denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow strongSwan to be spawned as non-root user

Browse Source 
This patch allows for giving strongSwan only the runtime capabilities it
needs, rather than full root privileges.

Adds preprocessor directives which allow strongSwan to be configured to
 1) start up as a non-root user
 2) avoid modprobe()'ing IPsec kernel modules into the kernel, which
    would normally require root or CAP_SYS_MODULE

Additionally, some small mods to charon/libstrongswan ensure that charon
fully supports starting as a non-root user.

Tested with strongSwan 5.5.3.
This commit is contained in:
Micah Morton
2018-05-14 15:50:01 +02:00
committed by Tobias Brunner
parent 0d2e18a189
commit b9fcc61991
5 changed files with 26 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libstrongswan/networking/streams/stream_service_unix.c
+6 -3
View File
@@ -39,8 +39,9 @@ stream_service_t *stream_service_create_unix(char *uri, int backlog)
}
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) service socket */
DBG1(DBG_NET, "socket '%s' requires CAP_CHOWN capability", uri);
return NULL;
DBG1(DBG_NET, "cannot change ownership of socket '%s' without "
"CAP_CHOWN capability. socket directory should be accessible to "
"UID/GID under which the deamon will run", uri);
}
fd = socket(AF_UNIX, SOCK_STREAM, 0);
if (fd == -1)
@@ -58,7 +59,9 @@ stream_service_t *stream_service_create_unix(char *uri, int backlog)
return NULL;
}
umask(old);
if (chown(addr.sun_path, lib->caps->get_uid(lib->caps),
/* only attempt to chown() socket if we have CAP_CHOWN */
if (lib->caps->check(lib->caps, CAP_CHOWN) &&
chown(addr.sun_path, lib->caps->get_uid(lib->caps),
lib->caps->get_gid(lib->caps)) != 0)
{
DBG1(DBG_NET, "changing socket permissions for '%s' failed: %s",