* [PATCH] iputils: Add capability dropping
@ 2012-02-05 18:16 Ángel González
2012-02-21 11:59 ` YOSHIFUJI Hideaki
0 siblings, 1 reply; 2+ messages in thread
From: Ángel González @ 2012-02-05 18:16 UTC (permalink / raw)
To: netdev; +Cc: yoshfuji
This patch adds support for dropping capabilities to the iputils programs
which need root privileges (ping, ping6, clockdiff, traceroute6), so that
users installing them suid can instead install them setcap cap_net_raw+ep
The feature adds libcap as a requisite. In order to disable the feature
sed -i "s/-DCAPABILITIES//;s/ -lcap//" Makefile
Signed-off-by: Ángel González <ingenit@zoho.com>
---
diff -ur iputils/Makefile iputils-capabilities/Makefile
--- iputils/Makefile 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/Makefile 2012-02-05 17:40:18.000000000 +0100
@@ -14,7 +14,7 @@
# What a pity, all new gccs are buggy and -Werror does not work. Sigh.
#CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g -Werror
CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g
-CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES)
+CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES) -DCAPABILITIES
IPV4_TARGETS=tracepath ping clockdiff rdisc arping tftpd rarpd
IPV6_TARGETS=tracepath6 traceroute6 ping6
@@ -25,11 +25,12 @@
all: $(TARGETS)
-
+clockdiff: -lcap
+traceroute6: -lcap
tftpd: tftpd.o tftpsubs.o
-arping: arping.o -lsysfs
-ping: ping.o ping_common.o
-ping6: ping6.o ping_common.o -lresolv -lcrypto
+arping: arping.o -lsysfs -lcap
+ping: ping.o ping_common.o -lcap
+ping6: ping6.o ping_common.o -lresolv -lcrypto -lcap
ping.o ping6.o ping_common.o: ping_common.h
tftpd.o tftpsubs.o: tftp.h
diff -ur iputils/arping.c iputils-capabilities/arping.c
--- iputils/arping.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/arping.c 2012-02-05 17:23:53.000000000 +0100
@@ -22,6 +22,9 @@
#include <linux/if_ether.h>
#include <net/if_arp.h>
#include <sys/uio.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
#include <netdb.h>
#include <unistd.h>
@@ -356,6 +359,17 @@
exit(-1);
}
+#ifdef CAPABILITIES
+ {
+ cap_t caps = cap_init();
+ if (cap_set_proc(caps)) {
+ perror("arping: cap_set_proc");
+ exit(-1);
+ }
+ cap_free(caps);
+ }
+#endif
+
while ((ch = getopt(argc, argv, "h?bfDUAqc:w:s:I:V")) != EOF) {
switch(ch) {
case 'b':
diff -ur iputils/clockdiff.c iputils-capabilities/clockdiff.c
--- iputils/clockdiff.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/clockdiff.c 2012-02-05 17:33:14.000000000 +0100
@@ -20,6 +20,9 @@
#include <arpa/inet.h>
#include <errno.h>
#include <linux/types.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
void usage(void) __attribute__((noreturn));
@@ -530,6 +533,20 @@
exit(1);
}
+void drop_rights(void) {
+#ifdef CAPABILITIES
+ cap_t caps = cap_init();
+ if (cap_set_proc(caps)) {
+ perror("clockdiff: cap_set_proc");
+ exit(-1);
+ }
+ cap_free(caps);
+#endif
+ if (setuid(getuid())) {
+ perror("clockdiff: setuid");
+ exit(-1);
+ }
+}
int
main(int argc, char *argv[])
@@ -541,10 +558,7 @@
int n_errno = 0;
if (argc < 2) {
- if (setuid(getuid())) {
- perror("clockdiff: setuid");
- exit(-1);
- }
+ drop_rights();
usage();
}
@@ -554,11 +568,7 @@
errno = 0;
if (nice(-16) == -1)
n_errno = errno;
-
- if (setuid(getuid())) {
- perror("clockdiff: setuid");
- exit(-1);
- }
+ drop_rights();
if (argc == 3) {
if (strcmp(argv[1], "-o") == 0) {
diff -ur iputils/ping.c iputils-capabilities/ping.c
--- iputils/ping.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/ping.c 2012-02-05 17:33:51.000000000 +0100
@@ -62,6 +62,9 @@
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
#ifndef ICMP_FILTER
#define ICMP_FILTER 1
@@ -131,6 +134,16 @@
perror("ping: setuid");
exit(-1);
}
+#ifdef CAPABILITIES
+ {
+ cap_t caps = cap_init();
+ if (cap_set_proc(caps)) {
+ perror("ping: cap_set_proc");
+ exit(-1);
+ }
+ cap_free(caps);
+ }
+#endif
source.sin_family = AF_INET;
diff -ur iputils/ping6.c iputils-capabilities/ping6.c
--- iputils/ping6.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/ping6.c 2012-02-05 17:33:44.000000000 +0100
@@ -72,6 +72,9 @@
#include <netinet/ip6.h>
#include <netinet/icmp6.h>
#include <resolv.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
#include "ping6_niquery.h"
@@ -551,9 +554,19 @@
uid = getuid();
if (setuid(uid)) {
- perror("ping: setuid");
+ perror("ping6: setuid");
exit(-1);
}
+#ifdef CAPABILITIES
+ {
+ cap_t caps = cap_init();
+ if (cap_set_proc(caps)) {
+ perror("ping6: cap_set_proc");
+ exit(-1);
+ }
+ cap_free(caps);
+ }
+#endif
source.sin6_family = AF_INET6;
memset(&firsthop, 0, sizeof(firsthop));
diff -ur iputils/traceroute6.c iputils-capabilities/traceroute6.c
--- iputils/traceroute6.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/traceroute6.c 2012-02-05 17:33:59.000000000 +0100
@@ -249,6 +249,9 @@
#include <netinet/ip6.h>
#include <netinet/icmp6.h>
#include <linux/types.h>
+#ifdef CAPABILITIES
+#include <sys/capability.h>
+#endif
#include <arpa/inet.h>
@@ -342,6 +345,16 @@
perror("traceroute6: setuid");
exit(-1);
}
+#ifdef CAPABILITIES
+ {
+ cap_t caps = cap_init();
+ if (cap_set_proc(caps)) {
+ perror("traceroute6: cap_set_proc");
+ exit(-1);
+ }
+ cap_free(caps);
+ }
+#endif
on = 1;
seq = tos = 0;
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] iputils: Add capability dropping
2012-02-05 18:16 [PATCH] iputils: Add capability dropping Ángel González
@ 2012-02-21 11:59 ` YOSHIFUJI Hideaki
0 siblings, 0 replies; 2+ messages in thread
From: YOSHIFUJI Hideaki @ 2012-02-21 11:59 UTC (permalink / raw)
To: Ángel González; +Cc: netdev, YOSHIFUJI Hideaki
Applied. Thank you.
Ángel González wrote:
> This patch adds support for dropping capabilities to the iputils programs
> which need root privileges (ping, ping6, clockdiff, traceroute6), so that
> users installing them suid can instead install them setcap cap_net_raw+ep
>
> The feature adds libcap as a requisite. In order to disable the feature
> sed -i "s/-DCAPABILITIES//;s/ -lcap//" Makefile
>
>
> Signed-off-by: Ángel González<ingenit@zoho.com>
> ---
>
> diff -ur iputils/Makefile iputils-capabilities/Makefile
> --- iputils/Makefile 2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/Makefile 2012-02-05 17:40:18.000000000 +0100
> @@ -14,7 +14,7 @@
> # What a pity, all new gccs are buggy and -Werror does not work. Sigh.
> #CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g -Werror
> CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g
> -CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES)
> +CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES) -DCAPABILITIES
>
> IPV4_TARGETS=tracepath ping clockdiff rdisc arping tftpd rarpd
> IPV6_TARGETS=tracepath6 traceroute6 ping6
> @@ -25,11 +25,12 @@
>
> all: $(TARGETS)
>
> -
> +clockdiff: -lcap
> +traceroute6: -lcap
> tftpd: tftpd.o tftpsubs.o
> -arping: arping.o -lsysfs
> -ping: ping.o ping_common.o
> -ping6: ping6.o ping_common.o -lresolv -lcrypto
> +arping: arping.o -lsysfs -lcap
> +ping: ping.o ping_common.o -lcap
> +ping6: ping6.o ping_common.o -lresolv -lcrypto -lcap
> ping.o ping6.o ping_common.o: ping_common.h
> tftpd.o tftpsubs.o: tftp.h
>
> diff -ur iputils/arping.c iputils-capabilities/arping.c
> --- iputils/arping.c 2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/arping.c 2012-02-05 17:23:53.000000000 +0100
> @@ -22,6 +22,9 @@
> #include<linux/if_ether.h>
> #include<net/if_arp.h>
> #include<sys/uio.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
> #include<netdb.h>
> #include<unistd.h>
> @@ -356,6 +359,17 @@
> exit(-1);
> }
>
> +#ifdef CAPABILITIES
> + {
> + cap_t caps = cap_init();
> + if (cap_set_proc(caps)) {
> + perror("arping: cap_set_proc");
> + exit(-1);
> + }
> + cap_free(caps);
> + }
> +#endif
> +
> while ((ch = getopt(argc, argv, "h?bfDUAqc:w:s:I:V")) != EOF) {
> switch(ch) {
> case 'b':
> diff -ur iputils/clockdiff.c iputils-capabilities/clockdiff.c
> --- iputils/clockdiff.c 2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/clockdiff.c 2012-02-05 17:33:14.000000000 +0100
> @@ -20,6 +20,9 @@
> #include<arpa/inet.h>
> #include<errno.h>
> #include<linux/types.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
> void usage(void) __attribute__((noreturn));
>
> @@ -530,6 +533,20 @@
> exit(1);
> }
>
> +void drop_rights(void) {
> +#ifdef CAPABILITIES
> + cap_t caps = cap_init();
> + if (cap_set_proc(caps)) {
> + perror("clockdiff: cap_set_proc");
> + exit(-1);
> + }
> + cap_free(caps);
> +#endif
> + if (setuid(getuid())) {
> + perror("clockdiff: setuid");
> + exit(-1);
> + }
> +}
>
> int
> main(int argc, char *argv[])
> @@ -541,10 +558,7 @@
> int n_errno = 0;
>
> if (argc< 2) {
> - if (setuid(getuid())) {
> - perror("clockdiff: setuid");
> - exit(-1);
> - }
> + drop_rights();
> usage();
> }
>
> @@ -554,11 +568,7 @@
> errno = 0;
> if (nice(-16) == -1)
> n_errno = errno;
> -
> - if (setuid(getuid())) {
> - perror("clockdiff: setuid");
> - exit(-1);
> - }
> + drop_rights();
>
> if (argc == 3) {
> if (strcmp(argv[1], "-o") == 0) {
> diff -ur iputils/ping.c iputils-capabilities/ping.c
> --- iputils/ping.c 2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/ping.c 2012-02-05 17:33:51.000000000 +0100
> @@ -62,6 +62,9 @@
>
> #include<netinet/ip.h>
> #include<netinet/ip_icmp.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
> #ifndef ICMP_FILTER
> #define ICMP_FILTER 1
> @@ -131,6 +134,16 @@
> perror("ping: setuid");
> exit(-1);
> }
> +#ifdef CAPABILITIES
> + {
> + cap_t caps = cap_init();
> + if (cap_set_proc(caps)) {
> + perror("ping: cap_set_proc");
> + exit(-1);
> + }
> + cap_free(caps);
> + }
> +#endif
>
> source.sin_family = AF_INET;
>
> diff -ur iputils/ping6.c iputils-capabilities/ping6.c
> --- iputils/ping6.c 2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/ping6.c 2012-02-05 17:33:44.000000000 +0100
> @@ -72,6 +72,9 @@
> #include<netinet/ip6.h>
> #include<netinet/icmp6.h>
> #include<resolv.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
> #include "ping6_niquery.h"
>
> @@ -551,9 +554,19 @@
>
> uid = getuid();
> if (setuid(uid)) {
> - perror("ping: setuid");
> + perror("ping6: setuid");
> exit(-1);
> }
> +#ifdef CAPABILITIES
> + {
> + cap_t caps = cap_init();
> + if (cap_set_proc(caps)) {
> + perror("ping6: cap_set_proc");
> + exit(-1);
> + }
> + cap_free(caps);
> + }
> +#endif
>
> source.sin6_family = AF_INET6;
> memset(&firsthop, 0, sizeof(firsthop));
> diff -ur iputils/traceroute6.c iputils-capabilities/traceroute6.c
> --- iputils/traceroute6.c 2012-01-10 02:42:52.000000000 +0100
> +++ iputils-capabilities/traceroute6.c 2012-02-05 17:33:59.000000000 +0100
> @@ -249,6 +249,9 @@
> #include<netinet/ip6.h>
> #include<netinet/icmp6.h>
> #include<linux/types.h>
> +#ifdef CAPABILITIES
> +#include<sys/capability.h>
> +#endif
>
> #include<arpa/inet.h>
>
> @@ -342,6 +345,16 @@
> perror("traceroute6: setuid");
> exit(-1);
> }
> +#ifdef CAPABILITIES
> + {
> + cap_t caps = cap_init();
> + if (cap_set_proc(caps)) {
> + perror("traceroute6: cap_set_proc");
> + exit(-1);
> + }
> + cap_free(caps);
> + }
> +#endif
>
> on = 1;
> seq = tos = 0;
>
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2012-02-21 11:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-02-05 18:16 [PATCH] iputils: Add capability dropping Ángel González
2012-02-21 11:59 ` YOSHIFUJI Hideaki
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).