From efa3d5bd32887cfd3a91d4d8b03c6bc8d7962c94 Mon Sep 17 00:00:00 2001 From: Enrico Scholz Date: Thu, 4 Mar 2004 00:33:12 +0000 Subject: [PATCH] BUGFIX/ENHANCEMENTS: the CLI interface of 'reducecap' was fixed significantly: now it is possible to remove capabilities like CHOWN'. Formerly, only privileged caps like SYS_* or *_ADMIN could be removed because of a coding error. Changes in the related code are making it possible that both '--CAP_XXX' and '--XXX' syntax will be recognized (based on patches and reports by Bodo Eggert). git-svn-id: http://svn.linux-vserver.org/svn/util-vserver/branches/SYSCALL_SWITCH@1051 94cd875c-1c1d-0410-91d2-eb244daf1a30 --- util-vserver/src/reducecap.c | 68 +++++++++++++++++++++++--------------------- 1 file changed, 36 insertions(+), 32 deletions(-) diff --git a/util-vserver/src/reducecap.c b/util-vserver/src/reducecap.c index 7124b11..9054185 100644 --- a/util-vserver/src/reducecap.c +++ b/util-vserver/src/reducecap.c @@ -161,49 +161,55 @@ int main (int argc, char *argv[]) // The following capabilities are normally available // to vservers administrator, but are place for // completeness - {"CAP_CHOWN",CAP_CHOWN}, - {"CAP_DAC_OVERRIDE",CAP_DAC_OVERRIDE}, - {"CAP_DAC_READ_SEARCH",CAP_DAC_READ_SEARCH}, - {"CAP_FOWNER",CAP_FOWNER}, - {"CAP_FSETID",CAP_FSETID}, - {"CAP_KILL",CAP_KILL}, - {"CAP_SETGID",CAP_SETGID}, - {"CAP_SETUID",CAP_SETUID}, - {"CAP_SETPCAP",CAP_SETPCAP}, - {"CAP_SYS_TTY_CONFIG",CAP_SYS_TTY_CONFIG}, - {"CAP_LEASE",CAP_LEASE}, - {"CAP_SYS_CHROOT",CAP_SYS_CHROOT}, + {"CHOWN",CAP_CHOWN}, + {"DAC_OVERRIDE",CAP_DAC_OVERRIDE}, + {"DAC_READ_SEARCH",CAP_DAC_READ_SEARCH}, + {"FOWNER",CAP_FOWNER}, + {"FSETID",CAP_FSETID}, + {"KILL",CAP_KILL}, + {"SETGID",CAP_SETGID}, + {"SETUID",CAP_SETUID}, + {"SETPCAP",CAP_SETPCAP}, + {"SYS_TTY_CONFIG",CAP_SYS_TTY_CONFIG}, + {"LEASE",CAP_LEASE}, + {"SYS_CHROOT",CAP_SYS_CHROOT}, // Those capabilities are not normally available // to vservers because they are not needed and // may represent a security risk - {"--LINUX_IMMUTABLE",CAP_LINUX_IMMUTABLE}, - {"--NET_BIND_SERVICE",CAP_NET_BIND_SERVICE}, - {"--NET_BROADCAST",CAP_NET_BROADCAST}, - {"--NET_ADMIN", CAP_NET_ADMIN}, - {"--NET_RAW", CAP_NET_RAW}, - {"--IPC_LOCK", CAP_IPC_LOCK}, - {"--IPC_OWNER", CAP_IPC_OWNER}, - {"--SYS_MODULE",CAP_SYS_MODULE}, - {"--SYS_RAWIO", CAP_SYS_RAWIO}, - {"--SYS_PACCT", CAP_SYS_PACCT}, - {"--SYS_ADMIN", CAP_SYS_ADMIN}, - {"--SYS_BOOT", CAP_SYS_BOOT}, - {"--SYS_NICE", CAP_SYS_NICE}, - {"--SYS_RESOURCE",CAP_SYS_RESOURCE}, - {"--SYS_TIME", CAP_SYS_TIME}, - {"--MKNOD", CAP_MKNOD}, - {"--QUOTACTL", CAP_QUOTACTL}, + {"LINUX_IMMUTABLE",CAP_LINUX_IMMUTABLE}, + {"NET_BIND_SERVICE",CAP_NET_BIND_SERVICE}, + {"NET_BROADCAST",CAP_NET_BROADCAST}, + {"NET_ADMIN", CAP_NET_ADMIN}, + {"NET_RAW", CAP_NET_RAW}, + {"IPC_LOCK", CAP_IPC_LOCK}, + {"IPC_OWNER", CAP_IPC_OWNER}, + {"SYS_MODULE",CAP_SYS_MODULE}, + {"SYS_RAWIO", CAP_SYS_RAWIO}, + {"SYS_PACCT", CAP_SYS_PACCT}, + {"SYS_ADMIN", CAP_SYS_ADMIN}, + {"SYS_BOOT", CAP_SYS_BOOT}, + {"SYS_NICE", CAP_SYS_NICE}, + {"SYS_RESOURCE",CAP_SYS_RESOURCE}, + {"SYS_TIME", CAP_SYS_TIME}, + {"MKNOD", CAP_MKNOD}, + {"QUOTACTL", CAP_QUOTACTL}, {NULL,0} }; int j; + arg += 2; + if (*arg=='\0') { + ++i; + break; + } + if (strncmp(arg, "CAP_", 4)==0) arg += 4; for (j=0; tbcap[j].option != NULL; j++){ if (strcasecmp(tbcap[j].option,arg)==0){ remove |= (1<