#ifdef HAVE_SYS_CAPABILITY_H
#include <sys/capability.h>
#endif
+#ifdef HAVE_SYS_PRCTL_H
+#include <sys/prctl.h>
+#endif
#include <pulsecore/core-error.h>
#endif
-#ifdef HAVE_SYS_CAPABILITY_H
+#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_SYS_PRCTL_H)
-/* Limit capabilities set to CAPSYS_NICE */
+/* Limit permitted capabilities set to CAPSYS_NICE */
int pa_limit_caps(void) {
int r = -1;
cap_t caps;
cap_value_t nice_cap = CAP_SYS_NICE;
- /* Only drop caps when called SUID */
- if (getuid() == 0)
- return 0;
-
caps = cap_init();
assert(caps);
-
cap_clear(caps);
-
- cap_set_flag(caps, CAP_EFFECTIVE, 1, &nice_cap, CAP_SET);
cap_set_flag(caps, CAP_PERMITTED, 1, &nice_cap, CAP_SET);
if (cap_set_proc(caps) < 0)
goto fail;
+ if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0)
+ goto fail;
+
pa_log_info("dropped capabilities successfully.");
-
- r = 0;
+
+ r = 1;
fail:
- cap_free (caps);
+ cap_free(caps);
return r;
}
cap_t caps;
int r = -1;
- /* Only drop caps when called SUID */
- if (getuid() == 0)
- return 0;
-
caps = cap_init();
assert(caps);
cap_clear(caps);
+ prctl(PR_SET_KEEPCAPS, 0, 0, 0, 0);
+
if (cap_set_proc(caps) < 0) {
pa_log("failed to drop capabilities: %s", pa_cstrerror(errno));
goto fail;
}
-
+
r = 0;
fail:
- cap_free (caps);
+ cap_free(caps);
return r;
}
struct timeval tv;
#endif
- setlocale(LC_ALL, "");
-
- pa_limit_caps();
-
#ifdef HAVE_GETUID
real_root = getuid() == 0;
suid_root = !real_root && geteuid() == 0;
+#else
+ real_root = 0;
+ suid_root = 0;
+#endif
+
+ if (suid_root) {
+ if (pa_limit_caps() > 0)
+ /* We managed to drop capabilities except the needed
+ * ones. Hence we can drop the uid. */
+ pa_drop_root();
+ }
+
+ setlocale(LC_ALL, "");
if (suid_root && (pa_own_uid_in_group(PA_REALTIME_GROUP, &gid) <= 0 || gid >= 1000)) {
pa_log_warn("WARNING: called SUID root, but not in group '"PA_REALTIME_GROUP"'.");
+ pa_drop_caps();
pa_drop_root();
+ suid_root = real_root = 0;
}
-#else
- real_root = 0;
- suid_root = 0;
-#endif
LTDL_SET_PRELOADED_SYMBOLS();
if (conf->high_priority && conf->cmd == PA_CMD_DAEMON)
pa_raise_priority();
- pa_drop_caps();
-
- if (suid_root)
+ if (suid_root) {
+ pa_drop_caps();
pa_drop_root();
+ }
if (conf->dl_search_path)
lt_dlsetsearchpath(conf->dl_search_path);
#include <sys/resource.h>
#endif
+#ifdef HAVE_SYS_CAPABILITY_H
+#include <sys/capability.h>
+#endif
+
#ifdef HAVE_PTHREAD
#include <pthread.h>
#endif
sensible: set the nice level to -15 and enable realtime scheduling if
supported.*/
void pa_raise_priority(void) {
-
+#if defined(HAVE_SYS_CAPABILITY_H)
+ cap_t caps;
+
+ /* Temporarily acquire CAP_SYS_NICE in the effective set */
+ if ((caps = cap_get_proc())) {
+ cap_t caps_new;
+ cap_value_t nice_cap = CAP_SYS_NICE;
+
+ if ((caps_new = cap_dup(caps))) {
+ cap_set_flag(caps_new, CAP_EFFECTIVE, 1, &nice_cap, CAP_SET);
+ cap_set_flag(caps_new, CAP_PERMITTED, 1, &nice_cap, CAP_SET);
+ cap_set_proc(caps_new);
+ cap_free(caps_new);
+ }
+ }
+#endif
+
#ifdef HAVE_SYS_RESOURCE_H
if (setpriority(PRIO_PROCESS, 0, NICE_LEVEL) < 0)
pa_log_warn("setpriority(): %s", pa_cstrerror(errno));
if (sched_getparam(0, &sp) < 0) {
pa_log("sched_getparam(): %s", pa_cstrerror(errno));
- return;
+ goto fail;
}
sp.sched_priority = 1;
if (sched_setscheduler(0, SCHED_FIFO, &sp) < 0) {
pa_log_warn("sched_setscheduler(): %s", pa_cstrerror(errno));
- return;
+ goto fail;
}
pa_log_info("Successfully enabled SCHED_FIFO scheduling.");
else
pa_log_info("Successfully gained high priority class.");
#endif
+
+fail:
+
+#if defined(HAVE_SYS_CAPABILITY_H)
+ if (caps) {
+ /* Restore original caps */
+ cap_set_proc(caps);
+ cap_free(caps);
+ }
+#endif
}
/* Reset the priority to normal, inverting the changes made by pa_raise_priority() */