6 files changed, 44 insertions, 15 deletions
diff --git a/runtime/staprun/common.c b/runtime/staprun/common.c
index afe96606..6a2ac77e 100644
--- a/runtime/staprun/common.c
+++ b/runtime/staprun/common.c
@@ -30,6 +30,7 @@ int need_uprobes;
 int daemon_mode;
 off_t fsize_max;
 int fnum_max;
+int unprivileged_user = 0;
 
 /* module variables */
 char *modname = NULL;
diff --git a/runtime/staprun/modverify.c b/runtime/staprun/modverify.c
index b50a69f4..f4b15ac3 100644
--- a/runtime/staprun/modverify.c
+++ b/runtime/staprun/modverify.c
@@ -203,11 +203,7 @@ verify_it (const char *inputName, const char *signatureName, SECKEYPublicKey *pu
   /* Get the size of the signature file.  */
   prStatus = PR_GetFileInfo (signatureName, &info);
   if (prStatus != PR_SUCCESS || info.type != PR_FILE_FILE || info.size < 0)
-    {
-      fprintf (stderr, "Unable to obtain information on the signature file %s.\n", signatureName);
-      nssError ();
-      return MODULE_UNTRUSTED; /* Not signed */
-    }
+    return MODULE_UNTRUSTED; /* Not signed */
 
   /* Open the signature file.  */
   local_file_fd = PR_Open (signatureName, PR_RDONLY, 0);
diff --git a/runtime/staprun/staprun.c b/runtime/staprun/staprun.c
index 7069cab3..554eecc8 100644
--- a/runtime/staprun/staprun.c
+++ b/runtime/staprun/staprun.c
@@ -16,7 +16,7 @@
  * along with this program; if not, write to the Free Software
  * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
  *
- * Copyright (C) 2005-2008 Red Hat, Inc.
+ * Copyright (C) 2005-2009 Red Hat, Inc.
  *
  */
 
@@ -139,11 +139,21 @@ static int enable_uprobes(void)
 
 static int insert_stap_module(void)
 {
-	char bufsize_option[128];
+	char special_options[128];
+	char *bufptr = special_options;
 
-	if (snprintf_chk(bufsize_option, 128, "_stp_bufsize=%d", buffer_size))
+	/* Add the _stp_bufsize option.  */
+	if (snprintf_chk(bufptr, sizeof (special_options), "_stp_bufsize=%d", buffer_size))
 		return -1;
-	return insert_module(modpath, bufsize_option, modoptions);
+
+	/* Add the _stp_unprivileged_user option.  */
+	bufptr += strlen (bufptr);
+	if (snprintf_chk(bufptr,
+			 sizeof (special_options) - (bufptr - special_options),
+			 " _stp_unprivileged_user=%d", unprivileged_user))
+	  return -1;
+
+	return insert_module(modpath, special_options, modoptions);
 }
 
 static int remove_module(const char *name, int verb);
diff --git a/runtime/staprun/staprun.h b/runtime/staprun/staprun.h
index 1c9aece8..0a1ca885 100644
--- a/runtime/staprun/staprun.h
+++ b/runtime/staprun/staprun.h
@@ -171,6 +171,7 @@ extern int need_uprobes;
 extern int daemon_mode;
 extern off_t fsize_max;
 extern int fnum_max;
+extern int unprivileged_user;
 
 /* getopt variables */
 extern char *optarg;
diff --git a/runtime/staprun/staprun_funcs.c b/runtime/staprun/staprun_funcs.c
index c19dc3ba..ed7f4fc3 100644
--- a/runtime/staprun/staprun_funcs.c
+++ b/runtime/staprun/staprun_funcs.c
@@ -404,7 +404,6 @@ check_groups (void)
 			perr("Unable to retrieve group list");
 			return -1;
 		}
-
 		for (i = 0; i < ngids; i++) {
 			/* If the user is a member of 'stapdev', then we're
 			 *  done, since he can use staprun without any
@@ -420,9 +419,10 @@ check_groups (void)
 			if (gidlist[i] == stapusr_gid)
 				gid = stapusr_gid;
 		}
-		/* Not a member of stapusr? */
-		if (gid != stapusr_gid)
-		  return 0;
+		if (gid != stapusr_gid) {
+			unprivileged_user = 1;
+			return 0;
+		}
 	}
 
 	/* At this point the user is only a member of the 'stapusr'
@@ -441,8 +441,9 @@ check_groups (void)
  * 1) root can do anything
  * 2) members of stapdev can do anything
  * 3) members of stapusr can load modules from /lib/modules/KVER/systemtap
+ * 4) anyone can load a module which has been signed by a trusted signer
  *
- * It is only an error if all 3 levels of checking fail
+ * It is only an error if all 4 levels of checking fail
  *
  * Returns: -1 on errors, 0 on failure, 1 on success.
  */
@@ -481,6 +482,17 @@ int check_permissions(void)
 	if (check_groups_rc == 1)
 		return 1;
 
+	/* The user is an ordinary user. If the module has been signed with
+	 * a "blessed" certificate and private key, then we will load it for
+	 * anyone.  */
+#if HAVE_NSS
+	if (check_signature_rc == MODULE_OK)
+		return 1;
+	assert (check_signature_rc == MODULE_UNTRUSTED || check_signature_rc == MODULE_CHECK_ERROR);
+#endif
+
+	/* We are an ordinary user and the module was not signed by a trusted
+	   signer.  */
 	err("ERROR: You are trying to run stap as a normal user.\n"
 	    "You should either be root, or be part of either "
 	    "group \"stapdev\" or group \"stapusr\".\n");
@@ -488,6 +500,11 @@ int check_permissions(void)
 		err("Your system doesn't seem to have either group.\n");
 		check_groups_rc = -1;
 	}
+#if HAVE_NSS
+	err("Alternatively, your module must be compiled using the --unprivileged option and signed by a trusted signer.\n"
+	    "For more information, please consult the \"SAFETY AND SECURITY\" section of the \"stap(1)\" manpage\n");
+#endif
 
-	return check_groups_rc;
+	/* Combine the return codes.  They are either 0 or -1. */
+	return check_groups_rc | check_signature_rc;
 }
diff --git a/runtime/transport/transport.c b/runtime/transport/transport.c
index 1d029e53..ec73f05f 100644
--- a/runtime/transport/transport.c
+++ b/runtime/transport/transport.c
@@ -59,6 +59,10 @@ static int _stp_bufsize;
 module_param(_stp_bufsize, int, 0);
 MODULE_PARM_DESC(_stp_bufsize, "buffer size");
 
+static int _stp_unprivileged_user;
+module_param(_stp_unprivileged_user, int, 1);
+MODULE_PARM_DESC(_stp_unprivileged_user, "user is unprivileged");
+
 /* forward declarations */
 static void probe_exit(void);
 static int probe_start(void);