|
|
8424efc |
diff -up dhcp-4.1.1/client/dhclient.8.capability dhcp-4.1.1/client/dhclient.8
|
|
|
8424efc |
--- dhcp-4.1.1/client/dhclient.8.capability 2010-02-03 11:19:39.854958099 -0500
|
|
|
8424efc |
+++ dhcp-4.1.1/client/dhclient.8 2010-02-03 11:44:57.949895909 -0500
|
|
|
8424efc |
@@ -381,6 +381,32 @@ Do not configure any interfaces. Most u
|
|
|
8424efc |
option.
|
|
|
8424efc |
|
|
|
8424efc |
.TP
|
|
|
8424efc |
+.BI \-nc
|
|
|
8424efc |
+Do not drop capabilities.
|
|
|
8424efc |
+
|
|
|
8424efc |
+Normally, if
|
|
|
8424efc |
+.B dhclient
|
|
|
8424efc |
+was compiled with libcap-ng support,
|
|
|
8424efc |
+.B dhclient
|
|
|
8424efc |
+drops most capabilities immediately upon startup. While more secure,
|
|
|
8424efc |
+this greatly restricts the additional actions that hooks in
|
|
|
8424efc |
+.B dhclient-script (8)
|
|
|
8424efc |
+can take. (For example, any daemons that
|
|
|
8424efc |
+.B dhclient-script (8)
|
|
|
8424efc |
+starts or restarts will inherit the restricted capabilities as well,
|
|
|
8424efc |
+which may interfere with their correct operation.) Thus, the
|
|
|
8424efc |
+.BI \-nc
|
|
|
8424efc |
+option can be used to prevent
|
|
|
8424efc |
+.B dhclient
|
|
|
8424efc |
+from dropping capabilities.
|
|
|
8424efc |
+
|
|
|
8424efc |
+The
|
|
|
8424efc |
+.BI \-nc
|
|
|
8424efc |
+option is ignored if
|
|
|
8424efc |
+.B dhclient
|
|
|
8424efc |
+was not compiled with libcap-ng support.
|
|
|
8424efc |
+
|
|
|
8424efc |
+.TP
|
|
|
8424efc |
.BI \-nw
|
|
|
8424efc |
Become a daemon process immediately (nowait) rather than waiting until an IP
|
|
|
8424efc |
address has been acquired.
|
|
|
d3e04df |
diff -up dhcp-4.1.1/client/dhclient.c.capability dhcp-4.1.1/client/dhclient.c
|
|
|
8424efc |
--- dhcp-4.1.1/client/dhclient.c.capability 2010-02-03 11:19:39.876957973 -0500
|
|
|
8424efc |
+++ dhcp-4.1.1/client/dhclient.c 2010-02-03 11:46:14.665957658 -0500
|
|
|
32e9820 |
@@ -37,6 +37,9 @@
|
|
|
32e9820 |
#include <sys/time.h>
|
|
|
32e9820 |
#include <sys/wait.h>
|
|
|
32e9820 |
#include <limits.h>
|
|
|
32e9820 |
+#ifdef HAVE_LIBCAP_NG
|
|
|
32e9820 |
+#include <cap-ng.h>
|
|
|
32e9820 |
+#endif
|
|
|
32e9820 |
|
|
|
32e9820 |
/*
|
|
|
32e9820 |
* Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
|
|
|
66bde6c |
@@ -89,6 +92,9 @@ int wanted_ia_ta = 0;
|
|
|
66bde6c |
int wanted_ia_pd = 0;
|
|
|
66bde6c |
char *mockup_relay = NULL;
|
|
|
66bde6c |
int bootp_broadcast_always = 0;
|
|
|
66bde6c |
+#ifdef HAVE_LIBCAP_NG
|
|
|
66bde6c |
+static int keep_capabilities = 0;
|
|
|
66bde6c |
+#endif
|
|
|
66bde6c |
|
|
|
66bde6c |
extern u_int32_t default_requested_options[];
|
|
|
66bde6c |
|
|
|
66bde6c |
@@ -376,6 +382,10 @@ main(int argc, char **argv) {
|
|
|
66bde6c |
}
|
|
|
66bde6c |
|
|
|
66bde6c |
dhclient_request_options = argv[i];
|
|
|
66bde6c |
+ } else if (!strcmp(argv[i], "-nc")) {
|
|
|
8424efc |
+#ifdef HAVE_LIBCAP_NG
|
|
|
66bde6c |
+ keep_capabilities = 1;
|
|
|
66bde6c |
+#endif
|
|
|
66bde6c |
} else if (argv[i][0] == '-') {
|
|
|
66bde6c |
usage();
|
|
|
66bde6c |
} else if (interfaces_requested < 0) {
|
|
|
66bde6c |
@@ -424,6 +434,19 @@ main(int argc, char **argv) {
|
|
|
32e9820 |
path_dhclient_script = s;
|
|
|
32e9820 |
}
|
|
|
32e9820 |
|
|
|
32e9820 |
+#ifdef HAVE_LIBCAP_NG
|
|
|
32e9820 |
+ /* Drop capabilities */
|
|
|
66bde6c |
+ if (!keep_capabilities) {
|
|
|
66bde6c |
+ capng_clear(CAPNG_SELECT_CAPS);
|
|
|
66bde6c |
+ capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
|
|
|
66bde6c |
+ CAP_DAC_OVERRIDE); // Drop this someday
|
|
|
66bde6c |
+ capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
|
|
|
66bde6c |
+ CAP_NET_ADMIN, CAP_NET_RAW,
|
|
|
66bde6c |
+ CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, -1);
|
|
|
66bde6c |
+ capng_apply(CAPNG_SELECT_CAPS);
|
|
|
66bde6c |
+ }
|
|
|
32e9820 |
+#endif
|
|
|
32e9820 |
+
|
|
|
32e9820 |
/* Set up the initial dhcp option universe. */
|
|
|
32e9820 |
initialize_common_option_spaces();
|
|
|
32e9820 |
|
|
|
d3e04df |
diff -up dhcp-4.1.1/client/Makefile.am.capability dhcp-4.1.1/client/Makefile.am
|
|
|
8424efc |
--- dhcp-4.1.1/client/Makefile.am.capability 2008-11-18 17:33:22.000000000 -0500
|
|
|
8424efc |
+++ dhcp-4.1.1/client/Makefile.am 2010-02-03 11:19:39.895958083 -0500
|
|
|
32e9820 |
@@ -5,7 +5,7 @@ dhclient_SOURCES = clparse.c dhclient.c
|
|
|
32e9820 |
scripts/netbsd scripts/nextstep scripts/openbsd \
|
|
|
32e9820 |
scripts/solaris scripts/openwrt
|
|
|
32e9820 |
dhclient_LDADD = ../common/libdhcp.a ../minires/libres.a \
|
|
|
32e9820 |
- ../omapip/libomapi.a ../dst/libdst.a
|
|
|
32e9820 |
+ ../omapip/libomapi.a ../dst/libdst.a $(CAPNG_LDADD)
|
|
|
32e9820 |
man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
|
|
|
32e9820 |
EXTRA_DIST = $(man_MANS)
|
|
|
32e9820 |
|
|
|
d3e04df |
diff -up dhcp-4.1.1/configure.ac.capability dhcp-4.1.1/configure.ac
|
|
|
8424efc |
--- dhcp-4.1.1/configure.ac.capability 2010-02-03 11:19:39.806895971 -0500
|
|
|
8424efc |
+++ dhcp-4.1.1/configure.ac 2010-02-03 11:19:39.895958083 -0500
|
|
|
66bde6c |
@@ -419,6 +419,41 @@ AC_TRY_LINK(
|
|
|
32e9820 |
# Look for optional headers.
|
|
|
32e9820 |
AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
|
|
|
32e9820 |
|
|
|
32e9820 |
+# look for capabilities library
|
|
|
66bde6c |
+AC_ARG_WITH(libcap-ng,
|
|
|
66bde6c |
+ [ --with-libcap-ng=[auto/yes/no] Add Libcap-ng support [default=auto]],,
|
|
|
66bde6c |
+ with_libcap_ng=auto)
|
|
|
66bde6c |
+
|
|
|
66bde6c |
+# Check for Libcap-ng API
|
|
|
66bde6c |
+#
|
|
|
66bde6c |
+# libcap-ng detection
|
|
|
66bde6c |
+if test x$with_libcap_ng = xno ; then
|
|
|
66bde6c |
+ have_libcap_ng=no;
|
|
|
66bde6c |
+else
|
|
|
66bde6c |
+ # Start by checking for header file
|
|
|
66bde6c |
+ AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
|
|
|
66bde6c |
+
|
|
|
66bde6c |
+ # See if we have libcap-ng library
|
|
|
66bde6c |
+ AC_CHECK_LIB(cap-ng, capng_clear,
|
|
|
66bde6c |
+ CAPNG_LDADD=-lcap-ng,)
|
|
|
66bde6c |
+
|
|
|
66bde6c |
+ # Check results are usable
|
|
|
66bde6c |
+ if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
|
|
|
66bde6c |
+ AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
|
|
|
66bde6c |
+ fi
|
|
|
66bde6c |
+ if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
|
|
|
66bde6c |
+ AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
|
|
|
66bde6c |
+ fi
|
|
|
66bde6c |
+fi
|
|
|
66bde6c |
+AC_SUBST(CAPNG_LDADD)
|
|
|
66bde6c |
+AC_MSG_CHECKING(whether to use libcap-ng)
|
|
|
66bde6c |
+if test x$CAPNG_LDADD != x ; then
|
|
|
66bde6c |
+ AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
|
|
|
66bde6c |
+ AC_MSG_RESULT(yes)
|
|
|
66bde6c |
+else
|
|
|
66bde6c |
+ AC_MSG_RESULT(no)
|
|
|
66bde6c |
+fi
|
|
|
32e9820 |
+
|
|
|
32e9820 |
# find an MD5 library
|
|
|
32e9820 |
AC_SEARCH_LIBS(MD5_Init, [crypto])
|
|
|
32e9820 |
AC_SEARCH_LIBS(MD5Init, [crypto])
|