Barak A. Pearlmutter

spelling

0! [SECURITY] Drop privilegies. Preserve access to files via "capabilites".
0! [SECURITY] Drop privilegies. Preserve access to files via "capabilities".
1. Remove pthreads metainfo GC
2. Replace g_hash_table* with "tsearch" and so on.
3. Remove all code with "#ifdef DOXYGEN"
... ...
... ... @@ -2749,7 +2749,7 @@ int main(int _argc, char *_argv[]) {
#ifdef CAPABILITIES_SUPPORT
debug(1, "Preserving Linux capabilites");
debug(1, "Preserving Linux capabilities");
// Tell kernel not clear capabilities when dropping root
if (prctl(PR_SET_KEEPCAPS, 1) < 0) {
... ...
... ... @@ -1283,7 +1283,7 @@ to preserve "CAP_DAC_READ_SEARCH", "CAP_SETUID" or/and "CAP_SETGID" [see
.BR capabilities (7)]
Linux capability for process using
.BR fts "(3), " inotify "(7) and " execve "(2)."
This allows to preserve enough FS privileges to watch a file tree and execute
This allows the preservation of enough FS privileges to watch a file tree and execute
the
.I sync\-handler
with required uid and gid [see
... ... @@ -1530,7 +1530,7 @@ Is set to "0" by default if \-\-splitting is set. Otherwise "1".
.RS
.B "[Requires \-\-splitting=process]"
Forbid writting or reading to/from shared memory when it shouldn't be.
Forbid writing or reading to/from shared memory when it shouldn't be.
.BR mprotect (2)
is used for the protection.
... ...
... ... @@ -386,7 +386,7 @@ int cap_enable(__u32 caps) {
cap_hdr.version = _LINUX_CAPABILITY_VERSION;
if (capget(&cap_hdr, &cap_dat) < 0) {
error("Cannot get capabilites with capget()");
error("Cannot get capabilities with capget()");
return errno;
}
... ... @@ -402,14 +402,14 @@ int cap_enable(__u32 caps) {
}
int cap_drop(ctx_t *ctx_p, __u32 caps) {
debug(1, "Dropping all Linux capabilites but 0x%x", caps);
debug(1, "Dropping all Linux capabilities but 0x%x", caps);
struct __user_cap_header_struct cap_hdr = {0};
struct __user_cap_data_struct cap_dat = {0};
cap_hdr.version = _LINUX_CAPABILITY_VERSION;
if (capget(&cap_hdr, &cap_dat) < 0) {
error_or_debug((ctx_p->flags[CAP_PRESERVE] != CAP_PRESERVE_TRY) ? -1 : 3, "Cannot get capabilites with capget()");
error_or_debug((ctx_p->flags[CAP_PRESERVE] != CAP_PRESERVE_TRY) ? -1 : 3, "Cannot get capabilities with capget()");
return errno;
}
debug(3, "old: cap.eff == 0x%04x; cap.prm == 0x%04x; cap.inh == 0x%04x.",
... ...