From patchwork Mon Apr 5 15:15:26 2010 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Layton X-Patchwork-Id: 49389 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.samba.org (fn.samba.org [216.83.154.106]) by ozlabs.org (Postfix) with ESMTP id 588ADB7C48 for ; Tue, 6 Apr 2010 01:15:35 +1000 (EST) Received: from fn.samba.org (localhost [127.0.0.1]) by lists.samba.org (Postfix) with ESMTP id 19CFDAD13E; Mon, 5 Apr 2010 09:15:35 -0600 (MDT) X-Spam-Checker-Version: SpamAssassin 3.2.5 (2008-06-10) on fn.samba.org X-Spam-Level: X-Spam-Status: No, score=-1.6 required=3.8 tests=AWL,BAYES_00,LONGWORDS, NO_MORE_FUNN,SPF_PASS autolearn=no version=3.2.5 X-Original-To: linux-cifs-client@lists.samba.org Delivered-To: linux-cifs-client@lists.samba.org Received: from cdptpa-omtalb.mail.rr.com (cdptpa-omtalb.mail.rr.com [75.180.132.122]) by lists.samba.org (Postfix) with ESMTP id E114EAD129 for ; Mon, 5 Apr 2010 09:15:28 -0600 (MDT) X-Authority-Analysis: v=1.1 cv=hj1FozfAy03f2h6OmyVtKRmRTx0FcRdqEzJSNo8ldKo= c=1 sm=0 a=kocDcb0Gf24A:10 a=ld/erqUjW76FpBUqCqkKeA==:17 a=hGzw-44bAAAA:8 a=xczT-hW5ZJ9DWqDJSksA:9 a=yVlMsx8L75bGvEcI5iYZOvbAOBcA:4 a=dowx1zmaLagA:10 a=ld/erqUjW76FpBUqCqkKeA==:117 X-Cloudmark-Score: 0 X-Originating-IP: 71.70.153.3 Received: from [71.70.153.3] ([71.70.153.3:49177] helo=mail.poochiereds.net) by cdptpa-oedge03.mail.rr.com (envelope-from ) (ecelerity 2.2.2.39 r()) with ESMTP id 03/22-28114-F8EF9BB4; Mon, 05 Apr 2010 15:15:27 +0000 Received: by mail.poochiereds.net (Postfix, from userid 4447) id 37F7758086; Mon, 5 Apr 2010 11:15:27 -0400 (EDT) From: Jeff Layton To: linux-cifs-client@lists.samba.org Date: Mon, 5 Apr 2010 11:15:26 -0400 Message-Id: <1270480527-29726-1-git-send-email-jlayton@samba.org> X-Mailer: git-send-email 1.6.6.1 Subject: [linux-cifs-client] [PATCH] mount.cifs: properly prune the capabilities bounding set X-BeenThere: linux-cifs-client@lists.samba.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: The Linux CIFS VFS client List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: linux-cifs-client-bounces@lists.samba.org Errors-To: linux-cifs-client-bounces@lists.samba.org ...libcap-ng does this in a much easier fashion. If that's not available, then we have to do it manually. Signed-off-by: Jeff Layton --- configure.ac | 3 +++ mount.cifs.c | 37 ++++++++++++++++++++++++++++++++++++- 2 files changed, 39 insertions(+), 1 deletions(-) diff --git a/configure.ac b/configure.ac index 857b0d8..d734d62 100644 --- a/configure.ac +++ b/configure.ac @@ -100,6 +100,9 @@ AC_FUNC_STRNLEN # check for required functions AC_CHECK_FUNCS([alarm atexit endpwent getmntent getpass gettimeofday inet_ntop memset realpath setenv strchr strdup strerror strncasecmp strndup strpbrk strrchr strstr strtol strtoul uname], , [AC_MSG_ERROR([necessary functions(s) not found])]) +# check for prctl +AC_CHECK_FUNCS([prctl]) + # ugly, but I'm not sure how to check for functions in a library that's not in $LIBS cu_saved_libs=$LIBS LIBS="$LIBS $KRB5_LDADD" diff --git a/mount.cifs.c b/mount.cifs.c index 1ff1846..712a8fe 100644 --- a/mount.cifs.c +++ b/mount.cifs.c @@ -47,6 +47,9 @@ #ifdef HAVE_LIBCAP_NG #include #else /* HAVE_LIBCAP_NG */ +#ifdef HAVE_PRCTL +#include +#endif /* HAVE_PRCTL */ #ifdef HAVE_LIBCAP #include #endif /* HAVE_LIBCAP */ @@ -364,14 +367,46 @@ toggle_cap_dac_override(int enable) return 0; } #else /* HAVE_LIBCAP_NG */ +#ifdef HAVE_PRCTL +static int +prune_bounding_set(void) +{ + int i, rc = 0; + static int bounding_set_cleared; + + if (bounding_set_cleared) + return 0; + + for (i = 0; i < CAP_LAST_CAP && rc == 0; ++i) + rc = prctl(PR_CAPBSET_DROP, i); + + if (rc != 0) { + fprintf(stderr, "Unable to clear capability bounding set: %d\n", rc); + return EX_SYSERR; + } + + ++bounding_set_cleared; + return 0; +} +#else /* HAVE_PRCTL */ +static int +prune_bounding_set(void) +{ + return 0; +} +#endif /* HAVE_PRCTL */ #ifdef HAVE_LIBCAP static int drop_capabilities(int parent) { - int rc = 0, ncaps; + int rc, ncaps; cap_t caps; cap_value_t cap_list[2]; + rc = prune_bounding_set(); + if (rc) + return rc; + caps = cap_get_proc(); if (caps == NULL) { fprintf(stderr, "Unable to get current capability set: %s\n",