denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Use newer Linux capability native API, if available

Browse Source
This commit is contained in:
Martin Willi
2011-01-17 18:18:21 +01:00
parent 2b52d5cb41
commit ff5538e5c0
1 changed files with 24 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/libcharon/daemon.c
+24 -9
View File
@@ -22,9 +22,11 @@
#include <time.h> #include <time.h>
#ifdef CAPABILITIES #ifdef CAPABILITIES
#ifdef HAVE_SYS_CAPABILITY_H # ifdef HAVE_SYS_CAPABILITY_H
#include <sys/capability.h> # include <sys/capability.h>
#endif /* HAVE_SYS_CAPABILITY_H */ # elif defined(CAPABILITIES_NATIVE)
# include <linux/capability.h>
# endif /* CAPABILITIES_NATIVE */
#endif /* CAPABILITIES */ #endif /* CAPABILITIES */
#include "daemon.h" #include "daemon.h"
@@ -56,7 +58,7 @@ struct private_daemon_t {
cap_t caps; cap_t caps;
#endif /* CAPABILITIES_LIBCAP */ #endif /* CAPABILITIES_LIBCAP */
#ifdef CAPABILITIES_NATIVE #ifdef CAPABILITIES_NATIVE
struct __user_cap_data_struct caps; struct __user_cap_data_struct caps[2];
#endif /* CAPABILITIES_NATIVE */ #endif /* CAPABILITIES_NATIVE */
}; };
@@ -141,9 +143,16 @@ METHOD(daemon_t, keep_cap, void,
cap_set_flag(this->caps, CAP_PERMITTED, 1, &cap, CAP_SET); cap_set_flag(this->caps, CAP_PERMITTED, 1, &cap, CAP_SET);
#endif /* CAPABILITIES_LIBCAP */ #endif /* CAPABILITIES_LIBCAP */
#ifdef CAPABILITIES_NATIVE #ifdef CAPABILITIES_NATIVE
this->caps.effective |= 1 << cap; int i = 0;
this->caps.permitted |= 1 << cap;
this->caps.inheritable |= 1 << cap; if (cap >= 32)
{
i++;
cap -= 32;
}
this->caps[i].effective |= 1 << cap;
this->caps[i].permitted |= 1 << cap;
this->caps[i].inheritable |= 1 << cap;
#endif /* CAPABILITIES_NATIVE */ #endif /* CAPABILITIES_NATIVE */
} }
@@ -158,9 +167,15 @@ METHOD(daemon_t, drop_capabilities, bool,
#endif /* CAPABILITIES_LIBCAP */ #endif /* CAPABILITIES_LIBCAP */
#ifdef CAPABILITIES_NATIVE #ifdef CAPABILITIES_NATIVE
struct __user_cap_header_struct header = { struct __user_cap_header_struct header = {
.version = _LINUX_CAPABILITY_VERSION, #if defined(_LINUX_CAPABILITY_VERSION_3)
.version = _LINUX_CAPABILITY_VERSION_3,
#elif defined(_LINUX_CAPABILITY_VERSION_2)
.version = _LINUX_CAPABILITY_VERSION_2,
#else
.version = _LINUX_CAPABILITY_VERSION_1,
#endif
}; };
if (capset(&header, &this->caps) != 0) if (capset(&header, this->caps) != 0)
{ {
return FALSE; return FALSE;
} }