mir/bind
2
0
Fork 0
mirror of https://gitlab.isc.org/isc-projects/bind9 synced 2025-08-31 14:35:26 +00:00
Code Issues Releases Wiki Activity

libcap ships with <sys/capability.h>, so use an #ifdef associated with that header to determine whether to enable capabilities support

Browse Source
This commit is contained in:
Michał Kępień
2018-06-28 21:54:22 +02:00
committed by Ondřej Surý
parent e299a870b3
commit c356413294
1 changed files with 9 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
bin/named/unix/os.c
View File

@@ -59,16 +59,16 @@ static int singletonfd = -1;
#endif
/*
* If there's no <linux/capability.h>, we don't care about <sys/prctl.h>
* If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
*/
#ifndef HAVE_LINUX_CAPABILITY_H
#ifndef HAVE_SYS_CAPABILITY_H
#undef HAVE_SYS_PRCTL_H
#endif
/*
* Linux defines:
* (T) HAVE_LINUXTHREADS
* (C) HAVE_SYS_CAPABILITY_H (or HAVE_LINUX_CAPABILITY_H)
* (C) HAVE_SYS_CAPABILITY_H
* (P) HAVE_SYS_PRCTL_H
* The possible cases are:
* none: setuid() normally
@@ -110,47 +110,15 @@ static struct passwd *runas_pw = NULL;
static isc_boolean_t done_setuid = ISC_FALSE;
static int dfd[2] = { -1, -1 };
#ifdef HAVE_LINUX_CAPABILITY_H
#ifdef HAVE_SYS_CAPABILITY_H
static isc_boolean_t non_root = ISC_FALSE;
static isc_boolean_t non_root_caps = ISC_FALSE;
#ifdef HAVE_SYS_CAPABILITY_H
#include <sys/capability.h>
#else
#ifdef HAVE_LINUX_TYPES_H
#include <linux/types.h>
#endif
/*%
* We define _LINUX_FS_H to prevent it from being included. We don't need
* anything from it, and the files it includes cause warnings with 2.2
* kernels, and compilation failures (due to conflicts between <linux/string.h>
* and <string.h>) on 2.3 kernels.
*/
#define _LINUX_FS_H
#include <linux/capability.h>
#include <syscall.h>
#ifndef SYS_capset
#ifndef __NR_capset
#include <asm/unistd.h> /* Slackware 4.0 needs this. */
#endif /* __NR_capset */
#define SYS_capset __NR_capset
#endif /* SYS_capset */
#endif /* HAVE_SYS_CAPABILITY_H */
#ifdef HAVE_SYS_PRCTL_H
#include <sys/prctl.h> /* Required for prctl(). */
/*
* If the value of PR_SET_KEEPCAPS is not in <sys/prctl.h>, define it
* here. This allows setuid() to work on systems running a new enough
* kernel but with /usr/include/linux pointing to "standard" kernel
* headers.
*/
#ifndef PR_SET_KEEPCAPS
#define PR_SET_KEEPCAPS 8
#endif
#endif /* HAVE_SYS_PRCTL_H */
static void
@@ -328,7 +296,7 @@ linux_keepcaps(void) {
}
#endif
#endif /* HAVE_LINUX_CAPABILITY_H */
#endif /* HAVE_SYS_CAPABILITY_H */
static void
@@ -345,7 +313,7 @@ setup_syslog(const char *progname) {
void
named_os_init(const char *progname) {
setup_syslog(progname);
#ifdef HAVE_LINUX_CAPABILITY_H
#ifdef HAVE_SYS_CAPABILITY_H
linux_initialprivs();
#endif
#ifdef HAVE_LINUXTHREADS
@@ -531,7 +499,7 @@ named_os_changeuser(void) {
done_setuid = ISC_TRUE;
#ifdef HAVE_LINUXTHREADS
#ifdef HAVE_LINUX_CAPABILITY_H
#ifdef HAVE_SYS_CAPABILITY_H
if (!non_root_caps) {
named_main_earlyfatal("-u with Linux threads not supported: "
"requires kernel support for "
@@ -565,7 +533,7 @@ named_os_changeuser(void) {
strbuf);
}
#endif
#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}
@@ -605,7 +573,7 @@ named_os_minprivs(void) {
named_os_changeuser(); /* Call setuid() before threads are started */
#endif
#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
linux_minprivs();
#endif
}