rpms/dhcp
7
0
Fork 0
Code Issues Pull Requests Releases Activity

- Fix capability patch (#546765)

Browse Source
This commit is contained in:
Jiří Popelka 2010-02-02 12:30:33 +00:00
parent a449503820
commit 79859968bb
2 changed files with 71 additions and 14 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

83
dhcp-4.1.1-capability.patch
View File

@ -1,6 +1,6 @@
diff -up dhcp-4.1.1/client/dhclient.c.capability dhcp-4.1.1/client/dhclient.c diff -up dhcp-4.1.1/client/dhclient.c.capability dhcp-4.1.1/client/dhclient.c
--- dhcp-4.1.1/client/dhclient.c.capability 2010-01-20 17:39:07.000000000 +0100 --- dhcp-4.1.1/client/dhclient.c.capability 2010-02-02 11:58:29.000000000 +0100
+++ dhcp-4.1.1/client/dhclient.c 2010-01-20 17:39:07.000000000 +0100 +++ dhcp-4.1.1/client/dhclient.c 2010-02-02 12:04:39.000000000 +0100
@@ -37,6 +37,9 @@ @@ -37,6 +37,9 @@
#include <sys/time.h> #include <sys/time.h>
#include <sys/wait.h> #include <sys/wait.h>
@ -11,17 +11,42 @@ diff -up dhcp-4.1.1/client/dhclient.c.capability dhcp-4.1.1/client/dhclient.c
/* /*
* Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
@@ -424,6 +427,15 @@ main(int argc, char **argv) { @@ -89,6 +92,9 @@ int wanted_ia_ta = 0;
int wanted_ia_pd = 0;
char *mockup_relay = NULL;
int bootp_broadcast_always = 0;
+#ifdef HAVE_LIBCAP_NG
+static int keep_capabilities = 0;
+#endif
extern u_int32_t default_requested_options[];
@@ -376,6 +382,10 @@ main(int argc, char **argv) {
}
dhclient_request_options = argv[i];
+#ifdef HAVE_LIBCAP_NG
+ } else if (!strcmp(argv[i], "-nc")) {
+ keep_capabilities = 1;
+#endif
} else if (argv[i][0] == '-') {
usage();
} else if (interfaces_requested < 0) {
@@ -424,6 +434,19 @@ main(int argc, char **argv) {
path_dhclient_script = s; path_dhclient_script = s;
} }
+#ifdef HAVE_LIBCAP_NG +#ifdef HAVE_LIBCAP_NG
+ /* Drop capabilities */ + /* Drop capabilities */
+ capng_clear(CAPNG_SELECT_BOTH); + if (!keep_capabilities) {
+ capng_updatev(CAPNG_ADD, + capng_clear(CAPNG_SELECT_CAPS);
+ CAPNG_EFFECTIVE|CAPNG_PERMITTED|CAPNG_BOUNDING_SET, + capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
+ CAP_NET_ADMIN, CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1); + CAP_DAC_OVERRIDE); // Drop this someday
+ capng_apply(CAPNG_SELECT_BOTH); + capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
+ CAP_NET_ADMIN, CAP_NET_RAW,
+ CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, -1);
+ capng_apply(CAPNG_SELECT_CAPS);
+ }
+#endif +#endif
+ +
/* Set up the initial dhcp option universe. */ /* Set up the initial dhcp option universe. */
@ -29,7 +54,7 @@ diff -up dhcp-4.1.1/client/dhclient.c.capability dhcp-4.1.1/client/dhclient.c
diff -up dhcp-4.1.1/client/Makefile.am.capability dhcp-4.1.1/client/Makefile.am diff -up dhcp-4.1.1/client/Makefile.am.capability dhcp-4.1.1/client/Makefile.am
--- dhcp-4.1.1/client/Makefile.am.capability 2008-11-18 23:33:22.000000000 +0100 --- dhcp-4.1.1/client/Makefile.am.capability 2008-11-18 23:33:22.000000000 +0100
+++ dhcp-4.1.1/client/Makefile.am 2010-01-20 17:39:07.000000000 +0100 +++ dhcp-4.1.1/client/Makefile.am 2010-02-02 12:05:31.000000000 +0100
@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c @@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c
scripts/netbsd scripts/nextstep scripts/openbsd \ scripts/netbsd scripts/nextstep scripts/openbsd \
scripts/solaris scripts/openwrt scripts/solaris scripts/openwrt
@ -40,14 +65,46 @@ diff -up dhcp-4.1.1/client/Makefile.am.capability dhcp-4.1.1/client/Makefile.am
EXTRA_DIST = $(man_MANS) EXTRA_DIST = $(man_MANS)
diff -up dhcp-4.1.1/configure.ac.capability dhcp-4.1.1/configure.ac diff -up dhcp-4.1.1/configure.ac.capability dhcp-4.1.1/configure.ac
--- dhcp-4.1.1/configure.ac.capability 2010-01-20 17:39:07.000000000 +0100 --- dhcp-4.1.1/configure.ac.capability 2010-02-02 11:58:29.000000000 +0100
+++ dhcp-4.1.1/configure.ac 2010-01-20 17:39:07.000000000 +0100 +++ dhcp-4.1.1/configure.ac 2010-02-02 12:07:04.000000000 +0100
@@ -419,6 +419,9 @@ AC_TRY_LINK( @@ -419,6 +419,41 @@ AC_TRY_LINK(
# Look for optional headers. # Look for optional headers.
AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h) AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
+# look for capabilities library +# look for capabilities library
+LIBCAP_NG_PATH +AC_ARG_WITH(libcap-ng,
+ [ --with-libcap-ng=[auto/yes/no] Add Libcap-ng support [default=auto]],,
+ with_libcap_ng=auto)
+
+# Check for Libcap-ng API
+#
+# libcap-ng detection
+if test x$with_libcap_ng = xno ; then
+ have_libcap_ng=no;
+else
+ # Start by checking for header file
+ AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
+
+ # See if we have libcap-ng library
+ AC_CHECK_LIB(cap-ng, capng_clear,
+ CAPNG_LDADD=-lcap-ng,)
+
+ # Check results are usable
+ if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
+ AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
+ fi
+ if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
+ AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
+ fi
+fi
+AC_SUBST(CAPNG_LDADD)
+AC_MSG_CHECKING(whether to use libcap-ng)
+if test x$CAPNG_LDADD != x ; then
+ AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
+ AC_MSG_RESULT(yes)
+else
+ AC_MSG_RESULT(no)
+fi
+ +
# find an MD5 library # find an MD5 library
AC_SEARCH_LIBS(MD5_Init, [crypto]) AC_SEARCH_LIBS(MD5_Init, [crypto])

2
dhcp.spec
View File

@ -200,7 +200,7 @@ libdhcpctl and libomapi static libraries are also included in this package.
# Ensure 64-bit platforms parse lease file dates & times correctly (#448615) # Ensure 64-bit platforms parse lease file dates & times correctly (#448615)
%patch19 -p1 -b .64-bit_lease_parse %patch19 -p1 -b .64-bit_lease_parse
# Drop unnecessary capabilities in dhclient (#517649) # Drop unnecessary capabilities in dhclient (#517649, #546765)
%patch20 -p1 -b .capability %patch20 -p1 -b .capability
# dhclient logs its pid to make troubleshooting NM managed systems # dhclient logs its pid to make troubleshooting NM managed systems