privilege.h

Go to the documentation of this file.

// Copyright (c) 2024-2026 Lux Industries Inc.
// SPDX-License-Identifier: BSD-3-Clause-Eco
//
// Privilege gate for env-var honoring. Public-but-internal: the gpu core, the
// plugin loader, and each backend plugin all need the SAME predicate so that
// every env-controlled lookup (LUX_GPU_BACKEND_PATH, LUX_METAL_KERNEL_PATH,
// LUX_CUDA_KERNEL_PATH, LUX_WGSL_KERNEL_PATH) refuses uniformly under
// elevated privileges.
//
// Refusal policy:
//   * Windows                — no setuid concept; treat env as trusted.
//   * macOS / *BSD           — issetugid() is authoritative.
//   * Linux                  — emulate issetugid() via real != effective uid
//                              or gid (gained privilege at exec()).
//
// A second opt-out: LUX_GPU_TRUST_ENV=0 forces refusal regardless of process
// privilege. Operators set this to harden long-lived services that should
// never honor caller-supplied paths.
 
#ifndef LUX_GPU_INTERNAL_PRIVILEGE_H
#define LUX_GPU_INTERNAL_PRIVILEGE_H
 
#include <cstdlib>
#include <cstring>
 
#ifdef _WIN32
#else
#  include <unistd.h>
#  include <sys/types.h>
#endif
 
namespace lux::gpu::internal {
 
inline bool process_is_privileged() {
#ifdef _WIN32
    return false;
#elif defined(__APPLE__) || defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__NetBSD__)
    return issetugid() != 0;
#else
    return getuid() != geteuid() || getgid() != getegid();
#endif
}
 
// Returns true if env-var consumption is forbidden. A backend plugin / loader
// MUST early-return on this predicate BEFORE calling std::getenv on any user-
// controlled path key. The single kill switch (LUX_GPU_TRUST_ENV=0) plus the
// privilege check covers both "operator opted out" and "setuid binary".
inline bool env_is_untrusted() {
    if (const char* trust = std::getenv("LUX_GPU_TRUST_ENV");
        trust && std::strcmp(trust, "0") == 0) {
        return true;
    }
    return process_is_privileged();
}
 
} // namespace lux::gpu::internal
 
#endif // LUX_GPU_INTERNAL_PRIVILEGE_H