berdav/cado
1
0
Fork 0
mirror of https://github.com/rd235/cado synced 2024-12-26 14:03:07 +01:00
Code Issues Releases Wiki Activity

portability fix (support missing PR_CAP_AMBIENT)

Browse Source
This commit is contained in:
Renzo Davoli 2016-12-24 16:47:55 +01:00
parent 499a930cd3
commit 32660373c8
4 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile.am
View File

@ -28,6 +28,7 @@ install-exec-hook:
chmod g+s $(DESTDIR)$(bindir)/scado
chown cado $(DESTDIR)$(bindir)/cado
chmod u+s $(DESTDIR)$(bindir)/cado
ldconfig $(DESTDIR)$(libdir)
$(DESTDIR)$(bindir)/cado -s
CLEANFILES = cado_paths.h

2
read_conf.c
View File

@ -51,7 +51,7 @@ static int groupmatch (char *group, char **grouplist) {
/* execs security, children must drop their capabilities */
static int drop_capabilities(void *useless) {
return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
return drop_all_ambient_cap();
}
/* get_authorized_caps returns the set of authorized capabilities

18
set_ambient_cap.c
View File

@ -1,21 +1,21 @@
/*
/*
* cado: execute a command in a capability ambient
* Copyright (C) 2016 Renzo Davoli, University of Bologna
*
*
* This file is part of cado.
*
* Cado is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version.
*
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
*
* You should have received a copy of the GNU General Public License
* along with this program; If not, see <http://www.gnu.org/licenses/>.
* along with this program; If not, see <http://www.gnu.org/licenses/>.
*
*/
@ -35,6 +35,9 @@
#ifndef PR_CAP_AMBIENT_LOWER
#define PR_CAP_AMBIENT_LOWER 3
#endif
#ifndef PR_CAP_AMBIENT_CLEAR_ALL
#define PR_CAP_AMBIENT_CLEAR_ALL 4
#endif
/* set the ambient capabilities to match the bitmap capset.
the capability #k is active if and only if the (k+1)-th least significative bit in capset is 1.
@ -88,6 +91,10 @@ void drop_ambient_cap(uint64_t capset) {
}
}
int drop_all_ambient_cap(void) {
return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
}
/* turn cap_dac_read_search on and off to have "extra" powers only when needed */
void raise_cap_dac_read_search(void) {
cap_value_t cap=CAP_DAC_READ_SEARCH;
@ -102,3 +109,4 @@ void lower_cap_dac_read_search(void) {
cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_CLEAR);
cap_set_proc(caps);
}

2
set_ambient_cap.h
View File

@ -6,6 +6,8 @@ void set_ambient_cap(uint64_t capset);
void drop_ambient_cap(uint64_t capset);
int drop_all_ambient_cap(void);
void raise_cap_dac_read_search(void);
void lower_cap_dac_read_search(void);