1 files changed, 79 insertions, 58 deletions

diff --git a/src/firemon/firemon.c b/src/firemon/firemon.c
index 3140c5f70..b63e37444 100644
--- a/src/firemon/firemon.c
+++ b/src/firemon/firemon.c
@@ -25,7 +25,6 @@
 #include <grp.h>
 #include <sys/stat.h>
  
-
 static int arg_route = 0;
 static int arg_arp = 0;
 static int arg_tree = 0;
@@ -35,6 +34,9 @@ static int arg_caps = 0;
 static int arg_cpu = 0;
 static int arg_cgroup = 0;
 static int arg_x11 = 0;
+static int arg_top = 0;
+static int arg_list = 0;
+static int arg_netstats = 0;
 int arg_nowrap = 0;
 
 static struct termios tlocal;   // startup terminal setting
@@ -62,17 +64,6 @@ int find_child(int id) {
         return -1;
 }
 
-// drop privileges
-void firemon_drop_privs(void) {
-        // drop privileges
-        if (setgroups(0, NULL) < 0)
-                errExit("setgroups");
-        if (setgid(getgid()) < 0)
-                errExit("setgid/getgid");
-        if (setuid(getuid()) < 0)
-                errExit("setuid/getuid");
-}
-
 // sleep and wait for a key to be pressed
 void firemon_sleep(int st) {
         if (terminal_set == 0) {
@@ -129,53 +120,44 @@ int main(int argc, char **argv) {
                 }
                 
                 // options without a pid argument
-                else if (strcmp(argv[i], "--top") == 0) {
-                        top(); // never to return
-                }
-                else if (strcmp(argv[i], "--list") == 0) {
-                        list();
-                        return 0;
-                }
+                else if (strcmp(argv[i], "--top") == 0)
+                        arg_top = 1;
+                else if (strcmp(argv[i], "--list") == 0)
+                        arg_list = 1;
+                else if (strcmp(argv[i], "--tree") == 0)
+                        arg_tree = 1;
                 else if (strcmp(argv[i], "--netstats") == 0) {
                         struct stat s;
                         if (getuid() != 0 && stat("/proc/sys/kernel/grsecurity", &s) == 0) {
                                 fprintf(stderr, "Error: this feature is not available on Grsecurity systems\n");
                                 exit(1);
                         }       
-
-                        netstats();
-                        return 0;
+                        arg_netstats = 1;
                 }
 
 
                 // cumulative options with or without a pid argument
-                else if (strcmp(argv[i], "--x11") == 0) {
+                else if (strcmp(argv[i], "--x11") == 0)
                         arg_x11 = 1;
-                }
-                else if (strcmp(argv[i], "--cgroup") == 0) {
+                else if (strcmp(argv[i], "--cgroup") == 0)
                         arg_cgroup = 1;
-                }
-                else if (strcmp(argv[i], "--cpu") == 0) {
+                else if (strcmp(argv[i], "--cpu") == 0)
                         arg_cpu = 1;
-                }
-                else if (strcmp(argv[i], "--seccomp") == 0) {
+                else if (strcmp(argv[i], "--seccomp") == 0)
                         arg_seccomp = 1;
-                }
-                else if (strcmp(argv[i], "--caps") == 0) {
+                else if (strcmp(argv[i], "--caps") == 0)
                         arg_caps = 1;
-                }
-                else if (strcmp(argv[i], "--tree") == 0) {
-                        arg_tree = 1;
-                }
                 else if (strcmp(argv[i], "--interface") == 0) {
+                        if (getuid() != 0) {
+                                fprintf(stderr, "Error: you need to be root to run this command\n");
+                                exit(1);
+                        }
                         arg_interface = 1;
                 }
-                else if (strcmp(argv[i], "--route") == 0) {
+                else if (strcmp(argv[i], "--route") == 0)
                         arg_route = 1;
-                }
-                else if (strcmp(argv[i], "--arp") == 0) {
+                else if (strcmp(argv[i], "--arp") == 0)
                         arg_arp = 1;
-                }
 
                 else if (strncmp(argv[i], "--name=", 7) == 0) {
                         char *name = argv[i] + 7;
@@ -212,27 +194,66 @@ int main(int argc, char **argv) {
                 }
         }
 
-        if (arg_tree)
+        // allow only root user if /proc is mounted hidepid
+        if (pid_hidepid() && getuid() != 0) {
+                fprintf(stderr, "Error: /proc is mounted hidepid, you would need to be root to run this command\n");
+                exit(1);
+        }
+        
+        if (arg_top) {
+                top(); 
+                return 0;
+        }
+        if (arg_list) {
+                list();
+                return 0;
+        }
+        if (arg_netstats) {
+                netstats();
+                return 0;               
+        }
+        
+        // cumulative options
+        int print_procs = 1;
+        if (arg_tree) {
                 tree((pid_t) pid);
-        if (arg_interface)
-                interface((pid_t) pid);
-        if (arg_route)
-                route((pid_t) pid);
-        if (arg_arp)
-                arp((pid_t) pid);
-        if (arg_seccomp)
-                seccomp((pid_t) pid);
-        if (arg_caps)
-                caps((pid_t) pid);
-        if (arg_cpu)
-                cpu((pid_t) pid);
-        if (arg_cgroup)
-                cgroup((pid_t) pid);
-        if (arg_x11)
-                x11((pid_t) pid);
+                print_procs = 0;
+        }
+        if (arg_cpu) {
+                cpu((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
+        if (arg_seccomp) {
+                seccomp((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
+        if (arg_caps) {
+                caps((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
+        if (arg_cgroup) {
+                cgroup((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
+        if (arg_x11) {
+                x11((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
+        if (arg_interface) {
+                interface((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
+        if (arg_route) {
+                route((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
+        if (arg_arp) {
+                arp((pid_t) pid, print_procs);
+                print_procs = 0;
+        }
         
-        if (!arg_route && !arg_arp && !arg_interface && !arg_tree && !arg_caps && !arg_seccomp && !arg_x11)
-                procevent((pid_t) pid); // never to return
+        if (print_procs)
+                procevent((pid_t) pid);
                 
         return 0;
 }