From b0167de894bdd5f27fba15826eee055201165dac Mon Sep 17 00:00:00 2001
From: Tom Gundersen <teg@jklm.no>
Date: Sun, 15 Jul 2018 16:13:11 +0200
Subject: [PATCH] fix audit support

---
 ...1e90b747d65bdcf9e0de622776a15ed4cad4.patch | 53 ++++++++++++++++++
 ...661cd21ab6d6194ce6f95f98e36c0b31be85.patch | 54 +++++++++++++++++++
 dbus-broker.spec                              |  2 +
 3 files changed, 109 insertions(+)
 create mode 100644 1a4a1e90b747d65bdcf9e0de622776a15ed4cad4.patch
 create mode 100644 79ae661cd21ab6d6194ce6f95f98e36c0b31be85.patch

diff --git a/1a4a1e90b747d65bdcf9e0de622776a15ed4cad4.patch b/1a4a1e90b747d65bdcf9e0de622776a15ed4cad4.patch
new file mode 100644
index 0000000..75105e1
--- /dev/null
+++ b/1a4a1e90b747d65bdcf9e0de622776a15ed4cad4.patch
@@ -0,0 +1,53 @@
+From 1a4a1e90b747d65bdcf9e0de622776a15ed4cad4 Mon Sep 17 00:00:00 2001
+From: Tom Gundersen <teg@jklm.no>
+Date: Thu, 12 Jul 2018 22:14:03 +0200
+Subject: [PATCH] audit: fix check for existing capability
+
+We must not treat the return code for capng_has_capability() as a boolean,
+it returns 0 if the capability is not set, 1 if it is, but CAPNG_FAIL on
+failure.
+
+Internally, it calls capng_get_caps_process() if needed, and if this fails,
+the failure is forwarded.
+
+Signed-off-by: Tom Gundersen <teg@jklm.no>
+---
+ src/util/audit.c | 23 +++++++++++++++++------
+ 1 file changed, 17 insertions(+), 6 deletions(-)
+
+diff --git a/src/util/audit.c b/src/util/audit.c
+index 5681b1c..1f73d49 100644
+--- a/src/util/audit.c
++++ b/src/util/audit.c
+@@ -55,14 +55,25 @@ int util_audit_drop_permissions(uint32_t uid, uint32_t gid) {
+                 if (r < 0)
+                         return error_origin(-errno);
+         } else {
+-                int have_audit_write;
++                bool have_audit_write;
++
++                r = capng_have_capability(CAPNG_PERMITTED, CAP_AUDIT_WRITE);
++                if (r == CAPNG_FAIL)
++                        return error_origin(-EIO);
++                else if (r == 1)
++                        have_audit_write = true;
++                else
++                        have_audit_write = false;
+ 
+-                have_audit_write = capng_have_capability(CAPNG_PERMITTED, CAP_AUDIT_WRITE);
+                 capng_clear(CAPNG_SELECT_BOTH);
+-                if (have_audit_write)
+-                        capng_update(CAPNG_ADD,
+-                                     CAPNG_EFFECTIVE | CAPNG_PERMITTED,
+-                                     CAP_AUDIT_WRITE);
++
++                if (have_audit_write) {
++                        r = capng_update(CAPNG_ADD,
++                                         CAPNG_EFFECTIVE | CAPNG_PERMITTED,
++                                         CAP_AUDIT_WRITE);
++                        if (r < 0)
++                                return error_origin(-EINVAL);
++                }
+ 
+                 r = capng_change_id(uid, gid, CAPNG_DROP_SUPP_GRP);
+                 if (r)
diff --git a/79ae661cd21ab6d6194ce6f95f98e36c0b31be85.patch b/79ae661cd21ab6d6194ce6f95f98e36c0b31be85.patch
new file mode 100644
index 0000000..18f7594
--- /dev/null
+++ b/79ae661cd21ab6d6194ce6f95f98e36c0b31be85.patch
@@ -0,0 +1,54 @@
+From 79ae661cd21ab6d6194ce6f95f98e36c0b31be85 Mon Sep 17 00:00:00 2001
+From: Tom Gundersen <teg@jklm.no>
+Date: Thu, 12 Jul 2018 21:43:14 +0200
+Subject: [PATCH] audit: retain CAP_AUDIT_WRITE in the ambient capability set
+ when dropping caps
+
+Since we are not running at root, all caps will be dropped on execve(), unless
+they are also in the ambient capability set, being in the inheritable set is
+not sufficient.
+
+This ensures that dbus-broker retains CAP_AUDIT_WRITE (when enabled), and that
+dbus-broker-launch still does not.
+
+This fixes issue #159.
+
+Signed-off-by: Tom Gundersen <teg@jklm.no>
+---
+ src/util/audit.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+diff --git a/src/util/audit.c b/src/util/audit.c
+index ac9b3d7..5a837de 100644
+--- a/src/util/audit.c
++++ b/src/util/audit.c
+@@ -7,6 +7,7 @@
+ #include <grp.h>
+ #include <libaudit.h>
+ #include <stdlib.h>
++#include <sys/prctl.h>
+ #include <unistd.h>
+ #include "util/audit.h"
+ #include "util/error.h"
+@@ -69,7 +70,7 @@ int util_audit_drop_permissions(uint32_t uid, uint32_t gid) {
+ 
+                 if (have_audit_write) {
+                         r = capng_update(CAPNG_ADD,
+-                                         CAPNG_EFFECTIVE | CAPNG_PERMITTED,
++                                         CAPNG_EFFECTIVE | CAPNG_PERMITTED | CAPNG_INHERITABLE,
+                                          CAP_AUDIT_WRITE);
+                         if (r < 0)
+                                 return error_origin(-EINVAL);
+@@ -78,6 +79,12 @@ int util_audit_drop_permissions(uint32_t uid, uint32_t gid) {
+                 r = capng_change_id(uid, gid, CAPNG_DROP_SUPP_GRP);
+                 if (r)
+                         return error_origin(-EPERM);
++
++                if (have_audit_write) {
++                        r = prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_AUDIT_WRITE, 0, 0);
++                        if (r < 0)
++                                return error_origin(-errno);
++                }
+         }
+ 
+         return 0;
diff --git a/dbus-broker.spec b/dbus-broker.spec
index a41b0fa..2c6a8c4 100644
--- a/dbus-broker.spec
+++ b/dbus-broker.spec
@@ -5,6 +5,8 @@ Summary:        Linux D-Bus Message Broker
 License:        ASL 2.0
 URL:            https://github.com/bus1/dbus-broker
 Source0:        https://github.com/bus1/dbus-broker/releases/download/v%{version}/dbus-broker-%{version}.tar.xz
+Patch0:         1a4a1e90b747d65bdcf9e0de622776a15ed4cad4.patch
+Patch1:         79ae661cd21ab6d6194ce6f95f98e36c0b31be85.patch
 Provides:       bundled(c-dvar) = 1
 Provides:       bundled(c-list) = 3
 Provides:       bundled(c-rbtree) = 3