denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

simplified capability dropping

Browse Source
This commit is contained in:
Martin Willi
2007-05-09 13:12:06 +00:00
parent 3cd3f48428
commit a6a039aa10
9 changed files with 32 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/charon/control/interfaces/dbus_interface.c
+1 -2
View File
@@ -338,8 +338,7 @@ static DBusHandlerResult signal_handler(DBusConnection *con, DBusMessage *msg,
*/
static void dispatch(private_dbus_interface_t *this)
{
/* drop threads capabilities */
charon->drop_capabilities(charon, TRUE, FALSE, FALSE);
charon->drop_capabilities(charon, TRUE);
while (dbus_connection_read_write_dispatch(this->conn, -1))
{
src/charon/control/interfaces/stroke_interface.c
+1 -2
View File
@@ -1535,8 +1535,7 @@ static void stroke_receive(private_stroke_interface_t *this)
int oldstate;
int strokefd;
/* drop threads capabilities, keep NET_ADMIN to query use times for status */
charon->drop_capabilities(charon, TRUE, TRUE, FALSE);
charon->drop_capabilities(charon, TRUE);
/* ignore sigpipe. writing over the pipe back to the console
* only fails if SIGPIPE is ignored. */
src/charon/daemon.c
+23 -32
View File
@@ -224,34 +224,14 @@ static void kill_daemon(private_daemon_t *this, char *reason)
/**
* drop daemon capabilities
*/
static void drop_capabilities(private_daemon_t *this, bool change_uid,
bool netlink, bool bind)
static void drop_capabilities(private_daemon_t *this, bool full)
{
struct __user_cap_header_struct hdr;
struct __user_cap_data_struct data;
u_int32_t keep = 0;
/* CAP_NET_ADMIN is needed to use netlink */
u_int32_t keep = (1<<CAP_NET_ADMIN);
if (netlink)
{
/* CAP_NET_ADMIN is needed to use netlink */
keep |= (1<<CAP_NET_ADMIN);
}
if (bind)
{
/* CAP_NET_BIND_SERVICE to bind services below port 1024,
* CAP_NET_RAW to create RAW sockets.
* CAP_DAC_READ_SEARCH is needed to read ipsec.secrets */
keep |= (1<<CAP_NET_BIND_SERVICE);
keep |= (1<<CAP_NET_RAW);
keep |= (1<<CAP_DAC_READ_SEARCH);
}
hdr.version = _LINUX_CAPABILITY_VERSION;
hdr.pid = 0;
data.effective = data.permitted = keep;
data.inheritable = 0;
if (change_uid)
if (full)
{
# if IPSEC_GID
setgid(IPSEC_GID);
@@ -260,6 +240,20 @@ static void drop_capabilities(private_daemon_t *this, bool change_uid,
setuid(IPSEC_UID);
# endif
}
else
{
/* CAP_NET_BIND_SERVICE to bind services below port 1024,
* CAP_NET_RAW to create RAW sockets.
* CAP_DAC_READ_SEARCH is needed to read ipsec.secrets */
keep |= (1<<CAP_NET_BIND_SERVICE);
keep |= (1<<CAP_NET_RAW);
keep |= (1<<CAP_DAC_READ_SEARCH);
}
hdr.version = _LINUX_CAPABILITY_VERSION;
hdr.pid = 0;
data.effective = data.permitted = keep;
data.inheritable = 0;
if (capset(&hdr, &data))
{
@@ -372,7 +366,7 @@ private_daemon_t *daemon_create(void)
/* assign methods */
this->public.kill = (void (*) (daemon_t*,char*))kill_daemon;
this->public.drop_capabilities = (void(*)(daemon_t*,bool,bool,bool))drop_capabilities;
this->public.drop_capabilities = (void(*)(daemon_t*,bool))drop_capabilities;
/* NULL members for clean destruction */
this->public.socket = NULL;
@@ -458,8 +452,8 @@ int main(int argc, char *argv[])
prctl(PR_SET_KEEPCAPS, 1);
/* keep bind() and netlink capabilities, stay as root until all files loaded */
drop_capabilities(NULL, FALSE, TRUE, TRUE);
/* drop the capabilities we won't need at all */
drop_capabilities(NULL, FALSE);
/* use CTRL loglevel for default */
for (signal = 0; signal < DBG_MAX; signal++)
@@ -534,9 +528,6 @@ int main(int argc, char *argv[])
/* initialize daemon */
initialize(private_charon, use_syslog, levels);
/* drop bind() capability, netlink is needed for cleanup */
drop_capabilities(private_charon, FALSE, TRUE, FALSE);
/* load pluggable EAP modules */
eap_method_load(eapdir);
@@ -568,8 +559,8 @@ int main(int argc, char *argv[])
}
list->destroy(list);
/* change UID */
drop_capabilities(private_charon, TRUE, TRUE, FALSE);
/* drop additional capabilites (bind & root) */
drop_capabilities(private_charon, TRUE);
/* run daemon */
run(private_charon);
src/charon/daemon.h
+2 -5
View File
@@ -422,12 +422,9 @@ struct daemon_t {
* @brief Let the calling thread drop its capabilities.
*
* @param this calling daemon
* @param change_uid TRUE to change UID/GID to IPSEC_UID/IPSEC_GID
* @param netlink TRUE to keep CAP_NET_ADMIN (using netlink)
* @param bind TRUE to keep CAP_NET_BIND_SERVICE and CAP_NET_RAW
* @param full TRUE to drop as many as possible
*/
void (*drop_capabilities) (daemon_t *this, bool change_uid,
bool netlink, bool bind);
void (*drop_capabilities) (daemon_t *this, bool full);
/**
* @brief Shut down the daemon.
src/charon/kernel/kernel_interface.c
+1 -2
View File
@@ -446,8 +446,7 @@ static void add_attribute(struct nlmsghdr *hdr, int rta_type, chunk_t data,
*/
static void receive_events(private_kernel_interface_t *this)
{
/* keep netlink capabilities only */
charon->drop_capabilities(charon, TRUE, TRUE, FALSE);
charon->drop_capabilities(charon, TRUE);
while(TRUE)
{
src/charon/network/receiver.c
+1 -2
View File
@@ -254,8 +254,7 @@ static void receive_packets(private_receiver_t *this)
DBG1(DBG_NET, "receiver thread running, thread_ID: %06u",
(int)pthread_self());
/* drop threads capabilities */
charon->drop_capabilities(charon, TRUE, FALSE, FALSE);
charon->drop_capabilities(charon, TRUE);
while (TRUE)
{
src/charon/network/sender.c
+1 -2
View File
@@ -88,8 +88,7 @@ static void send_packets(private_sender_t * this)
pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
DBG1(DBG_NET, "sender thread running, thread_ID: %06u", (int)pthread_self());
/* drop threads capabilities */
charon->drop_capabilities(charon, TRUE, FALSE, FALSE);
charon->drop_capabilities(charon, TRUE);
while (TRUE)
{
src/charon/processing/scheduler.c
+1 -2
View File
@@ -60,8 +60,7 @@ static void get_events(private_scheduler_t * this)
DBG1(DBG_JOB, "scheduler thread running, thread_ID: %06u",
(int)pthread_self());
/* drop threads capabilities */
charon->drop_capabilities(charon, TRUE, FALSE, FALSE);
charon->drop_capabilities(charon, TRUE);
while (TRUE)
{
src/charon/processing/thread_pool.c
+1 -2
View File
@@ -73,8 +73,7 @@ static void process_jobs(private_thread_pool_t *this)
DBG1(DBG_JOB, "worker thread running, thread_ID: %06u",
(int)pthread_self());
/* drop threads capabilities, except CAP_NET_ADMIN */
charon->drop_capabilities(charon, TRUE, TRUE, FALSE);
charon->drop_capabilities(charon, TRUE);
while (TRUE)
{