Attachment 878709 Details for Bug 1039346 – Keep CAP_DAC_OVERRIDE only when necessary

[patch] Keep CAP_DAC_OVERRIDE only when necessary

openswan-dac-override.patch (text/plain), 2.29 KB, created by Terry Wilson on 2014-03-25 22:31:34 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Terry Wilson

Created: 2014-03-25 22:31:34 UTC

Size: 2.29 KB

patch

obsolete

>--- openswan-2.6.32.bak/programs/pluto/plutomain.c	2014-03-13 11:11:19.932862931 -0500
>+++ openswan-2.6.32/programs/pluto/plutomain.c	2014-03-25 16:03:35.015024205 -0500
>@@ -36,6 +36,7 @@
> #include <fcntl.h>
> #include <getopt.h>
> #include <resolv.h>
>+#include <libgen.h>
> 
> #include <openswan.h>
> 
>@@ -329,6 +330,47 @@
> u_int16_t secctx_attr_value=SECCTX;
> #endif
> 
>+void set_capabilities(void)
>+{
>+#ifdef HAVE_LIBCAP_NG
>+	char *ctldir;
>+	bool with_dac = FALSE;
>+	
>+	/* If running as root, check and see if we have access to create ctlbase.
>+	 * If we don't, retain CAP_DAC_OVERRIDE as root has passed in a ctlbase
>+	 * owned by another user and we'll need to be able to access it. If
>+	 * this fails, we just go on and potentially fail in create_lock() */
>+	if (geteuid() == 0 && (ctldir = strdup(ctlbase))) {
>+		struct stat sb;
>+		char *parent = dirname(ctldir);
>+		int mode = R_OK|W_OK|X_OK;
>+
>+		if ((stat(parent, &sb) == -1) ||
>+				(sb.st_uid == 0 && mode != (sb.st_mode & (mode << 6)) >> 6) ||
>+				(sb.st_gid == 0 && mode != (sb.st_mode & (mode << 3)) >> 3) ||
>+				(mode != (sb.st_mode & mode))) {
>+			with_dac = TRUE;
>+		}
>+		free(ctldir);
>+	}
>+
>+	/* Drop capabilities */
>+	capng_clear(CAPNG_SELECT_BOTH);
>+	capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
>+			CAP_NET_BIND_SERVICE, CAP_NET_ADMIN, CAP_NET_RAW,
>+			CAP_IPC_LOCK, -1);
>+	if (with_dac) {
>+		capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
>+				CAP_DAC_OVERRIDE);
>+	}
>+	/* our children must be able to CAP_NET_ADMIN to change routes.
>+	 */
>+	capng_updatev(CAPNG_ADD, CAPNG_BOUNDING_SET,
>+			CAP_NET_ADMIN, -1);
>+	capng_apply(CAPNG_SELECT_BOTH);
>+#endif
>+}
>+
> int
> main(int argc, char **argv)
> {
>@@ -354,19 +396,6 @@
>     leak_detective=0;
> #endif
> 
>-#ifdef HAVE_LIBCAP_NG
>-	/* Drop capabilities */
>-	capng_clear(CAPNG_SELECT_BOTH);
>-	capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
>-			CAP_NET_BIND_SERVICE, CAP_NET_ADMIN, CAP_NET_RAW,
>-			CAP_IPC_LOCK, -1);
>-	/* our children must be able to CAP_NET_ADMIN to change routes.
>-	 */
>-	capng_updatev(CAPNG_ADD, CAPNG_BOUNDING_SET,
>-			CAP_NET_ADMIN, -1);
>-	capng_apply(CAPNG_SELECT_BOTH);
>-#endif
>-
> 
>     global_argv = argv;
>     global_argc = argc;
>@@ -751,6 +780,7 @@
>                     e, strerror(e));
>     }
> 
>+	set_capabilities();
>     oco = osw_init_options();
>     lockfd = create_lock();
>

Actions: View | Diff

Attachments on bug 1039346: 878709 | 879075