[PATCH] iputils: Add capability dropping
From: Ángel González <hidden>
Date: 2012-02-10 17:37:38
This patch adds support for dropping capabilities to the iputils programs which need root privileges (ping, ping6, clockdiff, traceroute6), so that users installing them suid can instead install them setcap cap_net_raw+ep The feature adds libcap as a requisite. In order to disable the feature sed -i "s/-DCAPABILITIES//;s/ -lcap//" Makefile Signed-off-by: Ángel González <redacted> --- diff -ur iputils/Makefile iputils-capabilities/Makefile
--- iputils/Makefile 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/Makefile 2012-02-05 17:40:18.000000000 +0100@@ -14,7 +14,7 @@ # What a pity, all new gccs are buggy and -Werror does not work. Sigh. #CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g -Werror CCOPT=-D_GNU_SOURCE -O2 -Wstrict-prototypes -Wall -g -CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES) +CFLAGS=$(CCOPT) $(GLIBCFIX) $(DEFINES) -DCAPABILITIES IPV4_TARGETS=tracepath ping clockdiff rdisc arping tftpd rarpd IPV6_TARGETS=tracepath6 traceroute6 ping6
@@ -25,11 +25,12 @@ all: $(TARGETS) - +clockdiff: -lcap +traceroute6: -lcap tftpd: tftpd.o tftpsubs.o -arping: arping.o -lsysfs -ping: ping.o ping_common.o -ping6: ping6.o ping_common.o -lresolv -lcrypto +arping: arping.o -lsysfs -lcap +ping: ping.o ping_common.o -lcap +ping6: ping6.o ping_common.o -lresolv -lcrypto -lcap ping.o ping6.o ping_common.o: ping_common.h tftpd.o tftpsubs.o: tftp.h
diff -ur iputils/arping.c iputils-capabilities/arping.c
--- iputils/arping.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/arping.c 2012-02-05 17:23:53.000000000 +0100@@ -22,6 +22,9 @@ #include <linux/if_ether.h> #include <net/if_arp.h> #include <sys/uio.h> +#ifdef CAPABILITIES +#include <sys/capability.h> +#endif #include <netdb.h> #include <unistd.h>
@@ -356,6 +359,17 @@ exit(-1); } +#ifdef CAPABILITIES + { + cap_t caps = cap_init(); + if (cap_set_proc(caps)) { + perror("arping: cap_set_proc"); + exit(-1); + } + cap_free(caps); + } +#endif + while ((ch = getopt(argc, argv, "h?bfDUAqc:w:s:I:V")) != EOF) { switch(ch) { case 'b':
diff -ur iputils/clockdiff.c iputils-capabilities/clockdiff.c
--- iputils/clockdiff.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/clockdiff.c 2012-02-05 17:33:14.000000000 +0100@@ -20,6 +20,9 @@ #include <arpa/inet.h> #include <errno.h> #include <linux/types.h> +#ifdef CAPABILITIES +#include <sys/capability.h> +#endif void usage(void) __attribute__((noreturn));
@@ -530,6 +533,20 @@ exit(1); } +void drop_rights(void) { +#ifdef CAPABILITIES + cap_t caps = cap_init(); + if (cap_set_proc(caps)) { + perror("clockdiff: cap_set_proc"); + exit(-1); + } + cap_free(caps); +#endif + if (setuid(getuid())) { + perror("clockdiff: setuid"); + exit(-1); + } +} int main(int argc, char *argv[])
@@ -541,10 +558,7 @@ int n_errno = 0; if (argc < 2) { - if (setuid(getuid())) { - perror("clockdiff: setuid"); - exit(-1); - } + drop_rights(); usage(); }
@@ -554,11 +568,7 @@ errno = 0; if (nice(-16) == -1) n_errno = errno; - - if (setuid(getuid())) { - perror("clockdiff: setuid"); - exit(-1); - } + drop_rights(); if (argc == 3) { if (strcmp(argv[1], "-o") == 0) {
diff -ur iputils/ping.c iputils-capabilities/ping.c
--- iputils/ping.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/ping.c 2012-02-05 17:33:51.000000000 +0100@@ -62,6 +62,9 @@ #include <netinet/ip.h> #include <netinet/ip_icmp.h> +#ifdef CAPABILITIES +#include <sys/capability.h> +#endif #ifndef ICMP_FILTER #define ICMP_FILTER 1
@@ -131,6 +134,16 @@ perror("ping: setuid"); exit(-1); } +#ifdef CAPABILITIES + { + cap_t caps = cap_init(); + if (cap_set_proc(caps)) { + perror("ping: cap_set_proc"); + exit(-1); + } + cap_free(caps); + } +#endif source.sin_family = AF_INET;
diff -ur iputils/ping6.c iputils-capabilities/ping6.c
--- iputils/ping6.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/ping6.c 2012-02-05 17:33:44.000000000 +0100@@ -72,6 +72,9 @@ #include <netinet/ip6.h> #include <netinet/icmp6.h> #include <resolv.h> +#ifdef CAPABILITIES +#include <sys/capability.h> +#endif #include "ping6_niquery.h"
@@ -551,9 +554,19 @@ uid = getuid(); if (setuid(uid)) { - perror("ping: setuid"); + perror("ping6: setuid"); exit(-1); } +#ifdef CAPABILITIES + { + cap_t caps = cap_init(); + if (cap_set_proc(caps)) { + perror("ping6: cap_set_proc"); + exit(-1); + } + cap_free(caps); + } +#endif source.sin6_family = AF_INET6; memset(&firsthop, 0, sizeof(firsthop));
diff -ur iputils/traceroute6.c iputils-capabilities/traceroute6.c
--- iputils/traceroute6.c 2012-01-10 02:42:52.000000000 +0100
+++ iputils-capabilities/traceroute6.c 2012-02-05 17:33:59.000000000 +0100@@ -249,6 +249,9 @@ #include <netinet/ip6.h> #include <netinet/icmp6.h> #include <linux/types.h> +#ifdef CAPABILITIES +#include <sys/capability.h> +#endif #include <arpa/inet.h>
@@ -342,6 +345,16 @@ perror("traceroute6: setuid"); exit(-1); } +#ifdef CAPABILITIES + { + cap_t caps = cap_init(); + if (cap_set_proc(caps)) { + perror("traceroute6: cap_set_proc"); + exit(-1); + } + cap_free(caps); + } +#endif on = 1; seq = tos = 0;