From patchwork Thu Mar 7 15:13:02 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: "Yuriy M. Kaminskiy" X-Patchwork-Id: 225867 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 06A972C03BA for ; Fri, 8 Mar 2013 02:13:34 +1100 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932387Ab3CGPN3 (ORCPT ); Thu, 7 Mar 2013 10:13:29 -0500 Received: from plane.gmane.org ([80.91.229.3]:56042 "EHLO plane.gmane.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755314Ab3CGPN2 (ORCPT ); Thu, 7 Mar 2013 10:13:28 -0500 Received: from list by plane.gmane.org with local (Exim 4.69) (envelope-from ) id 1UDcVv-0007pg-0d for netdev@vger.kernel.org; Thu, 07 Mar 2013 16:13:47 +0100 Received: from 37.190.36.96 ([37.190.36.96]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 07 Mar 2013 16:13:47 +0100 Received: from yumkam by 37.190.36.96 with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 07 Mar 2013 16:13:47 +0100 X-Injected-Via-Gmane: http://gmane.org/ To: netdev@vger.kernel.org From: Yuriy Kaminskiy Subject: [resent][iputils][patch 01-07] setuid/capabilities fixups Date: Thu, 07 Mar 2013 19:13:02 +0400 Lines: 589 Message-ID: Mime-Version: 1.0 X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: 37.190.36.96 User-Agent: Mozilla-Thunderbird 2.0.0.24 (X11/20110717) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org Yuriy Kaminskiy wrote: > Run ping, look at /proc/`pidof ping`/status -> oops (capabilities are not > [permanently] dropped, some of uids are not dropped, etc). Fix assorted issues > with setuid and capabilities drop. Limited testing only, please review/check > carefully. From 4298d3af86b881ef7abb61a36f83a610fc8bb772 Mon Sep 17 00:00:00 2001 From: "Yuriy M. Kaminskiy" Date: Wed, 2 Jan 2013 03:08:30 +0400 Subject: [PATCH 7/7] ninfod: fix capabilities setting 1) -u option failed to change real uid too (likely leaving it as root); 2) it failed to drop saved uid; --- ninfod/ninfod.c | 58 +++++++++++++++++------------------------------------- 1 files changed, 18 insertions(+), 40 deletions(-) diff --git a/ninfod/ninfod.c b/ninfod/ninfod.c index f1db977..7f6a2fa 100644 --- a/ninfod/ninfod.c +++ b/ninfod/ninfod.c @@ -497,16 +497,28 @@ static void do_daemonize(void) /* --------- */ #ifdef HAVE_LIBCAP static const cap_value_t cap_net_raw = CAP_NET_RAW; -static const cap_value_t cap_setuid = CAP_SETUID; -static cap_flag_value_t cap_ok; -#else -static uid_t euid; #endif static void limit_capabilities(void) { #ifdef HAVE_LIBCAP cap_t cap_p, cap_cur_p; + cap_flag_value_t cap_ok; + + if (prctl(PR_SET_KEEPCAPS, 1) < 0) { + DEBUG(LOG_ERR, "prctl: %s\n", strerror(errno)); + exit(-1); + } + + if (setuid(opt_u ? opt_u : getuid()) < 0) { + DEBUG(LOG_ERR, "setuid: %s\n", strerror(errno)); + exit(-1); + } + + if (prctl(PR_SET_KEEPCAPS, 0) < 0) { + DEBUG(LOG_ERR, "prctl: %s\n", strerror(errno)); + exit(-1); + } cap_p = cap_init(); if (!cap_p) { @@ -520,32 +532,20 @@ static void limit_capabilities(void) exit(-1); } - /* net_raw + setuid / net_raw */ cap_get_flag(cap_cur_p, CAP_NET_RAW, CAP_PERMITTED, &cap_ok); if (cap_ok != CAP_CLEAR) { cap_set_flag(cap_p, CAP_PERMITTED, 1, &cap_net_raw, CAP_SET); cap_set_flag(cap_p, CAP_EFFECTIVE, 1, &cap_net_raw, CAP_SET); } - cap_get_flag(cap_cur_p, CAP_SETUID, CAP_PERMITTED, &cap_ok); - if (cap_ok != CAP_CLEAR) - cap_set_flag(cap_p, CAP_PERMITTED, 1, &cap_setuid, CAP_SET); - if (cap_set_proc(cap_p) < 0) { DEBUG(LOG_ERR, "cap_set_proc: %s\n", strerror(errno)); if (errno != EPERM) exit(-1); } - if (prctl(PR_SET_KEEPCAPS, 1) < 0) { - DEBUG(LOG_ERR, "prctl: %s\n", strerror(errno)); - exit(-1); - } - cap_free(cap_cur_p); cap_free(cap_p); -#else - euid = geteuid(); #endif } @@ -560,28 +560,6 @@ static void drop_capabilities(void) exit(-1); } - /* setuid / setuid */ - if (cap_ok != CAP_CLEAR) { - cap_set_flag(cap_p, CAP_PERMITTED, 1, &cap_setuid, CAP_SET); - cap_set_flag(cap_p, CAP_EFFECTIVE, 1, &cap_setuid, CAP_SET); - - if (cap_set_proc(cap_p) < 0) { - DEBUG(LOG_ERR, "cap_set_proc: %s\n", strerror(errno)); - exit(-1); - } - } - - if (seteuid(opt_u ? opt_u : getuid()) < 0) { - DEBUG(LOG_ERR, "setuid: %s\n", strerror(errno)); - exit(-1); - } - - if (prctl(PR_SET_KEEPCAPS, 0) < 0) { - DEBUG(LOG_ERR, "prctl: %s\n", strerror(errno)); - exit(-1); - } - - cap_clear(cap_p); if (cap_set_proc(cap_p) < 0) { DEBUG(LOG_ERR, "cap_set_proc: %s\n", strerror(errno)); exit(-1); @@ -667,14 +645,14 @@ int main (int argc, char **argv) appname = argv[0]; set_logfile(); + parse_args(argc, argv); + limit_capabilities(); sock = open_sock(); if (sock < 0) sock_errno = errno; - parse_args(argc, argv); - drop_capabilities(); if (opt_h || opt_v) -- 1.7.6.3