From 8efb53300868b402e8ac0f3c77fab47cc9ce1fbb Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 6 Jul 2026 15:27:16 +0200 Subject: [PATCH] capabilities: Log warning if UID changes and no capability backend is compiled in In this case, we preserve the complete set of capabilities not just the ones we actually need. Removing the `prctl()` call isn't an option as the daemon wouldn't be functional without the capabilities. But we now warn users about this. We also only call `prctl()` if we actually switch to a non-zero UID, `has_capability()` in turn already checks that we are running as root in the `!CAPABILITIES` case. A similar warning has been added to the configure script if a user has been set at compile time. --- configure.ac | 6 ++++++ src/libstrongswan/utils/capabilities.c | 6 +++++- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/configure.ac b/configure.ac index e81ed1e8f..06d07ee05 100644 --- a/configure.ac +++ b/configure.ac @@ -1297,6 +1297,12 @@ if test x$capabilities = xlibcap; then AC_DEFINE([CAPABILITIES_LIBCAP], [], [have libpcap library]) fi +if test x$capabilities = xno -a x$ac_cv_func_prctl = xyes -a "x$ipsecuser" != xroot; then + AC_MSG_WARN(m4_normalize([ + no capability backend selected, the daemon will be unable to restrict + root-derived capabilities when changing to an unprivileged user])) +fi + if test x$selinux = xtrue; then PKG_CHECK_MODULES(selinux, [libselinux]) AC_SUBST(selinux_CFLAGS) diff --git a/src/libstrongswan/utils/capabilities.c b/src/libstrongswan/utils/capabilities.c index 9836fc9bb..536514953 100644 --- a/src/libstrongswan/utils/capabilities.c +++ b/src/libstrongswan/utils/capabilities.c @@ -422,9 +422,13 @@ METHOD(capabilities_t, drop, bool, { #ifndef WIN32 #ifdef HAVE_PRCTL - if (has_capability(this, CAP_SETPCAP, NULL)) + if (this->uid && has_capability(this, CAP_SETPCAP, NULL)) { prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0); +#ifndef CAPABILITIES + DBG0(DBG_LIB, "no capability backend compiled in, privilege drop will " + "preserve root-derived permitted capabilities"); +#endif } #endif