Toggle navigation
Toggle navigation
This project
Loading...
Sign in
UT
/
clsync
Go to a project
Toggle navigation
Toggle navigation pinning
Projects
Groups
Snippets
Help
Project
Activity
Repository
Pipelines
Graphs
Issues
0
Merge Requests
0
Wiki
Network
Create a new issue
Builds
Commits
Authored by
Barak A. Pearlmutter
2015-05-08 10:18:25 +0100
Browse Files
Options
Browse Files
Download
Email Patches
Plain Diff
Commit
f47fc6d3e768a2a9ba2b54c1b3df0fbfad575f75
f47fc6d3
1 parent
af58e74b
spelling
Hide whitespace changes
Inline
Side-by-side
Showing
4 changed files
with
7 additions
and
7 deletions
TODO
main.c
man/man1/clsync.1
privileged.c
TODO
View file @
f47fc6d
0! [SECURITY] Drop privilegies. Preserve access to files via "capabilites".
0! [SECURITY] Drop privilegies. Preserve access to files via "capabilit
i
es".
1. Remove pthreads metainfo GC
2. Replace g_hash_table* with "tsearch" and so on.
3. Remove all code with "#ifdef DOXYGEN"
...
...
main.c
View file @
f47fc6d
...
...
@@ -2749,7 +2749,7 @@ int main(int _argc, char *_argv[]) {
#ifdef CAPABILITIES_SUPPORT
debug
(
1
,
"Preserving Linux capabilites"
);
debug
(
1
,
"Preserving Linux capabilit
i
es"
);
// Tell kernel not clear capabilities when dropping root
if
(
prctl
(
PR_SET_KEEPCAPS
,
1
)
<
0
)
{
...
...
man/man1/clsync.1
View file @
f47fc6d
...
...
@@ -1283,7 +1283,7 @@ to preserve "CAP_DAC_READ_SEARCH", "CAP_SETUID" or/and "CAP_SETGID" [see
.BR capabilities (7)]
Linux capability for process using
.BR fts "(3), " inotify "(7) and " execve "(2)."
This allows t
o preserve
enough FS privileges to watch a file tree and execute
This allows t
he preservation of
enough FS privileges to watch a file tree and execute
the
.I sync\-handler
with required uid and gid [see
...
...
@@ -1530,7 +1530,7 @@ Is set to "0" by default if \-\-splitting is set. Otherwise "1".
.RS
.B "[Requires \-\-splitting=process]"
Forbid writ
t
ing or reading to/from shared memory when it shouldn't be.
Forbid writing or reading to/from shared memory when it shouldn't be.
.BR mprotect (2)
is used for the protection.
...
...
privileged.c
View file @
f47fc6d
...
...
@@ -386,7 +386,7 @@ int cap_enable(__u32 caps) {
cap_hdr
.
version
=
_LINUX_CAPABILITY_VERSION
;
if
(
capget
(
&
cap_hdr
,
&
cap_dat
)
<
0
)
{
error
(
"Cannot get capabilites with capget()"
);
error
(
"Cannot get capabilit
i
es with capget()"
);
return
errno
;
}
...
...
@@ -402,14 +402,14 @@ int cap_enable(__u32 caps) {
}
int
cap_drop
(
ctx_t
*
ctx_p
,
__u32
caps
)
{
debug
(
1
,
"Dropping all Linux capabilites but 0x%x"
,
caps
);
debug
(
1
,
"Dropping all Linux capabilit
i
es but 0x%x"
,
caps
);
struct
__user_cap_header_struct
cap_hdr
=
{
0
};
struct
__user_cap_data_struct
cap_dat
=
{
0
};
cap_hdr
.
version
=
_LINUX_CAPABILITY_VERSION
;
if
(
capget
(
&
cap_hdr
,
&
cap_dat
)
<
0
)
{
error_or_debug
((
ctx_p
->
flags
[
CAP_PRESERVE
]
!=
CAP_PRESERVE_TRY
)
?
-
1
:
3
,
"Cannot get capabilites with capget()"
);
error_or_debug
((
ctx_p
->
flags
[
CAP_PRESERVE
]
!=
CAP_PRESERVE_TRY
)
?
-
1
:
3
,
"Cannot get capabilit
i
es with capget()"
);
return
errno
;
}
debug
(
3
,
"old: cap.eff == 0x%04x; cap.prm == 0x%04x; cap.inh == 0x%04x."
,
...
...
Please
register
or
login
to post a comment