denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

capabilities: Some plugins don't actually require capabilities at runtime

Browse Source
This commit is contained in:
Tobias Brunner
2013-07-18 15:25:35 +02:00
parent 027676f750
commit dfc9902013
13 changed files with 17 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/plugins/dhcp/dhcp_plugin.c
+3 -2
View File
@@ -107,13 +107,14 @@ plugin_t *dhcp_plugin_create()
{
private_dhcp_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE))
if (!lib->caps->check(lib->caps, CAP_NET_BIND_SERVICE))
{ /* required to bind DHCP socket (port 68) */
DBG1(DBG_NET, "dhcp plugin requires CAP_NET_BIND_SERVICE capability");
return NULL;
}
else if (!lib->caps->keep(lib->caps, CAP_NET_RAW))
{ /* required to open DHCP receive socket (AF_PACKET) */
{ /* required to open DHCP receive socket (AF_PACKET). according to
* capabilities(7) it is also required to use the socket */
DBG1(DBG_NET, "dhcp plugin requires CAP_NET_RAW capability");
return NULL;
}
src/libcharon/plugins/duplicheck/duplicheck_plugin.c
+1 -1
View File
@@ -98,7 +98,7 @@ plugin_t *duplicheck_plugin_create()
return NULL;
}
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) notify socket */
DBG1(DBG_CFG, "duplicheck plugin requires CAP_CHOWN capability");
return NULL;
src/libcharon/plugins/error_notify/error_notify_plugin.c
+1 -1
View File
@@ -92,7 +92,7 @@ plugin_t *error_notify_plugin_create()
{
private_error_notify_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) notify socket */
DBG1(DBG_CFG, "error-notify plugin requires CAP_CHOWN capability");
return NULL;
src/libcharon/plugins/farp/farp_plugin.c
+2 -1
View File
@@ -93,7 +93,8 @@ plugin_t *farp_plugin_create()
private_farp_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_NET_RAW))
{ /* required to open ARP socket (AF_PACKET) */
{ /* required to open ARP socket (AF_PACKET). according to capabilities(7)
* it is also require to use the socket */
DBG1(DBG_NET, "farp plugin requires CAP_NET_RAW capability");
return NULL;
}
src/libcharon/plugins/ha/ha_plugin.c
+2 -1
View File
@@ -180,7 +180,8 @@ plugin_t *ha_plugin_create()
}
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
{ /* required to chown(2) control socket */
{ /* required to chown(2) control socket, ha_kernel also needs it at
* runtime */
DBG1(DBG_CFG, "ha plugin requires CAP_CHOWN capability");
return NULL;
}
src/libcharon/plugins/kernel_libipsec/kernel_libipsec_plugin.c
+1 -1
View File
@@ -102,7 +102,7 @@ plugin_t *kernel_libipsec_plugin_create()
{
private_kernel_libipsec_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_NET_ADMIN))
if (!lib->caps->check(lib->caps, CAP_NET_ADMIN))
{ /* required to create TUN devices */
DBG1(DBG_KNL, "kernel-libipsec plugin requires CAP_NET_ADMIN "
"capability");
src/libcharon/plugins/load_tester/load_tester_plugin.c
+1 -1
View File
@@ -269,7 +269,7 @@ plugin_t *load_tester_plugin_create()
return NULL;
}
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) control socket */
DBG1(DBG_CFG, "load-tester plugin requires CAP_CHOWN capability");
return NULL;
src/libcharon/plugins/lookip/lookip_plugin.c
+1 -1
View File
@@ -92,7 +92,7 @@ plugin_t *lookip_plugin_create()
{
private_lookip_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) control socket */
DBG1(DBG_CFG, "lookip plugin requires CAP_CHOWN capability");
return NULL;
src/libcharon/plugins/smp/smp.c
+1 -1
View File
@@ -741,7 +741,7 @@ plugin_t *smp_plugin_create()
private_smp_t *this;
mode_t old;
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) control socket */
DBG1(DBG_CFG, "smp plugin requires CAP_CHOWN capability");
return NULL;
src/libcharon/plugins/socket_default/socket_default_socket.c
+1 -1
View File
@@ -736,7 +736,7 @@ socket_default_socket_t *socket_default_socket_create()
if ((this->port && this->port < 1024) || (this->natt && this->natt < 1024))
{
if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE))
if (!lib->caps->check(lib->caps, CAP_NET_BIND_SERVICE))
{
/* required to bind ports < 1024 */
DBG1(DBG_NET, "socket-default plugin requires CAP_NET_BIND_SERVICE "
src/libcharon/plugins/stroke/stroke_plugin.c
+1 -1
View File
@@ -91,7 +91,7 @@ plugin_t *stroke_plugin_create()
{
private_stroke_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) stroke socket */
DBG1(DBG_CFG, "stroke plugin requires CAP_CHOWN capability");
return NULL;
src/libcharon/plugins/whitelist/whitelist_plugin.c
+1 -1
View File
@@ -92,7 +92,7 @@ plugin_t *whitelist_plugin_create()
{
private_whitelist_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_CHOWN))
if (!lib->caps->check(lib->caps, CAP_CHOWN))
{ /* required to chown(2) control socket */
DBG1(DBG_CFG, "whitelist plugin requires CAP_CHOWN capability");
return NULL;
src/libhydra/plugins/kernel_pfkey/kernel_pfkey_plugin.c
+1 -1
View File
@@ -62,7 +62,7 @@ plugin_t *kernel_pfkey_plugin_create()
{
private_kernel_pfkey_plugin_t *this;
if (!lib->caps->keep(lib->caps, CAP_NET_ADMIN))
if (!lib->caps->check(lib->caps, CAP_NET_ADMIN))
{ /* required to open PF_KEY sockets */
DBG1(DBG_KNL, "kernel-pfkey plugin requires CAP_NET_ADMIN capability");
return NULL;