denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Refactored heavily #ifdefd capability code to its own libstrongswan class

Browse Source
This commit is contained in:
Martin Willi
2012-07-04 11:01:40 +02:00
parent 644c6c968d
commit 0619ddfaa4
16 changed files with 393 additions and 233 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/Makefile.am
-4
View File
@@ -153,10 +153,6 @@ if USE_ME
sa/ikev2/tasks/ike_me.c sa/ikev2/tasks/ike_me.h
endif
if USE_LIBCAP
libcharon_la_LIBADD += -lcap
endif
# build optional plugins
########################
src/libcharon/daemon.c
+3 -85
View File
@@ -21,14 +21,6 @@
#include <unistd.h>
#include <time.h>
#ifdef CAPABILITIES
# ifdef HAVE_SYS_CAPABILITY_H
# include <sys/capability.h>
# elif defined(CAPABILITIES_NATIVE)
# include <linux/capability.h>
# endif /* CAPABILITIES_NATIVE */
#endif /* CAPABILITIES */
#include "daemon.h"
#include <library.h>
@@ -52,17 +44,6 @@ struct private_daemon_t {
* Handler for kernel events
*/
kernel_handler_t *kernel_handler;
/**
* capabilities to keep
*/
#ifdef CAPABILITIES_LIBCAP
cap_t caps;
#endif /* CAPABILITIES_LIBCAP */
#ifdef CAPABILITIES_NATIVE
struct __user_cap_data_struct caps[2];
#endif /* CAPABILITIES_NATIVE */
};
/**
@@ -125,9 +106,6 @@ static void destroy(private_daemon_t *this)
/* make sure the cache is clear before unloading plugins */
lib->credmgr->flush_cache(lib->credmgr, CERT_ANY);
lib->plugins->unload(lib->plugins);
#ifdef CAPABILITIES_LIBCAP
cap_free(this->caps);
#endif /* CAPABILITIES_LIBCAP */
DESTROY_IF(this->kernel_handler);
DESTROY_IF(this->public.traps);
DESTROY_IF(this->public.shunts);
@@ -138,6 +116,7 @@ static void destroy(private_daemon_t *this)
DESTROY_IF(this->public.backends);
DESTROY_IF(this->public.sender);
DESTROY_IF(this->public.socket);
DESTROY_IF(this->public.caps);
/* rehook library logging, shutdown logging */
dbg = dbg_old;
@@ -150,57 +129,6 @@ static void destroy(private_daemon_t *this)
free(this);
}
METHOD(daemon_t, keep_cap, void,
private_daemon_t *this, u_int cap)
{
#ifdef CAPABILITIES_LIBCAP
cap_set_flag(this->caps, CAP_EFFECTIVE, 1, &cap, CAP_SET);
cap_set_flag(this->caps, CAP_INHERITABLE, 1, &cap, CAP_SET);
cap_set_flag(this->caps, CAP_PERMITTED, 1, &cap, CAP_SET);
#endif /* CAPABILITIES_LIBCAP */
#ifdef CAPABILITIES_NATIVE
int i = 0;
if (cap >= 32)
{
i++;
cap -= 32;
}
this->caps[i].effective |= 1 << cap;
this->caps[i].permitted |= 1 << cap;
this->caps[i].inheritable |= 1 << cap;
#endif /* CAPABILITIES_NATIVE */
}
METHOD(daemon_t, drop_capabilities, bool,
private_daemon_t *this)
{
#ifdef CAPABILITIES_LIBCAP
if (cap_set_proc(this->caps) != 0)
{
return FALSE;
}
#endif /* CAPABILITIES_LIBCAP */
#ifdef CAPABILITIES_NATIVE
struct __user_cap_header_struct header = {
#if defined(_LINUX_CAPABILITY_VERSION_3)
.version = _LINUX_CAPABILITY_VERSION_3,
#elif defined(_LINUX_CAPABILITY_VERSION_2)
.version = _LINUX_CAPABILITY_VERSION_2,
#elif defined(_LINUX_CAPABILITY_VERSION_1)
.version = _LINUX_CAPABILITY_VERSION_1,
#else
.version = _LINUX_CAPABILITY_VERSION,
#endif
};
if (capset(&header, this->caps) != 0)
{
return FALSE;
}
#endif /* CAPABILITIES_NATIVE */
return TRUE;
}
METHOD(daemon_t, start, void,
private_daemon_t *this)
{
@@ -269,8 +197,6 @@ private_daemon_t *daemon_create(const char *name)
INIT(this,
.public = {
.keep_cap = _keep_cap,
.drop_capabilities = _drop_capabilities,
.initialize = _initialize,
.start = _start,
.bus = bus_create(),
@@ -280,6 +206,7 @@ private_daemon_t *daemon_create(const char *name)
},
);
charon = &this->public;
this->public.caps = capabilities_create();
this->public.controller = controller_create();
this->public.eap = eap_manager_create();
this->public.xauth = xauth_manager_create();
@@ -289,16 +216,7 @@ private_daemon_t *daemon_create(const char *name)
this->public.shunts = shunt_manager_create();
this->kernel_handler = kernel_handler_create();
#ifdef CAPABILITIES
#ifdef CAPABILITIES_LIBCAP
this->caps = cap_init();
#endif /* CAPABILITIES_LIBCAP */
keep_cap(this, CAP_NET_ADMIN);
if (lib->leak_detective)
{
keep_cap(this, CAP_SYS_NICE);
}
#endif /* CAPABILITIES */
this->public.caps->keep(this->public.caps, CAP_NET_ADMIN);
return this;
}
src/libcharon/daemon.h
+3 -27
View File
@@ -165,6 +165,7 @@ typedef struct daemon_t daemon_t;
#include <config/backend_manager.h>
#include <sa/eap/eap_manager.h>
#include <sa/xauth/xauth_manager.h>
#include <utils/capabilities.h>
#ifdef ME
#include <sa/ikev2/connect_manager.h>
@@ -269,40 +270,15 @@ struct daemon_t {
#endif /* ME */
/**
* User ID the daemon will user after initialization
* POSIX capability dropping
*/
uid_t uid;
/**
* Group ID the daemon will use after initialization
*/
gid_t gid;
capabilities_t *caps;
/**
* Name of the binary that uses the library (used for settings etc.)
*/
const char *name;
/**
* Do not drop a given capability after initialization.
*
* Some plugins might need additional capabilites. They tell the daemon
* during plugin initialization which one they need, the daemon won't
* drop these.
*/
void (*keep_cap)(daemon_t *this, u_int cap);
/**
* Drop all capabilities of the current process.
*
* Drops all capabalities, excect those exlcuded using keep_cap().
* This should be called after the initialization of the daemon because
* some plugins require the process to keep additional capabilities.
*
* @return TRUE, if successful
*/
bool (*drop_capabilities)(daemon_t *this);
/**
* Initialize the daemon.
*
src/libcharon/plugins/duplicheck/duplicheck_notify.c
+2 -1
View File
@@ -84,7 +84,8 @@ static bool open_socket(private_duplicheck_notify_t *this)
return FALSE;
}
umask(old);
if (chown(addr.sun_path, charon->uid, charon->gid) != 0)
if (chown(addr.sun_path, charon->caps->get_uid(charon->caps),
charon->caps->get_gid(charon->caps)) != 0)
{
DBG1(DBG_CFG, "changing duplicheck socket permissions failed: %s",
strerror(errno));
src/libcharon/plugins/eap_gtc/eap_gtc_plugin.c
+1 -1
View File
@@ -63,7 +63,7 @@ plugin_t *eap_gtc_plugin_create()
);
/* required for PAM authentication */
charon->keep_cap(charon, CAP_AUDIT_WRITE);
charon->caps->keep(charon->caps, CAP_AUDIT_WRITE);
charon->eap->add_method(charon->eap, EAP_GTC, 0, EAP_SERVER,
(eap_constructor_t)eap_gtc_create_server);
src/libcharon/plugins/ha/ha_ctl.c
+2 -1
View File
@@ -129,7 +129,8 @@ ha_ctl_t *ha_ctl_create(ha_segments_t *segments, ha_cache_t *cache)
}
umask(old);
}
if (chown(HA_FIFO, charon->uid, charon->gid) != 0)
if (chown(HA_FIFO, charon->caps->get_uid(charon->caps),
charon->caps->get_gid(charon->caps)) != 0)
{
DBG1(DBG_CFG, "changing HA FIFO permissions failed: %s",
strerror(errno));
src/libcharon/plugins/ha/ha_kernel.c
+2 -1
View File
@@ -316,7 +316,8 @@ static void disable_all(private_ha_kernel_t *this)
{
while (enumerator->enumerate(enumerator, NULL, &file, NULL))
{
if (chown(file, charon->uid, charon->gid) != 0)
if (chown(file, charon->caps->get_uid(charon->caps),
charon->caps->get_gid(charon->caps)) != 0)
{
DBG1(DBG_CFG, "changing ClusterIP permissions failed: %s",
strerror(errno));
src/libcharon/plugins/smp/smp.c
+2 -1
View File
@@ -757,7 +757,8 @@ plugin_t *smp_plugin_create()
return NULL;
}
umask(old);
if (chown(unix_addr.sun_path, charon->uid, charon->gid) != 0)
if (chown(unix_addr.sun_path, charon->caps->get_uid(charon->caps),
charon->caps->get_gid(charon->caps)) != 0)
{
DBG1(DBG_CFG, "changing XML socket permissions failed: %s", strerror(errno));
}
src/libcharon/plugins/stroke/stroke_socket.c
+2 -1
View File
@@ -758,7 +758,8 @@ static bool open_socket(private_stroke_socket_t *this)
return FALSE;
}
umask(old);
if (chown(socket_addr.sun_path, charon->uid, charon->gid) != 0)
if (chown(socket_addr.sun_path, charon->caps->get_uid(charon->caps),
charon->caps->get_gid(charon->caps)) != 0)
{
DBG1(DBG_CFG, "changing stroke socket permissions failed: %s",
strerror(errno));
src/libcharon/plugins/whitelist/whitelist_control.c
+2 -1
View File
@@ -77,7 +77,8 @@ static bool open_socket(private_whitelist_control_t *this)
return FALSE;
}
umask(old);
if (chown(addr.sun_path, charon->uid, charon->gid) != 0)
if (chown(addr.sun_path, charon->caps->get_uid(charon->caps),
charon->caps->get_gid(charon->caps)) != 0)
{
DBG1(DBG_CFG, "changing whitelist socket permissions failed: %s",
strerror(errno));