Bug 2184965
| Summary: | libcap-ng used by "/usr/sbin/dhcrelay" failed dropping bounding set due to not having CAP_SETPCAP in capng_apply | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 9 | Reporter: | Masahiro Matsuya <mmatsuya> |
| Component: | dhcp | Assignee: | Martin Osvald 🛹 <mosvald> |
| Status: | CLOSED ERRATA | QA Contact: | Petr Sklenar <psklenar> |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 9.1 | CC: | chorn, psklenar |
| Target Milestone: | rc | Keywords: | Triaged |
| Target Release: | --- | Flags: | pm-rhel:
mirror+
|
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | dhcp-4.4.2-19.b1.el9 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2023-11-07 08:51:49 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Thank you for reporting this problem and coming up with a possible solution! Noticed that this problem was mentioned in the BZ for libvirtd some time ago already: https://bugzilla.redhat.com/show_bug.cgi?id=1924218#c40 I will go with the capng_apply(CAPNG_SELECT_CAPS) as the bounding set gets cleared during the first call to capng_apply(CAPNG_SELECT_BOTH) and we just need to clear the rest: ~~~ ~]# cat /proc/113879/status | grep Cap CapInh: 0000000000000000 CapPrm: 0000000000002400 CapEff: 0000000000002400 CapBnd: 0000000000000000 CapAmb: 0000000000000000 ~]# ~~~ CAPNG_SELECT_CAPS is effectively skipping the printing of the log message, but ending up executing the same: ~~~ 778 } else { 779 memcpy(&m, &state, sizeof(m)); /* restore state */ 780 // rc = -4; 781 log_problem(4); 782 goto try_caps; 783 } 784 #endif 785 } 786 787 // Try caps is here so that if someone had SELECT_BOTH and we blew up 788 // doing the bounding set, we at least try to set any capabilities 789 // before returning in case the caller also doesn't bother checking 790 // the return code. 791 try_caps: 792 if (set & CAPNG_SELECT_CAPS) { 793 if (capset((cap_user_header_t)&m.hdr, 794 (cap_user_data_t)&m.data) == 0) 795 m.state = CAPNG_APPLIED; 796 else 797 rc = -5; 798 } ~~~ Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory (dhcp bug fix and enhancement update), and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2023:6607 |
Description of problem: dhcrelay always outputs an failure into journal log and /var/log/messages. dhcrelay[XXX]: libcap-ng used by "/usr/sbin/dhcrelay" failed dropping bounding set due to not having CAP_SETPCAP in capng_apply dhcrelay's main() function has the following two places for capability operation. 676 #ifdef HAVE_LIBCAP_NG 677 /* Drop capabilities */ 678 if (!keep_capabilities) { 679 capng_clear(CAPNG_SELECT_BOTH); 680 capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, 681 CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1); 682 capng_apply(CAPNG_SELECT_BOTH); 683 log_info ("Dropped all unnecessary capabilities."); 684 } 685 #endif 843 #ifdef HAVE_LIBCAP_NG 844 /* Drop all capabilities */ 845 if (!keep_capabilities) { 846 capng_clear(CAPNG_SELECT_BOTH); 847 capng_apply(CAPNG_SELECT_BOTH); 848 log_info ("Dropped all capabilities."); 849 } 850 #endif It tries twice to drop all capabilities from bounding set, since the CAPNG_SELECT_BOTH is used in both places. But, the second one never happens because CAP_SETPCAP has already been dropped from effective set in the first place. The following is the capng_apply() definition in libcap-ng, and it checks CAP_SETPCAP in the effective set and output the failure message. In shorts, the failure message is always output in the second place, since it tries to drop all capabilities without CAP_SETPCAP. int capng_apply(capng_select_t set) { ... snip ... if (set & CAPNG_SELECT_BOUNDS) { #ifdef PR_CAPBSET_DROP struct cap_ng state; memcpy(&state, &m, sizeof(state)); /* save state */ capng_get_caps_process(); if (capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) { <<== ... snip ... } else { memcpy(&m, &state, sizeof(m)); /* restore state */ // rc = -4; log_problem(4); goto try_caps; } There are two ways to fix it, at least. The first one is to keep CAP_SETPCAP in the first location. 680 capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, 681 CAP_NET_RAW, CAP_NET_BIND_SERVICE, CAP_SETPCAP -1); The second one is not to try dropping all capabilities from bounding set in the second place. 846 capng_clear(CAPNG_SELECT_CAPS); 847 capng_apply(CAPNG_SELECT_CAPS); Version-Release number of selected component (if applicable): RHEL9.1 How reproducible: Always Steps to Reproduce: 1. attach two network interfaces, at least 2. install dhcp-relay package into rhel9.1 3. configure /etc/systemd/system/dhcrelay.service by following: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/networking_guide/dhcp-relay-agent NOTE: This is RHEL7 doc, but it still works for RHEL9. 4. start dhcrelay service and check journal log. # systemctl start dhcrelay # journalctl -e optionally, check that the capabilities of the dhcrelay process is 0. # cat /etc/<PID>/status CapInh: 0000000000000000 CapPrm: 0000000000000000 CapEff: 0000000000000000 CapBnd: 0000000000000000 CapAmb: 0000000000000000 Actual results: This failure message is output. dhcrelay[XXX]: libcap-ng used by "/usr/sbin/dhcrelay" failed dropping bounding set due to not having CAP_SETPCAP in capng_apply Expected results: The failure message is not output. Additional info: