privdrop

package

v0.11.0 Latest Latest Go to latest Published: Oct 2, 2026 License: Apache-2.0 Imports: 9 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/cloud-exit/exitmesh-agent

Links

Open Source Insights

Documentation ¶

Overview ¶

Package privdrop re-executes the process as an unprivileged user that keeps selected capabilities as ambient capabilities.

Index ¶

func Exec(t Target, path string, argv, env []string) error
type Identity
- func Current() (Identity, error)
- func (i Identity) Root() bool
type Target
- func ParseTarget(s string) (Target, error)

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func Exec ¶

func Exec(t Target, path string, argv, env []string) error

Exec switches the calling thread to t and executes path with argv and env in its place. It returns only on failure, after which the process must exit because the thread may hold a partial identity.

Types ¶

type Identity ¶

type Identity struct {
	UID          int      `json:"uid"`
	GID          int      `json:"gid"`
	Capabilities []string `json:"capabilities"`
}

Identity is the running process's user and effective capabilities.

func Current ¶

func Current() (Identity, error)

Current reads the identity of the running process from /proc/self/status.

func (Identity) Root ¶

func (i Identity) Root() bool

Root reports whether the process runs as UID 0.

type Target ¶

type Target struct {
	UID, GID int
	// Keep lists capability numbers (unix.CAP_*) the new process holds as ambient capabilities.
	Keep []int
}

Target is the identity to switch to.

func ParseTarget ¶

func ParseTarget(s string) (Target, error)

ParseTarget parses UID:GID; both must be non-zero.

Source Files ¶

View all Source files

privdrop.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL