>From 00f63e1afc9d07e9793574304ef34a5bb54629b7 Mon Sep 17 00:00:00 2001 From: "Yuriy M. Kaminskiy" Date: Wed, 2 Jan 2013 01:56:07 +0400 Subject: [PATCH 5/7] ping, ping6, arping, clockdiff: Fix CAP_SETUID <-> setuid() interaction setuid() only drops saved uid if process have CAP_SETUID. Drop capabilities only after setuid(). --- arping.c | 30 +++++++++++++++--------------- clockdiff.c | 8 +++++--- ping_common.c | 30 +++++++++++++++--------------- 3 files changed, 35 insertions(+), 33 deletions(-) diff --git a/arping.c b/arping.c index 0033f33..3c02abf 100644 --- a/arping.c +++ b/arping.c @@ -161,6 +161,21 @@ void limit_capabilities(void) #ifdef CAPABILITIES cap_t cap_p; + if (prctl(PR_SET_KEEPCAPS, 1) < 0) { + perror("arping: prctl"); + exit(-1); + } + + if (setuid(getuid()) < 0) { + perror("arping: setuid"); + exit(-1); + } + + if (prctl(PR_SET_KEEPCAPS, 0) < 0) { + perror("arping: prctl"); + exit(-1); + } + cap_p = cap_get_proc(); if (!cap_p) { perror("arping: cap_get_proc"); @@ -184,21 +199,6 @@ void limit_capabilities(void) } } - if (prctl(PR_SET_KEEPCAPS, 1) < 0) { - perror("arping: prctl"); - exit(-1); - } - - if (setuid(getuid()) < 0) { - perror("arping: setuid"); - exit(-1); - } - - if (prctl(PR_SET_KEEPCAPS, 0) < 0) { - perror("arping: prctl"); - exit(-1); - } - cap_free(cap_p); #else euid = geteuid(); diff --git a/clockdiff.c b/clockdiff.c index f12da2d..540366d 100644 --- a/clockdiff.c +++ b/clockdiff.c @@ -536,6 +536,11 @@ usage() { } void drop_rights(void) { + if (setuid(getuid())) { + perror("clockdiff: setuid"); + exit(-1); + } + { #ifdef CAPABILITIES cap_t caps = cap_init(); if (cap_set_proc(caps)) { @@ -544,9 +549,6 @@ void drop_rights(void) { } cap_free(caps); #endif - if (setuid(getuid())) { - perror("clockdiff: setuid"); - exit(-1); } } diff --git a/ping_common.c b/ping_common.c index 39b2c74..08c8582 100644 --- a/ping_common.c +++ b/ping_common.c @@ -80,6 +80,21 @@ void limit_capabilities(void) cap_t cap_p; cap_flag_value_t cap_ok; + if (prctl(PR_SET_KEEPCAPS, 1) < 0) { + perror("ping: prctl"); + exit(-1); + } + + if (setuid(getuid()) < 0) { + perror("setuid"); + exit(-1); + } + + if (prctl(PR_SET_KEEPCAPS, 0) < 0) { + perror("ping: prctl"); + exit(-1); + } + cap_cur_p = cap_get_proc(); if (!cap_cur_p) { perror("ping: cap_get_proc"); @@ -109,21 +124,6 @@ void limit_capabilities(void) exit(-1); } - if (prctl(PR_SET_KEEPCAPS, 1) < 0) { - perror("ping: prctl"); - exit(-1); - } - - if (setuid(getuid()) < 0) { - perror("setuid"); - exit(-1); - } - - if (prctl(PR_SET_KEEPCAPS, 0) < 0) { - perror("ping: prctl"); - exit(-1); - } - cap_free(cap_p); cap_free(cap_cur_p); #endif -- 1.7.6.3