Re: [PATCH] iputils: Add capability dropping

[YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>]

Applied. Thank you.

Ángel González wrote:
> This patch adds support for dropping capabilities to the iputils programs
> which need root privileges (ping, ping6, clockdiff, traceroute6), so that
> users installing them suid can instead install them setcap cap_net_raw+ep
>
> The feature adds libcap as a requisite. In order to disable the feature
>   sed -i "s/-DCAPABILITIES//;s/ -lcap//" Makefile
>
>
> Signed-off-by: Ángel González<ingenit@zoho.com>
> ---
>
> diff -ur iputils/Makefile iputils-capabilities/Makefile
> --- iputils/Makefile	2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/Makefile	2012-02-05 17:40:18.000000000 +0100
> @@ -14,7 +14,7 @@
>   # What a pity, all new gccs are buggy and -Werror does not work. Sigh.
>   #CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g -Werror
>   CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g
> -CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES)
> +CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES) -DCAPABILITIES
>
>   IPV4_TARGETS=tracepath ping clockdiff rdisc arping tftpd rarpd
>   IPV6_TARGETS=tracepath6 traceroute6 ping6
> @@ -25,11 +25,12 @@
>
>   all: $(TARGETS)
>
> -
> +clockdiff: -lcap
> +traceroute6: -lcap
>   tftpd: tftpd.o tftpsubs.o
> -arping: arping.o -lsysfs
> -ping: ping.o ping_common.o
> -ping6: ping6.o ping_common.o -lresolv -lcrypto
> +arping: arping.o -lsysfs -lcap
> +ping: ping.o ping_common.o -lcap
> +ping6: ping6.o ping_common.o -lresolv -lcrypto -lcap
>   ping.o ping6.o ping_common.o: ping_common.h
>   tftpd.o tftpsubs.o: tftp.h
>
> diff -ur iputils/arping.c iputils-capabilities/arping.c
> --- iputils/arping.c	2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/arping.c	2012-02-05 17:23:53.000000000 +0100
> @@ -22,6 +22,9 @@
>   #include<linux/if_ether.h>
>   #include<net/if_arp.h>
>   #include<sys/uio.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
>   #include<netdb.h>
>   #include<unistd.h>
> @@ -356,6 +359,17 @@
>   		exit(-1);
>   	}
>
> +#ifdef CAPABILITIES
> +	{
> +		cap_t caps = cap_init();
> +		if (cap_set_proc(caps)) {
> +			perror("arping: cap_set_proc");
> +			exit(-1);
> +		}
> +		cap_free(caps);
> +	}
> +#endif
> +
>   	while ((ch = getopt(argc, argv, "h?bfDUAqc:w:s:I:V")) != EOF) {
>   		switch(ch) {
>   		case 'b':
> diff -ur iputils/clockdiff.c iputils-capabilities/clockdiff.c
> --- iputils/clockdiff.c	2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/clockdiff.c	2012-02-05 17:33:14.000000000 +0100
> @@ -20,6 +20,9 @@
>   #include<arpa/inet.h>
>   #include<errno.h>
>   #include<linux/types.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
>   void usage(void) __attribute__((noreturn));
>
> @@ -530,6 +533,20 @@
>     exit(1);
>   }
>
> +void drop_rights(void) {
> +#ifdef CAPABILITIES
> +	cap_t caps = cap_init();
> +	if (cap_set_proc(caps)) {
> +		perror("clockdiff: cap_set_proc");
> +		exit(-1);
> +	}
> +	cap_free(caps);
> +#endif
> +	if (setuid(getuid())) {
> +		perror("clockdiff: setuid");
> +		exit(-1);
> +	}
> +}
>
>   int
>   main(int argc, char *argv[])
> @@ -541,10 +558,7 @@
>   	int n_errno = 0;
>
>   	if (argc<  2) {
> -		if (setuid(getuid())) {
> -			perror("clockdiff: setuid");
> -			exit(-1);
> -		}
> +		drop_rights();
>   		usage();
>   	}
>
> @@ -554,11 +568,7 @@
>   	errno = 0;
>   	if (nice(-16) == -1)
>   		n_errno = errno;
> -
> -	if (setuid(getuid())) {
> -		perror("clockdiff: setuid");
> -		exit(-1);
> -	}
> +	drop_rights();
>
>   	if (argc == 3) {
>   		if (strcmp(argv[1], "-o") == 0) {
> diff -ur iputils/ping.c iputils-capabilities/ping.c
> --- iputils/ping.c	2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/ping.c	2012-02-05 17:33:51.000000000 +0100
> @@ -62,6 +62,9 @@
>
>   #include<netinet/ip.h>
>   #include<netinet/ip_icmp.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
>   #ifndef ICMP_FILTER
>   #define ICMP_FILTER	1
> @@ -131,6 +134,16 @@
>   		perror("ping: setuid");
>   		exit(-1);
>   	}
> +#ifdef CAPABILITIES
> +	{
> +		cap_t caps = cap_init();
> +		if (cap_set_proc(caps)) {
> +			perror("ping: cap_set_proc");
> +			exit(-1);
> +		}
> +		cap_free(caps);
> +	}
> +#endif
>
>   	source.sin_family = AF_INET;
>
> diff -ur iputils/ping6.c iputils-capabilities/ping6.c
> --- iputils/ping6.c	2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/ping6.c	2012-02-05 17:33:44.000000000 +0100
> @@ -72,6 +72,9 @@
>   #include<netinet/ip6.h>
>   #include<netinet/icmp6.h>
>   #include<resolv.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
>   #include "ping6_niquery.h"
>
> @@ -551,9 +554,19 @@
>
>   	uid = getuid();
>   	if (setuid(uid)) {
> -		perror("ping: setuid");
> +		perror("ping6: setuid");
>   		exit(-1);
>   	}
> +#ifdef CAPABILITIES
> +	{
> +		cap_t caps = cap_init();
> +		if (cap_set_proc(caps)) {
> +			perror("ping6: cap_set_proc");
> +			exit(-1);
> +		}
> +		cap_free(caps);
> +	}
> +#endif
>
>   	source.sin6_family = AF_INET6;
>   	memset(&firsthop, 0, sizeof(firsthop));
> diff -ur iputils/traceroute6.c iputils-capabilities/traceroute6.c
> --- iputils/traceroute6.c	2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/traceroute6.c	2012-02-05 17:33:59.000000000 +0100
> @@ -249,6 +249,9 @@
>   #include<netinet/ip6.h>
>   #include<netinet/icmp6.h>
>   #include<linux/types.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
>   #include<arpa/inet.h>
>
> @@ -342,6 +345,16 @@
>   		perror("traceroute6: setuid");
>   		exit(-1);
>   	}
> +#ifdef CAPABILITIES
> +	{
> +		cap_t caps = cap_init();
> +		if (cap_set_proc(caps)) {
> +			perror("traceroute6: cap_set_proc");
> +			exit(-1);
> +		}
> +		cap_free(caps);
> +	}
> +#endif
>
>   	on = 1;
>   	seq = tos = 0;
>
>