl/src/main.rs  |  1 +
 src/tools/kata-ctl/src/utils.rs | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 36 insertions(+)
 create mode 100644 src/tools/kata-ctl/src/utils.rs

diff --git a/src/tools/kata-ctl/Cargo.toml b/src/tools/kata-ctl/Cargo.toml
index 094613c34..a6701ddbd 100644
--- a/src/tools/kata-ctl/Cargo.toml
+++ b/src/tools/kata-ctl/Cargo.toml
@@ -15,6 +15,8 @@ clap = { version = "3.2.20", features = ["derive", "cargo"] }
 reqwest = { version = "0.11", default-features = false, features = ["json", "blocking", "rustls-tls"] }
 serde_json = "1.0.85"
 thiserror = "1.0.35"
+privdrop = "0.5.2"
+nix = "0.25.0"
 
 [dev-dependencies]
 semver = "1.0.12"
diff --git a/src/tools/kata-ctl/src/main.rs b/src/tools/kata-ctl/src/main.rs
index 30e4b5eb7..df3e0d7e7 100644
--- a/src/tools/kata-ctl/src/main.rs
+++ b/src/tools/kata-ctl/src/main.rs
@@ -7,6 +7,7 @@ mod arch;
 mod args;
 mod check;
 mod ops;
+mod utils;
 
 use anyhow::Result;
 use clap::Parser;
diff --git a/src/tools/kata-ctl/src/utils.rs b/src/tools/kata-ctl/src/utils.rs
new file mode 100644
index 000000000..86b22a4bf
--- /dev/null
+++ b/src/tools/kata-ctl/src/utils.rs
@@ -0,0 +1,33 @@
+// Copyright (c) 2022 Intel Corporation
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+
+#![allow(dead_code)]
+
+use anyhow::{anyhow, Result};
+
+const NON_PRIV_USER: &str = "nobody";
+
+pub fn drop_privs() -> Result<()> {
+    if nix::unistd::Uid::effective().is_root() {
+        privdrop::PrivDrop::default()
+            .chroot("/")
+            .user(NON_PRIV_USER)
+            .apply()
+            .map_err(|e| anyhow!("Failed to drop privileges to user {}: {}", NON_PRIV_USER, e))?;
+    }
+
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn test_drop_privs() {
+        let res = drop_privs();
+        assert!(res.is_ok());
+    }
+}