mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-09-03 08:05:21 +00:00
Code Issues Releases Wiki Activity

(#260) Running named as a non-root user failed on Linux kernels new enough to

Browse Source 
support retaining capabilities after setuid().
This commit is contained in:
Brian Wellington
2000-06-16 07:35:54 +00:00
parent bb54e57a8e
commit 7777118507
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
CHANGES
View File

@@ -1,3 +1,7 @@
260. [bug] Running named as a non-root user failed on Linux
kernels new enough to support retaining capabilities
after setuid().
259. [func] New random-device and random-seed-file statements 259. [func] New random-device and random-seed-file statements
for global options block of named.conf. Both accept for global options block of named.conf. Both accept
a single string argument. a single string argument.

8
bin/named/unix/os.c
View File

@@ -38,6 +38,7 @@ static char *pidfile = NULL;
#ifdef HAVE_LINUXTHREADS #ifdef HAVE_LINUXTHREADS
static pid_t mainpid = 0; static pid_t mainpid = 0;
static isc_boolean_t non_root_caps = ISC_FALSE; static isc_boolean_t non_root_caps = ISC_FALSE;
static isc_boolean_t non_root = ISC_FALSE;
#endif #endif
#ifdef HAVE_LINUX_CAPABILITY_H #ifdef HAVE_LINUX_CAPABILITY_H
@@ -66,7 +67,7 @@ linux_setcaps(unsigned int caps) {
struct __user_cap_header_struct caphead; struct __user_cap_header_struct caphead;
struct __user_cap_data_struct cap; struct __user_cap_data_struct cap;
if (getuid() != 0 && !non_root_caps) if ((getuid() != 0 && !non_root_caps) || non_root)
return; return;
memset(&caphead, 0, sizeof caphead); memset(&caphead, 0, sizeof caphead);
@@ -153,8 +154,11 @@ linux_keepcaps(void) {
if (errno != EINVAL) if (errno != EINVAL)
ns_main_earlyfatal("prctl() failed: %s", ns_main_earlyfatal("prctl() failed: %s",
strerror(errno)); strerror(errno));
} else } else {
non_root_caps = ISC_TRUE; non_root_caps = ISC_TRUE;
if (getuid() != 0)
non_root = ISC_TRUE;
}
} }
#endif #endif