[pulseaudio-commits] r1455 - in /trunk/src: daemon/caps.c daemon/main.c pulsecore/core-util.c
svnmailer-noreply at 0pointer.de
svnmailer-noreply at 0pointer.de
Fri May 25 13:35:31 PDT 2007
Author: lennart
Date: Fri May 25 22:35:30 2007
New Revision: 1455
URL: http://0pointer.de/cgi-bin/viewcvs.cgi?rev=3D1455&root=3Dpulseaudio&vi=
ew=3Drev
Log:
when called with the setid bit change euid to uid sooner to make sure that =
we can access our own files even when we dropped most capabilities. (Closes=
#21)
Modified:
trunk/src/daemon/caps.c
trunk/src/daemon/main.c
trunk/src/pulsecore/core-util.c
Modified: trunk/src/daemon/caps.c
URL: http://0pointer.de/cgi-bin/viewcvs.cgi/trunk/src/daemon/caps.c?rev=3D1=
455&root=3Dpulseaudio&r1=3D1454&r2=3D1455&view=3Ddiff
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
--- trunk/src/daemon/caps.c (original)
+++ trunk/src/daemon/caps.c Fri May 25 22:35:30 2007
@@ -34,6 +34,9 @@
=
#ifdef HAVE_SYS_CAPABILITY_H
#include <sys/capability.h>
+#endif
+#ifdef HAVE_SYS_PRCTL_H
+#include <sys/prctl.h>
#endif
=
#include <pulsecore/core-error.h>
@@ -76,35 +79,31 @@
=
#endif
=
-#ifdef HAVE_SYS_CAPABILITY_H
+#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_SYS_PRCTL_H)
=
-/* Limit capabilities set to CAPSYS_NICE */
+/* Limit permitted capabilities set to CAPSYS_NICE */
int pa_limit_caps(void) {
int r =3D -1;
cap_t caps;
cap_value_t nice_cap =3D CAP_SYS_NICE;
=
- /* Only drop caps when called SUID */
- if (getuid() =3D=3D 0)
- return 0;
-
caps =3D cap_init();
assert(caps);
-
cap_clear(caps);
-
- cap_set_flag(caps, CAP_EFFECTIVE, 1, &nice_cap, CAP_SET);
cap_set_flag(caps, CAP_PERMITTED, 1, &nice_cap, CAP_SET);
=
if (cap_set_proc(caps) < 0)
goto fail;
=
+ if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0)
+ goto fail;
+ =
pa_log_info("dropped capabilities successfully.");
-
- r =3D 0;
+ =
+ r =3D 1;
=
fail:
- cap_free (caps);
+ cap_free(caps);
=
return r;
}
@@ -114,24 +113,22 @@
cap_t caps;
int r =3D -1;
=
- /* Only drop caps when called SUID */
- if (getuid() =3D=3D 0)
- return 0;
-
caps =3D cap_init();
assert(caps);
=
cap_clear(caps);
=
+ prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0);
+ =
if (cap_set_proc(caps) < 0) {
pa_log("failed to drop capabilities: %s", pa_cstrerror(errno));
goto fail;
}
-
+ =
r =3D 0;
=
fail:
- cap_free (caps);
+ cap_free(caps);
=
return r;
}
Modified: trunk/src/daemon/main.c
URL: http://0pointer.de/cgi-bin/viewcvs.cgi/trunk/src/daemon/main.c?rev=3D1=
455&root=3Dpulseaudio&r1=3D1454&r2=3D1455&view=3Ddiff
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
--- trunk/src/daemon/main.c (original)
+++ trunk/src/daemon/main.c Fri May 25 22:35:30 2007
@@ -329,22 +329,29 @@
struct timeval tv;
#endif
=
- setlocale(LC_ALL, "");
-
- pa_limit_caps();
-
#ifdef HAVE_GETUID
real_root =3D getuid() =3D=3D 0;
suid_root =3D !real_root && geteuid() =3D=3D 0;
-
- if (suid_root && (pa_own_uid_in_group(PA_REALTIME_GROUP, &gid) <=3D 0 =
|| gid >=3D 1000)) {
- pa_log_warn("WARNING: called SUID root, but not in group '"PA_REAL=
TIME_GROUP"'.");
- pa_drop_root();
- }
#else
real_root =3D 0;
suid_root =3D 0;
#endif
+
+ if (suid_root) {
+ if (pa_limit_caps() > 0)
+ /* We managed to drop capabilities except the needed
+ * ones. Hence we can drop the uid. */
+ pa_drop_root();
+ }
+
+ setlocale(LC_ALL, "");
+
+ if (suid_root && (pa_own_uid_in_group(PA_REALTIME_GROUP, &gid) <=3D 0 =
|| gid >=3D 1000)) {
+ pa_log_warn("WARNING: called SUID root, but not in group '"PA_REAL=
TIME_GROUP"'.");
+ pa_drop_caps();
+ pa_drop_root();
+ suid_root =3D real_root =3D 0;
+ }
=
LTDL_SET_PRELOADED_SYMBOLS();
=
@@ -381,10 +388,10 @@
if (conf->high_priority && conf->cmd =3D=3D PA_CMD_DAEMON)
pa_raise_priority();
=
- pa_drop_caps();
-
- if (suid_root)
+ if (suid_root) {
+ pa_drop_caps();
pa_drop_root();
+ }
=
if (conf->dl_search_path)
lt_dlsetsearchpath(conf->dl_search_path);
Modified: trunk/src/pulsecore/core-util.c
URL: http://0pointer.de/cgi-bin/viewcvs.cgi/trunk/src/pulsecore/core-util.c=
?rev=3D1455&root=3Dpulseaudio&r1=3D1454&r2=3D1455&view=3Ddiff
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D
--- trunk/src/pulsecore/core-util.c (original)
+++ trunk/src/pulsecore/core-util.c Fri May 25 22:35:30 2007
@@ -51,6 +51,10 @@
#include <sys/resource.h>
#endif
=
+#ifdef HAVE_SYS_CAPABILITY_H
+#include <sys/capability.h>
+#endif
+
#ifdef HAVE_PTHREAD
#include <pthread.h>
#endif
@@ -481,7 +485,23 @@
sensible: set the nice level to -15 and enable realtime scheduling if
supported.*/
void pa_raise_priority(void) {
-
+#if defined(HAVE_SYS_CAPABILITY_H)
+ cap_t caps;
+
+ /* Temporarily acquire CAP_SYS_NICE in the effective set */
+ if ((caps =3D cap_get_proc())) {
+ cap_t caps_new;
+ cap_value_t nice_cap =3D CAP_SYS_NICE;
+ =
+ if ((caps_new =3D cap_dup(caps))) {
+ cap_set_flag(caps_new, CAP_EFFECTIVE, 1, &nice_cap, CAP_SET);
+ cap_set_flag(caps_new, CAP_PERMITTED, 1, &nice_cap, CAP_SET);
+ cap_set_proc(caps_new);
+ cap_free(caps_new);
+ }
+ }
+#endif
+ =
#ifdef HAVE_SYS_RESOURCE_H
if (setpriority(PRIO_PROCESS, 0, NICE_LEVEL) < 0)
pa_log_warn("setpriority(): %s", pa_cstrerror(errno));
@@ -495,13 +515,13 @@
=
if (sched_getparam(0, &sp) < 0) {
pa_log("sched_getparam(): %s", pa_cstrerror(errno));
- return;
+ goto fail;
}
=
sp.sched_priority =3D 1;
if (sched_setscheduler(0, SCHED_FIFO, &sp) < 0) {
pa_log_warn("sched_setscheduler(): %s", pa_cstrerror(errno));
- return;
+ goto fail;
}
=
pa_log_info("Successfully enabled SCHED_FIFO scheduling.");
@@ -513,6 +533,16 @@
pa_log_warn("SetPriorityClass() failed: 0x%08X", GetLastError());
else
pa_log_info("Successfully gained high priority class.");
+#endif
+
+fail:
+
+#if defined(HAVE_SYS_CAPABILITY_H)
+ if (caps) {
+ /* Restore original caps */
+ cap_set_proc(caps);
+ cap_free(caps);
+ }
#endif
}
=
More information about the pulseaudio-commits
mailing list