diff options
| author | Jeff Layton <jlayton@samba.org> | 2010-04-05 11:23:32 -0400 |
|---|---|---|
| committer | Jeff Layton <jlayton@samba.org> | 2010-04-05 11:23:32 -0400 |
| commit | da77c1b3ae934e29025d05b50eebecdbf569bfa4 (patch) | |
| tree | c36894d2d7f7100bb5fb5704a6c1c6b296528084 /mount.cifs.c | |
| parent | 4b52d2fdea00107f3c23388891467bbb7f2711eb (diff) | |
| download | cifs-utils-da77c1b3ae934e29025d05b50eebecdbf569bfa4.tar.gz cifs-utils-da77c1b3ae934e29025d05b50eebecdbf569bfa4.tar.bz2 cifs-utils-da77c1b3ae934e29025d05b50eebecdbf569bfa4.zip | |
mount.cifs: properly prune the capabilities bounding set
...libcap-ng does this in a much easier fashion. If that's not
available, then we have to do it manually.
Signed-off-by: Jeff Layton <jlayton@samba.org>
Diffstat (limited to 'mount.cifs.c')
| -rw-r--r-- | mount.cifs.c | 37 |
1 files changed, 36 insertions, 1 deletions
diff --git a/mount.cifs.c b/mount.cifs.c index 1ff1846..19e0963 100644 --- a/mount.cifs.c +++ b/mount.cifs.c @@ -47,6 +47,9 @@ #ifdef HAVE_LIBCAP_NG #include <cap-ng.h> #else /* HAVE_LIBCAP_NG */ +#ifdef HAVE_PRCTL +#include <sys/prctl.h> +#endif /* HAVE_PRCTL */ #ifdef HAVE_LIBCAP #include <sys/capability.h> #endif /* HAVE_LIBCAP */ @@ -364,14 +367,46 @@ toggle_cap_dac_override(int enable) return 0; } #else /* HAVE_LIBCAP_NG */ +#ifdef HAVE_PRCTL +static int +prune_bounding_set(void) +{ + int i, rc = 0; + static int bounding_set_cleared; + + if (bounding_set_cleared) + return 0; + + for (i = 0; i <= CAP_LAST_CAP && rc == 0; ++i) + rc = prctl(PR_CAPBSET_DROP, i); + + if (rc != 0) { + fprintf(stderr, "Unable to clear capability bounding set: %d\n", rc); + return EX_SYSERR; + } + + ++bounding_set_cleared; + return 0; +} +#else /* HAVE_PRCTL */ +static int +prune_bounding_set(void) +{ + return 0; +} +#endif /* HAVE_PRCTL */ #ifdef HAVE_LIBCAP static int drop_capabilities(int parent) { - int rc = 0, ncaps; + int rc, ncaps; cap_t caps; cap_value_t cap_list[2]; + rc = prune_bounding_set(); + if (rc) + return rc; + caps = cap_get_proc(); if (caps == NULL) { fprintf(stderr, "Unable to get current capability set: %s\n", |