berdav
/
cado
mirror of https://github.com/rd235/cado
1
0
Fork 0
Code Issues Releases Wiki Activity

portability fix (support missing PR_CAP_AMBIENT)

This commit is contained in:
Renzo Davoli 2016-12-24 16:47:55 +01:00
parent 499a930cd3
commit 32660373c8
4 changed files with 17 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile.am
View File

@ -28,6 +28,7 @@ install-exec-hook:
chmod g+s $(DESTDIR)$(bindir)/scado chmod g+s $(DESTDIR)$(bindir)/scado
chown cado $(DESTDIR)$(bindir)/cado chown cado $(DESTDIR)$(bindir)/cado
chmod u+s $(DESTDIR)$(bindir)/cado chmod u+s $(DESTDIR)$(bindir)/cado
ldconfig $(DESTDIR)$(libdir)
$(DESTDIR)$(bindir)/cado -s $(DESTDIR)$(bindir)/cado -s
CLEANFILES = cado_paths.h CLEANFILES = cado_paths.h

2
read_conf.c
View File

@ -51,7 +51,7 @@ static int groupmatch (char *group, char **grouplist) {
/* execs security, children must drop their capabilities */ /* execs security, children must drop their capabilities */
static int drop_capabilities(void *useless) { static int drop_capabilities(void *useless) {
return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0); return drop_all_ambient_cap();
} }
/* get_authorized_caps returns the set of authorized capabilities /* get_authorized_caps returns the set of authorized capabilities

18
set_ambient_cap.c
View File

@ -1,21 +1,21 @@
/* /*
* cado: execute a command in a capability ambient * cado: execute a command in a capability ambient
* Copyright (C) 2016 Renzo Davoli, University of Bologna * Copyright (C) 2016 Renzo Davoli, University of Bologna
* *
* This file is part of cado. * This file is part of cado.
* *
* Cado is free software; you can redistribute it and/or * Cado is free software; you can redistribute it and/or
* modify it under the terms of the GNU General Public License * modify it under the terms of the GNU General Public License
* as published by the Free Software Foundation; either version 2 * as published by the Free Software Foundation; either version 2
* of the License, or (at your option) any later version. * of the License, or (at your option) any later version.
* *
* This program is distributed in the hope that it will be useful, * This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of * but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details. * GNU General Public License for more details.
* *
* You should have received a copy of the GNU General Public License * You should have received a copy of the GNU General Public License
* along with this program; If not, see <http://www.gnu.org/licenses/>. * along with this program; If not, see <http://www.gnu.org/licenses/>.
* *
*/ */
@ -35,6 +35,9 @@
#ifndef PR_CAP_AMBIENT_LOWER #ifndef PR_CAP_AMBIENT_LOWER
#define PR_CAP_AMBIENT_LOWER 3 #define PR_CAP_AMBIENT_LOWER 3
#endif #endif
#ifndef PR_CAP_AMBIENT_CLEAR_ALL
#define PR_CAP_AMBIENT_CLEAR_ALL 4
#endif
/* set the ambient capabilities to match the bitmap capset. /* set the ambient capabilities to match the bitmap capset.
the capability #k is active if and only if the (k+1)-th least significative bit in capset is 1. the capability #k is active if and only if the (k+1)-th least significative bit in capset is 1.
@ -88,6 +91,10 @@ void drop_ambient_cap(uint64_t capset) {
} }
} }
int drop_all_ambient_cap(void) {
return prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0);
}
/* turn cap_dac_read_search on and off to have "extra" powers only when needed */ /* turn cap_dac_read_search on and off to have "extra" powers only when needed */
void raise_cap_dac_read_search(void) { void raise_cap_dac_read_search(void) {
cap_value_t cap=CAP_DAC_READ_SEARCH; cap_value_t cap=CAP_DAC_READ_SEARCH;
@ -102,3 +109,4 @@ void lower_cap_dac_read_search(void) {
cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_CLEAR); cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_CLEAR);
cap_set_proc(caps); cap_set_proc(caps);
} }

2
set_ambient_cap.h
View File

@ -6,6 +6,8 @@ void set_ambient_cap(uint64_t capset);
void drop_ambient_cap(uint64_t capset); void drop_ambient_cap(uint64_t capset);
int drop_all_ambient_cap(void);
void raise_cap_dac_read_search(void); void raise_cap_dac_read_search(void);
void lower_cap_dac_read_search(void); void lower_cap_dac_read_search(void);