libnsm.a: retain CAP_NET_BIND when dropping privileges

I'm about to switch the order of listener creation and dropping root
privileges.  rpc.statd will drop privileges first, then create its
listeners.  The reason for the new ordering is explained in a
subsequent patch.

However, for non-TI-RPC builds, rpc_init() needs to use a privileged
port to do pmap registrations.  For both TI-RPC and non-TI-RPC builds,
CAP_NET_BIND is required in case the admin requests a privileged
listener port on the statd command line.

So that these requirements are met, nsm_drop_privileges() will now
retain CAP_NET_BIND while dropping root.

Signed-off-by: Chuck Lever <chuck.lever@oracle.com>

diff --git a/aclocal/libcap.m4 b/aclocal/libcap.m4
new file mode 100644 (file)
index 0000000..eabe507
--- /dev/null
+++ b/aclocal/libcap.m4
@@ -0,0 +1,15 @@
+dnl Checks for libcap.so
+dnl
+AC_DEFUN([AC_LIBCAP], [
+
+  dnl look for prctl
+  AC_CHECK_FUNC([prctl], , )
+
+  dnl look for the library; do not add to LIBS if found
+  AC_CHECK_LIB([cap], [cap_get_proc], [LIBCAP=-lcap], ,)
+  AC_SUBST(LIBCAP)
+
+  AC_CHECK_HEADERS([sys/capability.h], ,
+                   [AC_MSG_ERROR([libcap headers not found.])])
+
+])dnl

diff --git a/configure.ac b/configure.ac
index ea6f4d9fd6ae5b739635e4a9c344370eacced840..c77c5baaf72c3b36339d310f0fcfaedaa2614aca 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -166,6 +166,9 @@ fi
 dnl Check for TI-RPC library and headers
 AC_LIBTIRPC
 
 dnl Check for TI-RPC library and headers
 AC_LIBTIRPC
 

+dnl Check for -lcap
+AC_LIBCAP
+

 # Check whether user wants TCP wrappers support
 AC_TCP_WRAPPERS
 
 # Check whether user wants TCP wrappers support
 AC_TCP_WRAPPERS
 

diff --git a/support/nsm/file.c b/support/nsm/file.c
index 8796705918545b95007628930999ded4eaae8379..d4692197df8e0853d80d65a2bbf51ade5d4166f0 100644 (file)
--- a/support/nsm/file.c
+++ b/support/nsm/file.c
@@ -67,6 +67,8 @@
 #endif
 
 #include <sys/types.h>
 #endif
 
 #include <sys/types.h>

+#include <sys/capability.h>
+#include <sys/prctl.h>

 #include <sys/stat.h>
 
 #include <ctype.h>
 #include <sys/stat.h>
 
 #include <ctype.h>


@@ -335,6 +337,34 @@ nsm_is_default_parentdir(void)
        return strcmp(nsm_base_dirname, NSM_DEFAULT_STATEDIR) == 0;
 }
 
        return strcmp(nsm_base_dirname, NSM_DEFAULT_STATEDIR) == 0;
 }
 

+/*
+ * Clear all capabilities but CAP_NET_BIND_SERVICE.  This permits
+ * callers to acquire privileged source ports, but all other root
+ * capabilities are disallowed.
+ *
+ * Returns true if successful, or false if some error occurred.
+ */
+static _Bool
+nsm_clear_capabilities(void)
+{
+       cap_t caps;
+
+       caps = cap_from_text("cap_net_bind_service=ep");
+       if (caps == NULL) {
+               xlog(L_ERROR, "Failed to allocate capability: %m");
+               return false;
+       }
+
+       if (cap_set_proc(caps) == -1) {
+               xlog(L_ERROR, "Failed to set capability flags: %m");
+               (void)cap_free(caps);
+               return false;
+       }
+
+       (void)cap_free(caps);
+       return true;
+}
+

 /**
  * nsm_drop_privileges - drop root privileges
  * @pidfd: file descriptor of a pid file
 /**
  * nsm_drop_privileges - drop root privileges
  * @pidfd: file descriptor of a pid file


@@ -382,6 +412,14 @@ nsm_drop_privileges(const int pidfd)
                if (fchown(pidfd, st.st_uid, st.st_gid) == -1)
                        xlog_warn("Failed to change owner of pidfile: %m");
 
                if (fchown(pidfd, st.st_uid, st.st_gid) == -1)
                        xlog_warn("Failed to change owner of pidfile: %m");
 

+       /*
+        * Don't clear capabilities when dropping root.
+        */
+        if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) == -1) {
+                xlog(L_ERROR, "prctl(PR_SET_KEEPCAPS) failed: %m");
+               return 0;
+       }
+

        if (setgroups(0, NULL) == -1) {
                xlog(L_ERROR, "Failed to drop supplementary groups: %m");
                return false;
        if (setgroups(0, NULL) == -1) {
                xlog(L_ERROR, "Failed to drop supplementary groups: %m");
                return false;


@@ -399,7 +437,8 @@ nsm_drop_privileges(const int pidfd)
        }
 
        xlog(D_CALL, "Effective UID, GID: %u, %u", st.st_uid, st.st_gid);
        }
 
        xlog(D_CALL, "Effective UID, GID: %u, %u", st.st_uid, st.st_gid);

-       return true;
+
+       return nsm_clear_capabilities();

 }
 
 /**
 }
 
 /**

diff --git a/utils/statd/Makefile.am b/utils/statd/Makefile.am
index a94c01207b128f0985b3873c46b5cd93e6296c70..17447914aa69c3066e7dda1b1ae5fb376072bf37 100644 (file)
--- a/utils/statd/Makefile.am
+++ b/utils/statd/Makefile.am
@@ -15,10 +15,10 @@ BUILT_SOURCES = $(GENFILES)
 statd_LDADD = ../../support/nsm/libnsm.a \
              ../../support/nfs/libnfs.a \
              ../../support/misc/libmisc.a \
 statd_LDADD = ../../support/nsm/libnsm.a \
              ../../support/nfs/libnfs.a \
              ../../support/misc/libmisc.a \

-             $(LIBWRAP) $(LIBNSL)
+             $(LIBWRAP) $(LIBNSL) $(LIBCAP)

 sm_notify_LDADD = ../../support/nsm/libnsm.a \
                  ../../support/nfs/libnfs.a \
 sm_notify_LDADD = ../../support/nsm/libnsm.a \
                  ../../support/nfs/libnfs.a \

-                 $(LIBNSL)
+                 $(LIBNSL) $(LIBCAP)

 
 EXTRA_DIST = sim_sm_inter.x $(man8_MANS) COPYRIGHT simulate.c
 
 
 EXTRA_DIST = sim_sm_inter.x $(man8_MANS) COPYRIGHT simulate.c