diff options
| -rwxr-xr-x | configure | 34 | ||||
| -rw-r--r-- | qemu-bridge-helper.c | 36 |
2 files changed, 70 insertions, 0 deletions
@@ -133,6 +133,7 @@ vnc_thread="no" xen="" xen_ctrl_version="" linux_aio="" +cap_ng="" attr="" libattr="" xfs="" @@ -672,6 +673,10 @@ for opt do ;; --enable-tcg-interpreter) tcg_interpreter="yes" ;; + --disable-cap-ng) cap_ng="no" + ;; + --enable-cap-ng) cap_ng="yes" + ;; --disable-spice) spice="no" ;; --enable-spice) spice="yes" @@ -1053,6 +1058,8 @@ echo " --disable-vde disable support for vde network" echo " --enable-vde enable support for vde network" echo " --disable-linux-aio disable Linux AIO support" echo " --enable-linux-aio enable Linux AIO support" +echo " --disable-cap-ng disable libcap-ng support" +echo " --enable-cap-ng enable libcap-ng support" echo " --disable-attr disables attr and xattr support" echo " --enable-attr enable attr and xattr support" echo " --disable-blobs disable installing provided firmware blobs" @@ -1745,6 +1752,29 @@ EOF fi ########################################## +# libcap-ng library probe +if test "$cap_ng" != "no" ; then + cap_libs="-lcap-ng" + cat > $TMPC << EOF +#include <cap-ng.h> +int main(void) +{ + capng_capability_to_name(CAPNG_EFFECTIVE); + return 0; +} +EOF + if compile_prog "" "$cap_libs" ; then + cap_ng=yes + libs_tools="$cap_libs $libs_tools" + else + if test "$cap_ng" = "yes" ; then + feature_not_found "cap_ng" + fi + cap_ng=no + fi +fi + +########################################## # Sound support libraries probe audio_drv_probe() @@ -2876,6 +2906,7 @@ echo "fdatasync $fdatasync" echo "madvise $madvise" echo "posix_madvise $posix_madvise" echo "uuid support $uuid" +echo "libcap-ng support $cap_ng" echo "vhost-net support $vhost_net" echo "Trace backend $trace_backend" echo "Trace output file $trace_file-<pid>" @@ -2980,6 +3011,9 @@ fi if test "$vde" = "yes" ; then echo "CONFIG_VDE=y" >> $config_host_mak fi +if test "$cap_ng" = "yes" ; then + echo "CONFIG_LIBCAP=y" >> $config_host_mak +fi for card in $audio_card_list; do def=CONFIG_`echo $card | tr '[:lower:]' '[:upper:]'` echo "$def=y" >> $config_host_mak diff --git a/qemu-bridge-helper.c b/qemu-bridge-helper.c index 01eeb38c58..aec5008e22 100644 --- a/qemu-bridge-helper.c +++ b/qemu-bridge-helper.c @@ -39,6 +39,10 @@ #include "net/tap-linux.h" +#ifdef CONFIG_LIBCAP +#include <cap-ng.h> +#endif + #define DEFAULT_ACL_FILE CONFIG_QEMU_CONFDIR "/bridge.conf" enum { @@ -193,6 +197,27 @@ static int send_fd(int c, int fd) return sendmsg(c, &msg, 0); } +#ifdef CONFIG_LIBCAP +static int drop_privileges(void) +{ + /* clear all capabilities */ + capng_clear(CAPNG_SELECT_BOTH); + + if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, + CAP_NET_ADMIN) < 0) { + return -1; + } + + /* change to calling user's real uid and gid, retaining supplemental + * groups and CAP_NET_ADMIN */ + if (capng_change_id(getuid(), getgid(), CAPNG_CLEAR_BOUNDING)) { + return -1; + } + + return 0; +} +#endif + int main(int argc, char **argv) { struct ifreq ifr; @@ -207,6 +232,17 @@ int main(int argc, char **argv) int access_allowed, access_denied; int ret = EXIT_SUCCESS; +#ifdef CONFIG_LIBCAP + /* if we're run from an suid binary, immediately drop privileges preserving + * cap_net_admin */ + if (geteuid() == 0 && getuid() != geteuid()) { + if (drop_privileges() == -1) { + fprintf(stderr, "failed to drop privileges\n"); + return 1; + } + } +#endif + /* parse arguments */ for (index = 1; index < argc; index++) { if (strcmp(argv[index], "--use-vnet") == 0) { |