main: add -Z to drop privileges after binding sockets

[JuliusBairaktaris]

uhttpd itself needs root only during startup, to bind the listeners and to
read the TLS key, and then keeps it for the process lifetime. -Z user drops
it once startup is done; without -Z nothing changes. Read before the drop,
the key stays root:root 0600. CGI children inherit the dropped uid, so a
handler needing root needs its own fix (openwrt/cgi-io#6).

The drop is these three calls in this order, so no saved root uid and no root
supplementary group survives it, and it runs before the daemonizing fork:

main.c, main():

    if (priv_user) {
            struct passwd *pw = getpwnam(priv_user);
            ...
            if (initgroups(priv_user, pw->pw_gid) ||
                setgid(pw->pw_gid) ||
                setresuid(pw->pw_uid, pw->pw_uid, pw->pw_uid)) {

It sits after uh_tls_init() and before the uh_plugin_init() calls, because
the ubus plugin connects in its init:

ubus.c, uh_ubus_init():

    ctx = ubus_connect(conf.ubus_socket);

My understanding is that ubusd reads the peer uid from SO_PEERCRED when the
connection is accepted and exempts uid 0 from its ACLs, so a socket opened
before the drop stays a root socket for the life of the process. Connecting
afterwards is what puts the daemon's ubus access under /usr/share/acl.d.

This has run on an ipq807x router. file exec on rpcd with no session id
answered uid=0(root) through a ubus socket opened before the drop, and
Permission denied through one opened after, on a single before/after run.
Beyond that I have not exercised the daemon at the dropped uid. I used AI to
help me write this change.

openwrt/openwrt#24740 is the package side that passes -Z.

Is before uh_plugin_init() the right place, or does a lua or ucode init need
root for anything?

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[JuliusBairaktaris]

@jow- @hauke — this is the uhttpd side of running the daemon as a dedicated
non-root user on OpenWrt (openwrt/openwrt#24558).

The reason it is a uhttpd change rather than just a procd user parameter is
the TLS key: dropping inside the daemon keeps the key at root:root 0600,
because it is already read by the time the drop happens. Dropping before
execve() instead would mean chowning the key to the unprivileged user, and
on OpenWrt that path comes from uci — so it would be a chown of an
operator-supplied path, which is a worse trade than the one it buys.

26 lines, inert unless -Z is passed.

[JuliusBairaktaris]

Amended: the drop now happens before the handler plugins are initialised rather than after them.

ubusd reads the peer uid from SO_PEERCRED when the connection is accepted and exempts uid 0 from every ACL it enforces, so the socket the ubus plugin opens in its init stayed a root socket for the life of the process. In that state — connected as root, uid dropped, no capabilities left — file exec on rpcd with no session id still comes back with uid=0(root); the same call from a connection opened after the drop is refused with Permission denied. Connecting afterwards is what puts the daemon's ubus access under /usr/share/acl.d.

The plugins need no privilege of their own — they dlopen a module and read a handler script — and the TLS key is still read before the drop, so it keeps root:root 0600.