Re: Using certificates and keys from a list

> On Apr 8, 2026, at 16:37, Seo Suchan <[email protected]> wrote:
>=20
> Wouldn't it defeat perpose of dropping privilege in first place if code c=
an call function to raise its privilege back to root?
>=20
>=20
> On 2026=EB=85=84 4=EC=9B=94 9=EC=9D=BC =EC=98=A4=EC=A0=84 7=EC=8B=9C 24=
=EB=B6=84 14=EC=B4=88 GMT+09:00, Doug Hardie <[email protected]> =EC=9E=91=EC=
=84=B1=ED=95=A8:
> I implemented all that code to load the certificates and keys and it work=
ed just fine. However, once I set the keys to 0600, it no longer worked. Th=
e reason is that the startup code that runs as root is quite small. It does=
n't know which keys will be required. In fact, those keys might not even ex=
ist yet. They can be added at any time. Hence, the app needs to read the ke=
ys after the uid has been changed to the unprivileged uid.
>=20
> The solution turns out to be changing the setuid to seteuid to the unpriv=
ileged user, and then when the connection is starting, in the SSL_CTX_set_c=
lient_hello_cb routine, use seteuid (0) to go back to root. After the certi=
ficate and key are loaded use seteuid to go back to the unprivileged user. =
This is on FreeBSD. There is a similar, but different implementation for Li=
nux.

Not really.  It only raises privilege for just enough time to read the cert=
ificate and key.  That code is checked by me to ensure it does nothing unus=
ual.

-- Doug


--=20
You received this message because you are subscribed to the Google Groups "=
openssl-users" group.
To unsubscribe from this group and stop receiving emails from it, send an e=
mail to openssl-users+unsubscribe-MCmKBN63+Bmbup2nOX2J7Q@public.gmane.org
To view this discussion visit https://groups.google.com/a/openssl.org/d/msg=
id/openssl-users/17570E38-919A-47D5-8DA0-53248D5DD490%40sermon-archive.info=
.