68 lines
2.2 KiB
Diff
68 lines
2.2 KiB
Diff
|
diff -up rsyslog-8.2102.0/runtime/rsconf.c.orig rsyslog-8.2102.0/runtime/rsconf.c
|
||
|
|
--- rsyslog-8.2102.0/runtime/rsconf.c.orig 2023-02-17 11:52:17.460043970 +0100
|
||
|
|
+++ rsyslog-8.2102.0/runtime/rsconf.c 2023-02-17 12:00:49.881602881 +0100
|
||
|
|
@@ -33,9 +33,6 @@
|
||
|
|
#include <sys/resource.h>
|
||
|
|
#include <sys/types.h>
|
||
|
|
#include <sys/stat.h>
|
||
|
|
-#ifdef ENABLE_LIBCAPNG
|
||
|
|
- #include <cap-ng.h>
|
||
|
|
-#endif
|
||
|
|
|
||
|
|
#include "rsyslog.h"
|
||
|
|
#include "obj.h"
|
||
|
|
@@ -549,7 +546,7 @@ rsRetVal doDropPrivGid(void)
|
||
|
|
uchar szBuf[1024];
|
||
|
|
DEFiRet;
|
||
|
|
|
||
|
|
-#ifndef ENABLE_LIBCAPNG
|
||
|
|
+
|
||
|
|
if(!ourConf->globals.gidDropPrivKeepSupplemental) {
|
||
|
|
res = setgroups(0, NULL); /* remove all supplemental group IDs */
|
||
|
|
if(res) {
|
||
|
|
@@ -567,15 +564,6 @@ rsRetVal doDropPrivGid(void)
|
||
|
|
"could not set requested group id: %s via setgid()", szBuf);
|
||
|
|
ABORT_FINALIZE(RS_RET_ERR_DROP_PRIV);
|
||
|
|
}
|
||
|
|
-#else
|
||
|
|
- int capng_flags = ourConf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP;
|
||
|
|
- res = capng_change_id(-1, ourConf->globals.gidDropPriv, capng_flags);
|
||
|
|
- if (res) {
|
||
|
|
- LogError(0, RS_RET_LIBCAPNG_ERR,
|
||
|
|
- "could not set requested group id %d via capng_change_id()", ourConf->globals.gidDropPriv);
|
||
|
|
- ABORT_FINALIZE(RS_RET_LIBCAPNG_ERR);
|
||
|
|
- }
|
||
|
|
-#endif
|
||
|
|
|
||
|
|
DBGPRINTF("setgid(%d): %d\n", ourConf->globals.gidDropPriv, res);
|
||
|
|
snprintf((char*)szBuf, sizeof(szBuf), "rsyslogd's groupid changed to %d",
|
||
|
|
@@ -613,13 +601,8 @@ static void doDropPrivUid(int iUid)
|
||
|
|
iUid, szBuf);
|
||
|
|
}
|
||
|
|
|
||
|
|
-#ifndef ENABLE_LIBCAPNG
|
||
|
|
+
|
||
|
|
res = setuid(iUid);
|
||
|
|
- // res = setuid(cnf->globals.uidDropPriv);
|
||
|
|
-#else
|
||
|
|
- int capng_flags = ourConf->globals.gidDropPrivKeepSupplemental ? CAPNG_NO_FLAG : CAPNG_DROP_SUPP_GRP;
|
||
|
|
- res = capng_change_id(iUid, -1, capng_flags);
|
||
|
|
-#endif
|
||
|
|
|
||
|
|
if(res) {
|
||
|
|
/* if we can not set the userid, this is fatal, so let's unconditionally abort */
|
||
|
|
diff -up rsyslog-8.2102.0/tools/rsyslogd.c.orig rsyslog-8.2102.0/tools/rsyslogd.c
|
||
|
|
--- rsyslog-8.2102.0/tools/rsyslogd.c.orig 2023-02-17 11:52:00.011011019 +0100
|
||
|
|
+++ rsyslog-8.2102.0/tools/rsyslogd.c 2023-02-17 11:58:37.322491823 +0100
|
||
|
|
@@ -2161,9 +2161,9 @@ main(int argc, char **argv)
|
||
|
|
CAP_LEASE,
|
||
|
|
CAP_NET_ADMIN,
|
||
|
|
CAP_NET_BIND_SERVICE,
|
||
|
|
- CAP_PERFMON,
|
||
|
|
CAP_SETGID,
|
||
|
|
CAP_SETUID,
|
||
|
|
+ CAP_DAC_OVERRIDE,
|
||
|
|
CAP_SYS_ADMIN,
|
||
|
|
CAP_SYS_CHROOT,
|
||
|
|
CAP_SYS_RESOURCE,
|