From da54228cd9e6fe144efcb2d6da87e3cbb5db5b4c Mon Sep 17 00:00:00 2001 From: Jeff Layton Date: Thu, 1 Apr 2010 15:28:57 -0400 Subject: mount.cifs: drop capabilities if libcap is available Might as well be as safe as possible. Have child drop all capabilities, and have the parent drop all but CAP_SYS_ADMIN (needed for mounting) and CAP_DAC_OVERRIDE (needed in case mtab isn't writable by root). We might even eventually consider being clever and dropping CAP_DAC_OVERRIDE when root has access to the mtab. Signed-off-by: Jeff Layton --- aclocal/libcap.m4 | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 aclocal/libcap.m4 (limited to 'aclocal/libcap.m4') diff --git a/aclocal/libcap.m4 b/aclocal/libcap.m4 new file mode 100644 index 0000000..0b42689 --- /dev/null +++ b/aclocal/libcap.m4 @@ -0,0 +1,20 @@ +dnl Checks for libcap.so +dnl +AC_DEFUN([AC_LIBCAP], [ + + dnl look for prctl + AC_CHECK_FUNC([prctl], , ) + + dnl look for the library; do not add to LIBS if found + AC_CHECK_LIB([cap], [cap_get_proc], enable_libcap="yes", enable_libcap="no", ) + + AC_CHECK_HEADERS([sys/capability.h], , + [AC_MSG_WARN([libcap headers not found. mount.cifs will be built without support for dropping capabilities. Consider installing libcap-devel.]) ; enable_libcap="no"]) + + if test "$enable_libcap" = "yes"; then + AC_DEFINE([HAVE_LIBCAP],[1], [Define if libcap exists]) + LIBCAP=-lcap + AC_SUBST(LIBCAP) + fi + +])dnl -- cgit v1.2.3