Re: Using certificates and keys from a list
Seo Suchan <[email protected]> Thu, 09 Apr 2026 08:37:24 +0900
| Newsgroups | gmane.comp.encryption.openssl.user |
|---|---|
| Message-ID | <[email protected]> |
------DJ4MD1WGH2RPZ0XQ8G6489ZFG6M58V Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Wouldn't it defeat perpose of dropping privilege in first place if code can= call function to raise its privilege back to root? On 2026=EB=85=84 4=EC=9B=94 9=EC=9D=BC =EC=98=A4=EC=A0=84 7=EC=8B=9C 24=EB= =B6=84 14=EC=B4=88 GMT+09:00, Doug Hardie <[email protected]> =EC=9E=91=EC=84= =B1=ED=95=A8: >I implemented all that code to load the certificates and keys and it worke= d just fine. However, once I set the keys to 0600, it no longer worked. T= he reason is that the startup code that runs as root is quite small. It do= esn't know which keys will be required. In fact, those keys might not even= exist yet. They can be added at any time. Hence, the app needs to read t= he keys after the uid has been changed to the unprivileged uid. > >The solution turns out to be changing the setuid to seteuid to the unprivi= leged user, and then when the connection is starting, in the SSL_CTX_set_cl= ient_hello_cb routine, use seteuid (0) to go back to root. After the certi= ficate and key are loaded use seteuid to go back to the unprivileged user. = This is on FreeBSD. There is a similar, but different implementation for = Linux. > >-- Doug > > >--=20 >You received this message because you are subscribed to the Google Groups = "openssl-users" group. >To unsubscribe from this group and stop receiving emails from it, send an = email to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org >To view this discussion visit https://groups.google.com/a/openssl.org/d/ms= gid/openssl-users/09BABC0E-35C8-4964-9677-5129903D269A%40sermon-archive.inf= o. --=20 You received this message because you are subscribed to the Google Groups "= openssl-users" group. To unsubscribe from this group and stop receiving emails from it, send an e= mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org To view this discussion visit https://groups.google.com/a/openssl.org/d/msg= id/openssl-users/C3660D4E-70D8-4C4E-8B20-CF5E318436BB%40gmail.com. ------DJ4MD1WGH2RPZ0XQ8G6489ZFG6M58V Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable <html><head></head><body><div dir=3D"auto">Wouldn't it defeat perpose of dr= opping privilege in first place if code can call function to raise its priv= ilege back to root?</div><br><br><div class=3D"gmail_quote"><div dir=3D"aut= o">On 2026=EB=85=84 4=EC=9B=94 9=EC=9D=BC =EC=98=A4=EC=A0=84 7=EC=8B=9C 24= =EB=B6=84 14=EC=B4=88 GMT+09:00, Doug Hardie <[email protected]> =EC=9E= =91=EC=84=B1=ED=95=A8:</div><blockquote class=3D"gmail_quote" style=3D"marg= in: 0pt 0pt 0pt 0.8ex; border-left: 1px solid rgb(204, 204, 204); padding-l= eft: 1ex;"> <pre class=3D"com-fsck-k9__plain-text-message-pre"><div dir=3D"auto">I impl= emented all that code to load the certificates and keys and it worked just = fine. However, once I set the keys to 0600, it no longer worked. The reas= on is that the startup code that runs as root is quite small. It doesn't k= now which keys will be required. In fact, those keys might not even exist = yet. They can be added at any time. Hence, the app needs to read the keys= after the uid has been changed to the unprivileged uid.<br><br>The solutio= n turns out to be changing the setuid to seteuid to the unprivileged user, = and then when the connection is starting, in the SSL_CTX_set_client_hello_c= b routine, use seteuid (0) to go back to root. After the certificate and k= ey are loaded use seteuid to go back to the unprivileged user. This is on = FreeBSD. There is a similar, but different implementation for Linux.<br><b= r>-- Doug<br><br><br></div></pre></blockquote></div></body></html> <p></p> -- <br /> You received this message because you are subscribed to the Google Groups &= quot;openssl-users" group.<br /> To unsubscribe from this group and stop receiving emails from it, send an e= mail to <a href=3D"mailto:openssl-users+unsubscribe-MCmKBN63+BlAfugRpC6u6w@public.gmane.org">openssl-us= [email protected]</a>.<br /> To view this discussion visit <a href=3D"https://groups.google.com/a/openss= l.org/d/msgid/openssl-users/C3660D4E-70D8-4C4E-8B20-CF5E318436BB%40gmail.co= m?utm_medium=3Demail&utm_source=3Dfooter">https://groups.google.com/a/opens= sl.org/d/msgid/openssl-users/C3660D4E-70D8-4C4E-8B20-CF5E318436BB%40gmail.c= om</a>.<br /> ------DJ4MD1WGH2RPZ0XQ8G6489ZFG6M58V--