rpms/firewalld
7
0
Fork 0
Code Issues Pull Requests Releases Activity

fix(firewalld): check capng_apply() return code

Browse Source 
Resolves: rhbz1999090
This commit is contained in:
Eric Garver 2021-11-22 09:00:01 -05:00
parent 3e7577c6e4
commit 3b53f39161
2 changed files with 53 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

48
0003-fix-firewalld-check-capng_apply-return-code.patch Normal file
View File

@ -0,0 +1,48 @@
From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001
From: Eric Garver <eric@garver.life>
Date: Mon, 30 Aug 2021 13:24:47 -0400
Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code
If dropping capabilities is blocked by SELinux, e.g. old selinux-policy,
then capng_apply() will return non-zero. Also check other things that
may fail, i.e. capng_update().
Fixes: rhbz 1999090
(cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363)
(cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57)
---
src/firewalld.in | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/src/firewalld.in b/src/firewalld.in
index b1c886c6f02f..38331a0b49a9 100755
--- a/src/firewalld.in
+++ b/src/firewalld.in
@@ -140,14 +140,16 @@ def startup(args):
try:
import capng
capng.capng_clear(capng.CAPNG_SELECT_BOTH)
- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
- capng.CAP_NET_ADMIN)
- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
- capng.CAP_NET_RAW)
- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
- capng.CAP_SYS_MODULE)
- capng.capng_apply(capng.CAPNG_SELECT_BOTH)
- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
+ if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
+ capng.CAP_NET_ADMIN) or \
+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
+ capng.CAP_NET_RAW) or \
+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
+ capng.CAP_SYS_MODULE) or \
+ capng.capng_apply(capng.CAPNG_SELECT_BOTH):
+ log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.")
+ else:
+ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
except ImportError:
pass
--
2.31.1

6
firewalld.spec
View File

@ -1,12 +1,13 @@
Summary: A firewall daemon with D-Bus interface providing a dynamic firewall
Name: firewalld
Version: 1.0.0
Release: 3%{?dist}
Release: 4%{?dist}
URL: http://www.firewalld.org
License: GPLv2+
Source0: https://github.com/firewalld/firewalld/releases/download/v%{version}/firewalld-%{version}.tar.gz
Patch1: 0001-RHEL-only-Add-cockpit-by-default-to-some-zones.patch
Patch2: 0002-fix-firewalld-keep-linux-capability-CAP_SYS_MODULE.patch
Patch3: 0003-fix-firewalld-check-capng_apply-return-code.patch
BuildArch: noarch
BuildRequires: autoconf
BuildRequires: automake
@ -228,6 +229,9 @@ rm -rf %{buildroot}%{_datadir}/firewalld/testsuite
%{_mandir}/man1/firewall-config*.1*
%changelog
* Mon Nov 22 2021 Eric Garver <egarver@redhat.com> - 1.0.0-4
- fix(firewalld): check capng_apply() return code
* Mon Nov 22 2021 Eric Garver <egarver@redhat.com> - 1.0.0-3
- fix(firewalld): keep linux capability CAP_SYS_MODULE