From patchwork Mon Mar 23 11:02:55 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexandru Ardelean X-Patchwork-Id: 453354 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from arrakis.dune.hu (arrakis.dune.hu [78.24.191.176]) (using TLSv1.1 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 8AB3F140134 for ; Mon, 23 Mar 2015 22:03:21 +1100 (AEDT) Authentication-Results: ozlabs.org; dkim=fail reason="verification failed; unprotected key" header.d=gmail.com header.i=@gmail.com header.b=WguLdqLv; dkim-adsp=none (unprotected policy); dkim-atps=neutral Received: from arrakis.dune.hu (localhost [127.0.0.1]) by arrakis.dune.hu (Postfix) with ESMTP id 3166A28C5FD; Mon, 23 Mar 2015 12:02:35 +0100 (CET) X-Spam-Checker-Version: SpamAssassin 3.3.2 (2011-06-06) on arrakis.dune.hu X-Spam-Level: X-Spam-Status: No, score=-1.5 required=5.0 tests=BAYES_00,FREEMAIL_FROM, T_DKIM_INVALID autolearn=unavailable version=3.3.2 Received: from arrakis.dune.hu (localhost [127.0.0.1]) by arrakis.dune.hu (Postfix) with ESMTP id 2D91528C1B3 for ; Mon, 23 Mar 2015 12:02:30 +0100 (CET) X-policyd-weight: using cached result; rate: -8.5 Received: from mail-we0-f182.google.com (mail-we0-f182.google.com [74.125.82.182]) by arrakis.dune.hu (Postfix) with ESMTPS for ; Mon, 23 Mar 2015 12:02:29 +0100 (CET) Received: by wegp1 with SMTP id p1so134512878weg.1 for ; Mon, 23 Mar 2015 04:03:01 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=fKeDzOQB+/dqg2MJfVkYkiw+wqsWtLE0u3ZPOc9n0go=; b=WguLdqLv/pWbPlebYXqp0O4DdCPwJtoDfdZdbAi3Xem/5ABbOiedz4MpZoWoB7ZihQ E3S7keC1bBfzc7Oghx9xGhAZKbyc4+oiiy7Fs2J2Xjl565nTKKRo8XfU1IlSPsRHmZ8J CVhxbXDH9Vg1Z1219TyggB/yzj6KbPKSWjKYvH5EJ2sK87j+3SeQmVFkztE3zZFgvmvn d+MjlUof3sQxmWVmKif0WtfZOP/ZYyg1TaPOcDjjkwUZBXbo31wqaBfAt14WRpS0X7vm sUd4t5MUT7FND1Nlr7aaj09/oahaQELopFPhxe+S1YaOif5fJ1Wx284mtyjTrX2DfsNj 0KCw== X-Received: by 10.180.74.135 with SMTP id t7mr18404114wiv.72.1427108581442; Mon, 23 Mar 2015 04:03:01 -0700 (PDT) Received: from orion.local ([194.105.29.179]) by mx.google.com with ESMTPSA id dz6sm10712206wib.0.2015.03.23.04.03.00 (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 23 Mar 2015 04:03:00 -0700 (PDT) From: Alexandru Ardelean To: openwrt-devel@lists.openwrt.org Date: Mon, 23 Mar 2015 13:02:55 +0200 Message-Id: <1427108575-16678-1-git-send-email-ardeleanalex@gmail.com> X-Mailer: git-send-email 2.1.2 Cc: Alexandru Ardelean Subject: [OpenWrt-Devel] [PATCH] lldpd: add option to disable priviledge separation X-BeenThere: openwrt-devel@lists.openwrt.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: OpenWrt Development List List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: openwrt-devel-bounces@lists.openwrt.org Sender: "openwrt-devel" From: Alexandru Ardelean Helpful to disable when debugging lldpd crashes (when working on it). When priviledge separation is on, some crashes are stack-traced to some priviledge separation code. Signed-off-by: Alexandru Ardelean --- package/network/services/lldpd/Config.in | 5 ++ package/network/services/lldpd/Makefile | 2 + ...lookup-for-_lldpd-when-privsep-is-disable.patch | 73 ++++++++++++++++++++++ 3 files changed, 80 insertions(+) create mode 100644 package/network/services/lldpd/patches/0001-priv-don-t-lookup-for-_lldpd-when-privsep-is-disable.patch diff --git a/package/network/services/lldpd/Config.in b/package/network/services/lldpd/Config.in index a416490..4a8b5e7d 100644 --- a/package/network/services/lldpd/Config.in +++ b/package/network/services/lldpd/Config.in @@ -1,6 +1,11 @@ menu "Configuration" depends on PACKAGE_lldpd +config LLDPD_WITH_PRIVSEP + bool + default y + prompt "Enable priviledge separation (run lldpd with a chrooted 'lldpd' user)" + config LLDPD_WITH_CDP bool default y diff --git a/package/network/services/lldpd/Makefile b/package/network/services/lldpd/Makefile index ff367f1..d80840e 100644 --- a/package/network/services/lldpd/Makefile +++ b/package/network/services/lldpd/Makefile @@ -85,9 +85,11 @@ define Package/lldpd/conffiles endef CONFIGURE_ARGS += \ + $(if $(CONFIG_LLDPD_WITH_PRIVSEP), \ --with-privsep-user=lldp \ --with-privsep-group=lldp \ --with-privsep-chroot=/var/run/lldp \ + ,--disable-privsep) \ --with-readline=no \ --with-embedded-libevent=no \ $(if $(CONFIG_LLDPD_WITH_CDP),,--disable-cdp) \ diff --git a/package/network/services/lldpd/patches/0001-priv-don-t-lookup-for-_lldpd-when-privsep-is-disable.patch b/package/network/services/lldpd/patches/0001-priv-don-t-lookup-for-_lldpd-when-privsep-is-disable.patch new file mode 100644 index 0000000..907c21b --- /dev/null +++ b/package/network/services/lldpd/patches/0001-priv-don-t-lookup-for-_lldpd-when-privsep-is-disable.patch @@ -0,0 +1,73 @@ +From 28bf40220840c277d70ed66f6d58729ebb975de8 Mon Sep 17 00:00:00 2001 +From: Vincent Bernat +Date: Thu, 12 Feb 2015 08:07:43 +0100 +Subject: [PATCH] priv: don't lookup for _lldpd when privsep is disabled + +Closes #95 +--- + src/daemon/lldpd.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/src/daemon/lldpd.c b/src/daemon/lldpd.c +index f868fc7..6a3a160 100644 +--- a/src/daemon/lldpd.c ++++ b/src/daemon/lldpd.c +@@ -1335,11 +1335,13 @@ lldpd_main(int argc, char *argv[], char *envp[]) + int receiveonly = 0; + int ctl; + ++#ifdef ENABLE_PRIVSEP + /* Non privileged user */ + struct passwd *user; + struct group *group; + uid_t uid; + gid_t gid; ++#endif + + saved_argv = argv; + +@@ -1493,12 +1495,14 @@ lldpd_main(int argc, char *argv[], char *envp[]) + log_debug("main", "lldpd starting..."); + + /* Grab uid and gid to use for priv sep */ ++#ifdef ENABLE_PRIVSEP + if ((user = getpwnam(PRIVSEP_USER)) == NULL) + fatal("main", "no " PRIVSEP_USER " user for privilege separation"); + uid = user->pw_uid; + if ((group = getgrnam(PRIVSEP_GROUP)) == NULL) + fatal("main", "no " PRIVSEP_GROUP " group for privilege separation"); + gid = group->gr_gid; ++#endif + + /* Create and setup socket */ + int retry = 1; +@@ -1526,12 +1530,14 @@ lldpd_main(int argc, char *argv[], char *envp[]) + log_warn("main", "unable to create control socket"); + fatalx("giving up"); + } ++#ifdef ENABLE_PRIVSEP + if (chown(ctlname, uid, gid) == -1) + log_warn("main", "unable to chown control socket"); + if (chmod(ctlname, + S_IRUSR | S_IWUSR | S_IXUSR | + S_IRGRP | S_IWGRP | S_IXGRP) == -1) + log_warn("main", "unable to chmod control socket"); ++#endif + + /* Disable SIGPIPE */ + signal(SIGPIPE, SIG_IGN); +@@ -1576,7 +1582,11 @@ lldpd_main(int argc, char *argv[], char *envp[]) + } + + log_debug("main", "initialize privilege separation"); ++#ifdef ENABLE_PRIVSEP + priv_init(PRIVSEP_CHROOT, ctl, uid, gid); ++#else ++ priv_init(PRIVSEP_CHROOT, ctl, 0, 0); ++#endif + + /* Initialization of global configuration */ + if ((cfg = (struct lldpd *) +-- +2.1.2 +