All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] iputils: Add capability dropping
@ 2012-02-05 18:16 Ángel González
  2012-02-21 11:59 ` YOSHIFUJI Hideaki
  0 siblings, 1 reply; 2+ messages in thread
From: Ángel González @ 2012-02-05 18:16 UTC (permalink / raw)
  To: netdev; +Cc: yoshfuji

This patch adds support for dropping capabilities to the iputils programs
which need root privileges (ping, ping6, clockdiff, traceroute6), so that
users installing them suid can instead install them setcap cap_net_raw+ep

The feature adds libcap as a requisite. In order to disable the feature
 sed -i "s/-DCAPABILITIES//;s/ -lcap//" Makefile


Signed-off-by: Ángel González <ingenit@zoho.com>
---

diff -ur iputils/Makefile iputils-capabilities/Makefile
--- iputils/Makefile	2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/Makefile	2012-02-05 17:40:18.000000000 +0100
@@ -14,7 +14,7 @@
 # What a pity, all new gccs are buggy and -Werror does not work. Sigh.
 #CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g -Werror
 CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g
-CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES) 
+CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES) -DCAPABILITIES
 
 IPV4_TARGETS=tracepath ping clockdiff rdisc arping tftpd rarpd
 IPV6_TARGETS=tracepath6 traceroute6 ping6
@@ -25,11 +25,12 @@
 
 all: $(TARGETS)
 
-
+clockdiff: -lcap
+traceroute6: -lcap
 tftpd: tftpd.o tftpsubs.o
-arping: arping.o -lsysfs
-ping: ping.o ping_common.o
-ping6: ping6.o ping_common.o -lresolv -lcrypto
+arping: arping.o -lsysfs -lcap
+ping: ping.o ping_common.o -lcap
+ping6: ping6.o ping_common.o -lresolv -lcrypto -lcap
 ping.o ping6.o ping_common.o: ping_common.h
 tftpd.o tftpsubs.o: tftp.h
 
diff -ur iputils/arping.c iputils-capabilities/arping.c
--- iputils/arping.c	2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/arping.c	2012-02-05 17:23:53.000000000 +0100
@@ -22,6 +22,9 @@
 #include <linux/if_ether.h>
 #include <net/if_arp.h>
 #include <sys/uio.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
 
 #include <netdb.h>
 #include <unistd.h>
@@ -356,6 +359,17 @@
 		exit(-1);
 	}
 
+#ifdef CAPABILITIES
+	{
+		cap_t caps = cap_init();
+		if (cap_set_proc(caps)) {
+			perror("arping: cap_set_proc");
+			exit(-1);
+		}
+		cap_free(caps);
+	}
+#endif
+
 	while ((ch = getopt(argc, argv, "h?bfDUAqc:w:s:I:V")) != EOF) {
 		switch(ch) {
 		case 'b':
diff -ur iputils/clockdiff.c iputils-capabilities/clockdiff.c
--- iputils/clockdiff.c	2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/clockdiff.c	2012-02-05 17:33:14.000000000 +0100
@@ -20,6 +20,9 @@
 #include <arpa/inet.h>
 #include <errno.h>
 #include <linux/types.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
 
 void usage(void) __attribute__((noreturn));
 
@@ -530,6 +533,20 @@
   exit(1);
 }
 
+void drop_rights(void) {
+#ifdef CAPABILITIES
+	cap_t caps = cap_init();
+	if (cap_set_proc(caps)) {
+		perror("clockdiff: cap_set_proc");
+		exit(-1);
+	}
+	cap_free(caps);
+#endif
+	if (setuid(getuid())) {
+		perror("clockdiff: setuid");
+		exit(-1);
+	}
+}
 
 int
 main(int argc, char *argv[])
@@ -541,10 +558,7 @@
 	int n_errno = 0;
 
 	if (argc < 2) {
-		if (setuid(getuid())) {
-			perror("clockdiff: setuid");
-			exit(-1);
-		}
+		drop_rights();
 		usage();
 	}
 
@@ -554,11 +568,7 @@
 	errno = 0;
 	if (nice(-16) == -1)
 		n_errno = errno;
-
-	if (setuid(getuid())) {
-		perror("clockdiff: setuid");
-		exit(-1);
-	}
+	drop_rights();
 
 	if (argc == 3) {
 		if (strcmp(argv[1], "-o") == 0) {
diff -ur iputils/ping.c iputils-capabilities/ping.c
--- iputils/ping.c	2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/ping.c	2012-02-05 17:33:51.000000000 +0100
@@ -62,6 +62,9 @@
 
 #include <netinet/ip.h>
 #include <netinet/ip_icmp.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
 
 #ifndef ICMP_FILTER
 #define ICMP_FILTER	1
@@ -131,6 +134,16 @@
 		perror("ping: setuid");
 		exit(-1);
 	}
+#ifdef CAPABILITIES
+	{
+		cap_t caps = cap_init();
+		if (cap_set_proc(caps)) {
+			perror("ping: cap_set_proc");
+			exit(-1);
+		}
+		cap_free(caps);
+	}
+#endif
 
 	source.sin_family = AF_INET;
 
diff -ur iputils/ping6.c iputils-capabilities/ping6.c
--- iputils/ping6.c	2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/ping6.c	2012-02-05 17:33:44.000000000 +0100
@@ -72,6 +72,9 @@
 #include <netinet/ip6.h>
 #include <netinet/icmp6.h>
 #include <resolv.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
 
 #include "ping6_niquery.h"
 
@@ -551,9 +554,19 @@
 
 	uid = getuid();
 	if (setuid(uid)) {
-		perror("ping: setuid");
+		perror("ping6: setuid");
 		exit(-1);
 	}
+#ifdef CAPABILITIES
+	{
+		cap_t caps = cap_init();
+		if (cap_set_proc(caps)) {
+			perror("ping6: cap_set_proc");
+			exit(-1);
+		}
+		cap_free(caps);
+	}
+#endif
 
 	source.sin6_family = AF_INET6;
 	memset(&firsthop, 0, sizeof(firsthop));
diff -ur iputils/traceroute6.c iputils-capabilities/traceroute6.c
--- iputils/traceroute6.c	2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/traceroute6.c	2012-02-05 17:33:59.000000000 +0100
@@ -249,6 +249,9 @@
 #include <netinet/ip6.h>
 #include <netinet/icmp6.h>
 #include <linux/types.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
 
 #include <arpa/inet.h>
 
@@ -342,6 +345,16 @@
 		perror("traceroute6: setuid");
 		exit(-1);
 	}
+#ifdef CAPABILITIES
+	{
+		cap_t caps = cap_init();
+		if (cap_set_proc(caps)) {
+			perror("traceroute6: cap_set_proc");
+			exit(-1);
+		}
+		cap_free(caps);
+	}
+#endif
 
 	on = 1;
 	seq = tos = 0;

^ permalink raw reply	[flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-02-21 11:59 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-05 18:16 [PATCH] iputils: Add capability dropping Ángel González
2012-02-21 11:59 ` YOSHIFUJI Hideaki

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.