denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

capabilities: Ensure required capabilities are actually held by the process/user

Browse Source
This commit is contained in:
Tobias Brunner
2013-06-25 17:16:32 +02:00
parent a650242643
commit 2e21bac19a
5 changed files with 77 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/utils/capabilities.c
+51 -2
View File
@@ -1,5 +1,5 @@
/*
* Copyright (C) 2012 Tobias Brunner
* Copyright (C) 2012-2013 Tobias Brunner
* Hochschule fuer Technik Rapperswil
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
@@ -76,9 +76,57 @@ struct private_capabilities_t {
#endif
};
METHOD(capabilities_t, keep, void,
static bool has_capability(u_int cap)
{
#ifndef CAPABILITIES
/* if we can't check the actual capabilities assume only root has it */
return getuid() == 0;
#endif /* !CAPABILITIES */
#ifdef CAPABILITIES_LIBCAP
cap_flag_value_t val;
cap_t caps;
bool ok;
caps = cap_get_proc();
if (!caps)
{
return FALSE;
}
ok = cap_get_flag(caps, cap, CAP_PERMITTED, &val) == 0 && val == CAP_SET;
cap_free(caps);
return ok;
#endif /* CAPABILITIES_LIBCAP */
#ifdef CAPABILITIES_NATIVE
struct __user_cap_header_struct header = {
#if defined(_LINUX_CAPABILITY_VERSION_3)
.version = _LINUX_CAPABILITY_VERSION_3,
#elif defined(_LINUX_CAPABILITY_VERSION_2)
.version = _LINUX_CAPABILITY_VERSION_2,
#elif defined(_LINUX_CAPABILITY_VERSION_1)
.version = _LINUX_CAPABILITY_VERSION_1,
#else
.version = _LINUX_CAPABILITY_VERSION,
#endif
};
struct __user_cap_data_struct caps[2];
int i = 0;
if (cap >= 32)
{
i++;
cap -= 32;
}
return capget(&header, caps) == 0 && caps[i].permitted & (1 << cap);
#endif /* CAPABILITIES_NATIVE */
}
METHOD(capabilities_t, keep, bool,
private_capabilities_t *this, u_int cap)
{
if (!has_capability(cap))
{
return FALSE;
}
#ifdef CAPABILITIES_LIBCAP
cap_set_flag(this->caps, CAP_EFFECTIVE, 1, &cap, CAP_SET);
cap_set_flag(this->caps, CAP_INHERITABLE, 1, &cap, CAP_SET);
@@ -96,6 +144,7 @@ METHOD(capabilities_t, keep, void,
this->caps[i].permitted |= 1 << cap;
this->caps[i].inheritable |= 1 << cap;
#endif /* CAPABILITIES_NATIVE */
return TRUE;
}
METHOD(capabilities_t, get_uid, uid_t,
src/libstrongswan/utils/capabilities.h
+7 -2
View File
@@ -1,4 +1,6 @@
/*
* Copyright (C) 2013 Tobias Brunner
* Hochschule fuer Technik Rapperswil
* Copyright (C) 2012 Martin Willi
* Copyright (C) 2012 revosec AG
*
@@ -36,11 +38,14 @@ typedef struct capabilities_t capabilities_t;
struct capabilities_t {
/**
* Register a capability to keep while calling drop().
* Register a capability to keep while calling drop(). Verifies that the
* capability is currently held.
*
* @param cap capability to keep
* @return FALSE if the capability is currently not held
*/
void (*keep)(capabilities_t *this, u_int cap);
bool (*keep)(capabilities_t *this,
u_int cap) __attribute__((warn_unused_result));
/**
* Get the user ID set through set_uid/resolve_uid.