--- src/tcsd/svrside.c.orig	Thu Jan 21 15:18:55 2010
+++ src/tcsd/svrside.c	Thu Jan 28 17:37:07 2010
@@ -27,6 +27,13 @@
 #include <arpa/inet.h>
 #include <errno.h>
 #include <getopt.h>
+#ifdef SOLARIS
+#include <priv.h>
+#endif
+#ifndef HAVE_DAEMON
+#include <fcntl.h>
+#endif
+
 #include "trousers/tss.h"
 #include "trousers_types.h"
 #include "tcs_tsp.h"
@@ -207,6 +214,79 @@
 }
 
 
+#ifdef SOLARIS
+
+/*
+ * For Solaris, make the tcsd privilege aware and drop
+ * risky privileges if they are not needed.
+ */
+static int
+drop_privs()
+{
+	priv_set_t *myprivs;
+	int rv;
+
+	/*
+	 * Drop unneeded privs such as fork/exec.
+	 *
+	 * Get "basic" privs and remove the ones we don't want.
+	 */
+	if ((myprivs = priv_str_to_set("basic", ",", NULL)) == NULL) {
+		LogError("priv_str_to_set failed: %s", strerror(errno));
+		return (1);
+	} else {
+		(void) priv_delset(myprivs, PRIV_PROC_EXEC);
+		(void) priv_delset(myprivs, PRIV_PROC_FORK);
+		(void) priv_delset(myprivs, PRIV_FILE_LINK_ANY);
+		(void) priv_delset(myprivs, PRIV_PROC_INFO);
+		(void) priv_delset(myprivs, PRIV_PROC_SESSION);
+		(void) priv_delset(myprivs, PRIV_PROC_SETID);
+
+		/* for auditing */
+		(void) priv_addset(myprivs, PRIV_PROC_AUDIT);
+
+		if ((rv = setppriv(PRIV_SET, PRIV_PERMITTED, myprivs)))
+			return (rv);
+		if ((rv = setppriv(PRIV_SET, PRIV_LIMIT, myprivs)))
+			return (rv);
+		if ((rv = setppriv(PRIV_SET, PRIV_INHERITABLE, myprivs)))
+			return (rv);
+
+		(void) priv_freeset(myprivs);
+	}
+	return (0);
+}
+#endif /* SOLARIS */
+
+#ifndef HAVE_DAEMON
+static int
+daemon(int nochdir, int noclose) {
+	int rv, fd;
+
+	switch (fork()) {
+		case -1:
+			return (-1);
+		case 0:
+			break;
+		default:
+		exit (0);
+	}
+
+	if (setsid() == -1)
+		return (-1);
+	if (!nochdir)
+		(void) chdir("/");
+	if (!noclose && (fd = open("/dev/null", O_RDWR, 0)) != -1) {
+		(void) dup2(fd, STDIN_FILENO);
+		(void) dup2(fd, STDOUT_FILENO);
+		(void) dup2(fd, STDERR_FILENO);
+		if (fd > 2)
+			(void)close (fd);
+	}
+	return (0);
+}
+#endif /* !HAVE_DAEMON */
+
 int
 main(int argc, char **argv)
 {
@@ -222,6 +302,9 @@
 		{"foreground", 0, NULL, 'f'},
 		{0, 0, 0, 0}
 	};
+#ifdef SOLARIS
+	int rv;
+#endif
 
 	while ((c = getopt_long(argc, argv, "fh", long_options, &option_index)) != -1) {
 		switch (c) {
@@ -287,6 +372,11 @@
 			return -1;
 		}
 	}
+#ifdef SOLARIS
+	/* For Solaris, drop privileges for security. */
+	if ((rv = drop_privs()))
+		return (rv);
+#endif /* SOLARIS */
 
 	LogInfo("%s: TCSD up and running.", PACKAGE_STRING);
 	do {