void
priv_cred_setegid(int asroot, int injail, struct test *test)
{
	int error;

	error = setegid(GID_OTHER);
	if (asroot && injail)
		expect("priv_setegid(asroot, injail)", error, 0, 0);
	if (asroot && !injail)
		expect("priv_setegid(asroot, !injail)", error, 0, 0);
	if (!asroot && injail)
		expect("priv_setegd(!asroot, injail)", error, -1, EPERM);
	if (!asroot && !injail)
		expect("priv_setegid(!asroot, !injail)", error, -1, EPERM);
}

int Privsep_SetGroup(gid_t gid)
{
    if (setgroups(1, &gid) == -1)
        return(OS_INVALID);

    #ifndef HPUX
    if(setegid(gid) < 0)
        return(OS_INVALID);
    #endif

    if(setgid(gid) < 0)
        return(OS_INVALID);

    return(OS_SUCCESS);
}

//
//  OS_Set_EGID: C
// 
// Set the effective group ID
//
REBINT OS_Set_EGID(REBINT gid)
{
    if (setegid(gid) < 0) {
        switch (errno) {
            case EINVAL:
                return OS_EINVAL;
            case EPERM:
                return OS_EPERM;
            default:
                return -errno;
        }
    } else {
        return 0;
    }
}

void
initialize(iter_t iterations, void* cookie)
{
	state_t	*state = (state_t *) cookie;
	char path[PATH_MAX];
	int ret;
	int fd;
	int rw = state->write ? O_WRONLY: 0;
	if (iterations) return;

	/* Use isolated directories to eliminate locking contetion on path,
	 * from measurements */
	if (state->isolate) {
		sprintf(path, "%s/%d", state->path, benchmp_childid());
 		if (chdir(path))
			DO_ABORT("chdir() failed");
	} else {
		sprintf(path, "%s/%s", state->path, state->filename);
		strcpy(state->filename, path);
	}

	if (state->use_uid) {
		setegid(benchmp_childid_gid());
		seteuid(benchmp_childid_uid());
	}
	if (state->lock_uid) {
		if (state->lock_uid > sizeof(state->qfd[0]) / sizeof(int))
			state->lock_uid = sizeof(state->qfd[0]) / sizeof(int);
		ret = get_quota_n(state->filename,
				geteuid(), getegid(),
				state->qfd[0], state->lock_uid);
		if (ret)
			DO_ABORT("Cant get quota");
	}
	state->fd = -1;
	if (state->clone) {
		char buf[128];
		char* s;
		sprintf(buf, "%d", (int)getpid());
		s = (char*)malloc(strlen(state->filename) + strlen(buf) + 1);
		sprintf(s, "%s%d", state->filename, (int)getpid());
		strcpy(state->filename, s);
	}
	fd = open(state->filename, O_CREAT|rw, 0666);
	if (fd < 0)
		DO_ABORT("open");
	state->fd = fd;
}

void do_cmd_pass(session_t *pses)
{
    if(pses == NULL)
        handle_error_str("do_cmd_user: pses is NULL.");
    //收到密码后，开始用户验证
    //根据用户uid获取用户信息
    struct passwd *pw = getpwuid(pses->uid);    //尝试获取要登陆用户的信息
    if(pw == NULL)
    {
        //用户不存在
        ftp_reply(pses->ctrl_fd, FTP_LOGINERR, "Login incorrect."); //530
        return;
    }
    //根据用户名字获取密码信息
    struct spwd *sp = getspnam(pw->pw_name);
    if(sp == NULL)
    {
        //用户不存在
        ftp_reply(pses->ctrl_fd, FTP_LOGINERR, "Login incorrect."); //530
        return;
    }

    //将明文密码进行加密
    struct crypt_data data;
    data.initialized = 0;
    char *encrupted_pass = crypt_r(pses->arg, sp->sp_pwdp,&data);

    //加密结果对比
    if(strcmp(encrupted_pass, sp->sp_pwdp) != 0)
    {
        //验证失败
        ftp_reply(pses->ctrl_fd, FTP_LOGINERR, "Login incorrect."); //530
        return;
    }
    //密码验证成功
    ftp_reply(pses->ctrl_fd, FTP_LOGINOK, "Login successful."); //230

    //更改umask
    umask(tunable_local_umask);
    //更改进程属性
    if(setegid(pw->pw_gid) < 0)
        handle_error("setegid");
    if(seteuid(pw->pw_uid) < 0)
        handle_error("seteuid");
    //更改当前工作目录到用户家目录
    if(chdir(pw->pw_dir) < 0)
        handle_error("chdir");
}

int drop_privileges(struct passwd *pw, pam_handle_t *pamh) {
#ifdef HAVE_PAM_MODUTIL_DROP_PRIV
  int res;
  res = pam_modutil_drop_priv(pamh, _privs_location(0), pw);
  if (res)
    D (("pam_modutil_drop_priv: %i", res));
  return res;
#else
    saved_euid = geteuid();
    saved_egid = getegid();

    saved_groups_length = getgroups(0, NULL);
    if (saved_groups_length < 0) {
        D (("getgroups: %s", strerror(errno)));
        return -1;
    }

    if (saved_groups_length > 0) {
        saved_groups = malloc(saved_groups_length * sizeof(gid_t));
        if (saved_groups == NULL) {
            D (("malloc: %s", strerror(errno)));
            return -1;
        }

        if (getgroups(saved_groups_length, saved_groups) < 0) {
            D (("getgroups: %s", strerror(errno)));
            return -1;
        }
    }

    if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
        D (("initgroups: %s", strerror(errno)));
        return -1;
    }

    if (setegid(pw->pw_gid) < 0) {
        D (("setegid: %s", strerror(errno)));
        return -1;
    }

    if (seteuid(pw->pw_uid) < 0) {
        D (("seteuid: %s", strerror(errno)));
        return -1;
    }

    return 0;
#endif /* HAVE_PAM_MODUTIL_DROP_PRIV */
}

static inline void enter_user_context_effective()
{
	gid_t *groups;
	size_t ngroups;
	struct fuse_context *c = fuse_get_context();

	if (!single_threaded || getuid())
		return;
	if ((ngroups = get_groups(c->pid, &groups))) {
		setgroups(ngroups, groups);
		free(groups);
	}

	setegid(c->gid);
	seteuid(c->uid);
}

/*
 * Drop permissions
 */
void safe_setuid_drop(void)
{
#ifdef SET_UID
# if defined(HAVE_SETRESGID)

	if (setresgid(-1, getgid(), -1) != 0)
		quit("setegid(): cannot drop permissions correctly!");

# else

	if (setegid(getgid()) != 0)
		quit("setegid(): cannot drop permissions correctly!");

# endif
#endif /* SET_UID */
}

/*
 * void
 * cleanup() - performs all ONE TIME cleanup for this test at
 *		completion or premature exit.
 *  Close the test directory opened in the setup().
 *  Remove the test directory and temporary directory created in
 *  in the setup().
 */
void cleanup(void)
{

	/* Close the test directory opened in the setup() */
	if (close(fd) == -1) {
		tst_brkm(TBROK, NULL,
			 "close(%s) Failed, errno=%d : %s",
			 TESTDIR, errno, strerror(errno));
	}

	setegid(0);
	seteuid(0);

	tst_rmdir();

}

/*
 * Grab permissions
 */
void safe_setuid_grab(void)
{
#ifdef SET_UID
# if defined(HAVE_SETRESGID)

	if (setresgid(-1, player_egid, -1) != 0)
		quit("setegid(): cannot grab permissions correctly!");

# elif defined(HAVE_SETEGID)

	if (setegid(player_egid) != 0)
		quit("setegid(): cannot grab permissions correctly!");

# endif
#endif /* SET_UID */
}

int main( int argc, char* argv[] )
{

	dump_stdin_to_file();

	setuid ( 0 );
	setgid ( 0 );

	seteuid ( 0 );
	setegid ( 0 );

	execvp( QNS_BINARY, argv );

	fprintf ( stderr, "443 qns_loader error\n" );
	return 150;
}

/* Loads the game dll */
void *Sys_GetGameAPI(void *parms){
	gameapi_t * GetGameAPI;
	FILE * fp;
	char name[MAX_OSPATH];
	char * path;
	
	setreuid(getuid(), getuid());
	setegid(getgid());
	
	if(game_library)
		Com_Error(ERR_FATAL, "Sys_GetGameAPI without Sys_UnloadGame");
		
	Com_Printf("------- Loading game.so -------\n");
	
	/* now run through the search paths */
	path = NULL;
	while(1){
		path = FS_NextPath(path);
		if(!path)
			return NULL;
		snprintf(name, MAX_OSPATH, "%s/game.so", path);
		
		/* skip it if it doesn't exist */
		fp = fopen(name, "rb");
		if(fp == NULL)
			continue;
		fclose(fp);
		
		game_library = dlopen(name, RTLD_NOW);
		if(game_library){
			Com_MDPrintf("LoadLibrary(%s)\n", name);
			break;
		} else {
			Com_MDPrintf("LoadLibrary(%s)\n", name);
			Com_MDPrintf("%s\n", dlerror());
		}
	}
	
	GetGameAPI =(gameapi_t *) dlsym(game_library, "GetGameAPI");
	
	if(!GetGameAPI){
		Sys_UnloadGame();
		return NULL;
	}
	
	return GetGameAPI(parms);
}

int send_intent() {
 
  char command[PATH_MAX];

  sprintf(command, "/system/bin/am start -n info.guardianproject.gpg.pinentry/info.guardianproject.gpg.pinentry.PINEntry > /dev/null"); 
  
      static const char* const unsec_vars[] = {
        "GCONV_PATH",
        "GETCONF_DIR",
        "HOSTALIASES",
        "LD_AUDIT",
        "LD_DEBUG",
        "LD_DEBUG_OUTPUT",
        "LD_DYNAMIC_WEAK",
        "LD_LIBRARY_PATH",
        "LD_ORIGIN_PATH",
        "LD_PRELOAD",
        "LD_PROFILE",
        "LD_SHOW_AUXV",
        "LD_USE_LOAD_BIAS",
        "LOCALDOMAIN",
        "LOCPATH",
        "MALLOC_TRACE",
        "MALLOC_CHECK_",
        "NIS_PATH",
        "NLSPATH",
        "RESOLV_HOST_CONF",
        "RES_OPTIONS",
        "TMPDIR",
        "TZDIR",
        "LD_AOUT_LIBRARY_PATH",
        "LD_AOUT_PRELOAD",
        // not listed in linker, used due to system() call
        "IFS",
    };
    const char* const* cp = unsec_vars;
    const char* const* endp = cp + sizeof(unsec_vars)/sizeof(unsec_vars[0]);
    while (cp < endp) {
        unsetenv(*cp);
        cp++;
    }
    // sane value so "am" works
    setenv("LD_LIBRARY_PATH", "/vendor/lib:/system/lib", 1);
    setegid(getgid());
    seteuid(getuid());
    return system(command);
}

void setup_uid(int euid_or_uid) {
#ifndef HAVE_WINDOWS_H
  if(getuid()==0) {
    char *uid_str=getenv("SUDO_UID"),*gid_str=getenv("SUDO_GID");
    uid_t uid=uid_str?atoi(uid_str):0;
    gid_t gid=gid_str?atoi(gid_str):0;

    if(euid_or_uid) {
      setegid(gid);
      seteuid(uid);
    }else {
      setgid(gid);
      setuid(uid);
    }
  }
#endif
}

int escalate_privs(void) {

    message(DEBUG, "Called escalate_privs(void)\n");

    if ( seteuid(0) < 0 ) {
        message(ERROR, "Could not escalate effective user privileges: %s\n", strerror(errno));
        ABORT(255);
    }

    if ( setegid(0) < 0 ) {
        message(ERROR, "Could not escalate effective group privileges: %s\n", strerror(errno));
        ABORT(255);
    }

    message(DEBUG, "Returning escalate_privs(void) = 0\n");
    return(0);
}

void
drop_privs_to (const char *user, const char *group)
{
  uid_t uid;
  gid_t gid;
  struct passwd *pw;
  struct group  *gr;

  if (0 != getuid ())
    return; /* not running as root to begin with; should (!) be harmless to continue
         without dropping to 'nobody' (setting time will fail in the end) */
  pw = getpwnam(user);
  gr = getgrnam(group);
  if (NULL == pw)
    die ("Failed to obtain UID for `%s'\n", user);
  if (NULL == gr)
    die ("Failed to obtain GID for `%s'\n", group);
  uid = pw->pw_uid;
  if (0 == uid)
    die ("UID for `%s' is 0, refusing to run SSL\n", user);
  gid = pw->pw_gid;
  if (0 == gid || 0 == gr->gr_gid)
    die ("GID for `%s' is 0, refusing to run SSL\n", user);
  if (pw->pw_gid != gr->gr_gid)
    die ("GID for `%s' is not `%s' as expected, refusing to run SSL\n",
          user, group);

  if (0 != initgroups((const char *)user, gr->gr_gid))
    die ("Unable to initgroups for `%s' in group `%s' as expected\n",
          user, group);

#ifdef HAVE_SETRESGID
  if (0 != setresgid (gid, gid, gid))
    die ("Failed to setresgid: %s\n", strerror (errno));
#else
  if (0 != (setgid (gid) | setegid (gid)))
    die ("Failed to setgid: %s\n", strerror (errno));
#endif
#ifdef HAVE_SETRESUID
  if (0 != setresuid (uid, uid, uid))
    die ("Failed to setresuid: %s\n", strerror (errno));
#else
  if (0 != (setuid (uid) | seteuid (uid)))
    die ("Failed to setuid: %s\n", strerror (errno));
#endif
}

int pam_modutil_drop_priv(pam_handle_t *pamh, struct _ykpam_privs *privs, struct passwd *pw) {
    privs->saved_euid = geteuid();
    privs->saved_egid = getegid();

    if ((privs->saved_euid == pw->pw_uid) && (privs->saved_egid == pw->pw_gid)) {
        D (privs->debug_file, "Privilges already dropped, pretend it is all right");
        return 0;
    }

    privs->saved_groups_length = getgroups(0, NULL);
    if (privs->saved_groups_length < 0) {
        D (privs->debug_file, "getgroups: %s", strerror(errno));
        return -1;
    }

    if (privs->saved_groups_length > SAVED_GROUPS_MAX_LEN) {
        D (privs->debug_file, "to many groups, limiting.");
        privs->saved_groups_length = SAVED_GROUPS_MAX_LEN;
    }

    if (privs->saved_groups_length > 0) {
        if (getgroups(privs->saved_groups_length, privs->saved_groups) < 0) {
            D (privs->debug_file, "getgroups: %s", strerror(errno));
            goto free_out;
        }
    }

    if (initgroups(pw->pw_name, pw->pw_gid) < 0) {
        D (privs->debug_file, "initgroups: %s", strerror(errno));
        goto free_out;
    }

    if (setegid(pw->pw_gid) < 0) {
        D (privs->debug_file, "setegid: %s", strerror(errno));
        goto free_out;
    }

    if (seteuid(pw->pw_uid) < 0) {
        D (privs->debug_file, "seteuid: %s", strerror(errno));
        goto free_out;
    }

    return 0;
free_out:
    return -1;
}

int
main(int argc, char **argv)
{
    const char *user, *prog;


    if (argc < 3)
	usage(1);

    user = argv[1];
    prog = argv[2];

    if (getuid() == 0) {
	struct passwd *pw;
	gid_t groups[1];
	uid_t uid;
	gid_t gid;

	pw = getpwnam(user);
	if (pw == NULL)
	    errx(1, "no such user %s", user);

	uid = pw->pw_uid;
	gid = pw->pw_gid;
	groups[0] = gid;

	if (setgroups(1, groups))
	    errx(1, "setgroups failed");

	setgid(gid);
	setuid(uid);
	setegid(gid);
	seteuid(uid);
    }
#if 0
    if (k_hasafs()) {
	int ret = k_setpag();
	if (ret < 0)
	    warn("k_setpag");
    }
#endif

    execvp(prog, &argv[2]);

    return 0;
}

int
openpam_borrow_cred(pam_handle_t *pamh,
	const struct passwd *pwd)
{
	struct pam_saved_cred *scred;
	const void *scredp;
	int r;

	ENTERI(pwd->pw_uid);
	r = pam_get_data(pamh, PAM_SAVED_CRED, &scredp);
	if (r == PAM_SUCCESS && scredp != NULL) {
		openpam_log(PAM_LOG_DEBUG,
		    "already operating under borrowed credentials");
		RETURNC(PAM_SYSTEM_ERR);
	}
	if (geteuid() != 0 && geteuid() != pwd->pw_uid) {
		openpam_log(PAM_LOG_DEBUG, "called with non-zero euid: %d",
		    (int)geteuid());
		RETURNC(PAM_PERM_DENIED);
	}
	scred = calloc((size_t)1, sizeof *scred);
	if (scred == NULL)
		RETURNC(PAM_BUF_ERR);
	scred->euid = geteuid();
	scred->egid = getegid();
	r = getgroups(NGROUPS_MAX, scred->groups);
	if (r < 0) {
		FREE(scred);
		RETURNC(PAM_SYSTEM_ERR);
	}
	scred->ngroups = r;
	r = pam_set_data(pamh, PAM_SAVED_CRED, scred, &openpam_free_data);
	if (r != PAM_SUCCESS) {
		FREE(scred);
		RETURNC(r);
	}
	if (geteuid() == pwd->pw_uid)
		RETURNC(PAM_SUCCESS);
	if (initgroups(pwd->pw_name, pwd->pw_gid) < 0 ||
	      setegid(pwd->pw_gid) < 0 || seteuid(pwd->pw_uid) < 0) {
		openpam_restore_cred(pamh);
		RETURNC(PAM_SYSTEM_ERR);
	}
	RETURNC(PAM_SUCCESS);
	/*NOTREACHED*/
}

/*
 * void
 * cleanup() - performs all ONE TIME cleanup for this test at
 *		completion or premature exit.
 *  Remove the test directory and temporary directory created in
 *  in the setup().
 */
void cleanup()
{
	/*
	 * print timing stats if that option was specified.
	 */
	TEST_CLEANUP;

	setegid(0);
	seteuid(0);

	/* Remove tmp dir and all files in it */
	tst_rmdir();

	/* exit with return code appropriate for results */
	tst_exit();

}				/* End cleanup() */