implement user switching

This was documented (incorrectly) and not implemented for either
the master/worker or single process cases.  Implement and test
all (with mocks, so not fully-tested).

1 files changed, 17 insertions, 0 deletions

diff --git a/lib/yahns/server.rb b/lib/yahns/server.rb
index fea310c..a2af745 100644
--- a/lib/yahns/server.rb
+++ b/lib/yahns/server.rb
@@ -10,6 +10,7 @@ class Yahns::Server # :nodoc:
                  :CHLD ]
   attr_accessor :daemon_pipe
   attr_accessor :logger
+  attr_writer :user
   attr_writer :worker_processes
   attr_writer :worker_atfork_prepare
   attr_writer :worker_atfork_parent
@@ -60,10 +61,26 @@ class Yahns::Server # :nodoc:
     if @worker_processes
       require 'yahns/server_mp'
       extend Yahns::ServerMP
+    else
+      switch_user(*@user) if @user
     end
     self
   end
 
+  def switch_user(user, group = nil)
+    # we do not protect the caller, checking Process.euid == 0 is
+    # insufficient because modern systems have fine-grained
+    # capabilities.  Let the caller handle any and all errors.
+    uid = Etc.getpwnam(user).uid
+    gid = Etc.getgrnam(group).gid if group
+    Yahns::Log.chown_all(uid, gid)
+    if gid && Process.egid != gid
+      Process.initgroups(user, gid)
+      Process::GID.change_privilege(gid)
+    end
+    Process.euid != uid and Process::UID.change_privilege(uid)
+  end
+
   def drop_acceptors
     @listeners.delete_if(&:ac_quit)
   end