packaging/dhcp-4.2.2-capability.patch

   1 diff -up dhcp-4.2.2b1/client/dhclient.8.capability dhcp-4.2.2b1/client/dhclient.8
   2 --- dhcp-4.2.2b1/client/dhclient.8.capability   2011-07-01 15:09:06.603784531 +0200
   3 +++ dhcp-4.2.2b1/client/dhclient.8      2011-07-01 15:09:06.663783913 +0200
   4 @@ -118,6 +118,9 @@ dhclient - Dynamic Host Configuration Pr
   5  .B -w
   6  ]
   7  [
   8 +.B -nc
   9 +]
  10 +[
  11  .B -B
  12  ]
  13  [
  14 @@ -296,6 +299,32 @@ has been added or removed, so that the c
  15  address on that interface.
  16
  17  .TP
  18 +.BI \-nc
  19 +Do not drop capabilities.
  20 +
  21 +Normally, if
  22 +.B dhclient
  23 +was compiled with libcap-ng support,
  24 +.B dhclient
  25 +drops most capabilities immediately upon startup.  While more secure,
  26 +this greatly restricts the additional actions that hooks in
  27 +.B dhclient-script (8)
  28 +can take.  (For example, any daemons that
  29 +.B dhclient-script (8)
  30 +starts or restarts will inherit the restricted capabilities as well,
  31 +which may interfere with their correct operation.)  Thus, the
  32 +.BI \-nc
  33 +option can be used to prevent
  34 +.B dhclient
  35 +from dropping capabilities.
  36 +
  37 +The
  38 +.BI \-nc
  39 +option is ignored if
  40 +.B dhclient
  41 +was not compiled with libcap-ng support.
  42 +
  43 +.TP
  44  .BI \-B
  45  Set the BOOTP broadcast flag in request packets so servers will always
  46  broadcast replies.
  47 diff -up dhcp-4.2.2b1/client/dhclient.c.capability dhcp-4.2.2b1/client/dhclient.c
  48 --- dhcp-4.2.2b1/client/dhclient.c.capability   2011-07-01 15:09:06.644784107 +0200
  49 +++ dhcp-4.2.2b1/client/dhclient.c      2011-07-01 15:09:06.664783903 +0200
  50 @@ -39,6 +39,10 @@
  51  #include <limits.h>
  52  #include <dns/result.h>
  53
  54 +#ifdef HAVE_LIBCAP_NG
  55 +#include <cap-ng.h>
  56 +#endif
  57 +
  58  /*
  59   * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
  60   * that when building ISC code.
  61 @@ -141,6 +145,9 @@ main(int argc, char **argv) {
  62         int timeout_arg = 0;
  63         char *arg_conf = NULL;
  64         int arg_conf_len = 0;
  65 +#ifdef HAVE_LIBCAP_NG
  66 +       int keep_capabilities = 0;
  67 +#endif
  68
  69         /* Initialize client globals. */
  70         memset(&default_duid, 0, sizeof(default_duid));
  71 @@ -410,6 +417,10 @@ main(int argc, char **argv) {
  72                         }
  73
  74                         dhclient_request_options = argv[i];
  75 +               } else if (!strcmp(argv[i], "-nc")) {
  76 +#ifdef HAVE_LIBCAP_NG
  77 +                       keep_capabilities = 1;
  78 +#endif
  79                 } else if (argv[i][0] == '-') {
  80                     usage();
  81                 } else if (interfaces_requested < 0) {
  82 @@ -458,6 +469,19 @@ main(int argc, char **argv) {
  83                 path_dhclient_script = s;
  84         }
  85
  86 +#ifdef HAVE_LIBCAP_NG
  87 +       /* Drop capabilities */
  88 +       if (!keep_capabilities) {
  89 +               capng_clear(CAPNG_SELECT_CAPS);
  90 +               capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
  91 +                               CAP_DAC_OVERRIDE); // Drop this someday
  92 +               capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
  93 +                               CAP_NET_ADMIN, CAP_NET_RAW,
  94 +                               CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, -1);
  95 +               capng_apply(CAPNG_SELECT_CAPS);
  96 +       }
  97 +#endif
  98 +
  99         /* Set up the initial dhcp option universe. */
 100         initialize_common_option_spaces();
 101
 102 diff -up dhcp-4.2.2b1/client/dhclient-script.8.capability dhcp-4.2.2b1/client/dhclient-script.8
 103 --- dhcp-4.2.2b1/client/dhclient-script.8.capability    2011-07-01 15:09:06.604784521 +0200
 104 +++ dhcp-4.2.2b1/client/dhclient-script.8       2011-07-01 15:09:06.666783883 +0200
 105 @@ -239,6 +239,16 @@ repeatedly initialized to the values pro
 106  the other.   Assuming the information provided by both servers is
 107  valid, this shouldn't cause any real problems, but it could be
 108  confusing.
 109 +.PP
 110 +Normally, if dhclient was compiled with libcap-ng support,
 111 +dhclient drops most capabilities immediately upon startup.
 112 +While more secure, this greatly restricts the additional actions that
 113 +hooks in dhclient-script can take. For example, any daemons that
 114 +dhclient-script starts or restarts will inherit the restricted
 115 +capabilities as well, which may interfere with their correct operation.
 116 +Thus, the
 117 +.BI \-nc
 118 +option can be used to prevent dhclient from dropping capabilities.
 119  .SH SEE ALSO
 120  dhclient(8), dhcpd(8), dhcrelay(8), dhclient.conf(5) and
 121  dhclient.leases(5).
 122 diff -up dhcp-4.2.2b1/configure.ac.capability dhcp-4.2.2b1/configure.ac
 123 --- dhcp-4.2.2b1/configure.ac.capability        2011-07-01 15:09:06.527785317 +0200
 124 +++ dhcp-4.2.2b1/configure.ac   2011-07-01 15:09:06.667783873 +0200
 125 @@ -449,6 +449,41 @@ AC_TRY_LINK(
 126  # Look for optional headers.
 127  AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
 128
 129 +# look for capabilities library
 130 +AC_ARG_WITH(libcap-ng,
 131 +    [  --with-libcap-ng=[auto/yes/no]  Add Libcap-ng support [default=auto]],,
 132 +    with_libcap_ng=auto)
 133 +
 134 +# Check for Libcap-ng API
 135 +#
 136 +# libcap-ng detection
 137 +if test x$with_libcap_ng = xno ; then
 138 +    have_libcap_ng=no;
 139 +else
 140 +    # Start by checking for header file
 141 +    AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
 142 +
 143 +    # See if we have libcap-ng library
 144 +    AC_CHECK_LIB(cap-ng, capng_clear,
 145 +                 CAPNG_LDADD=-lcap-ng,)
 146 +
 147 +    # Check results are usable
 148 +    if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
 149 +       AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
 150 +    fi
 151 +    if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
 152 +       AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
 153 +    fi
 154 +fi
 155 +AC_SUBST(CAPNG_LDADD)
 156 +AC_MSG_CHECKING(whether to use libcap-ng)
 157 +if test x$CAPNG_LDADD != x ; then
 158 +    AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
 159 +    AC_MSG_RESULT(yes)
 160 +else
 161 +    AC_MSG_RESULT(no)
 162 +fi
 163 +
 164  # Solaris needs some libraries for functions
 165  AC_SEARCH_LIBS(socket, [socket])
 166  AC_SEARCH_LIBS(inet_ntoa, [nsl])
 167 diff -up dhcp-4.2.2b1/relay/dhcrelay.c.capability dhcp-4.2.2b1/relay/dhcrelay.c
 168 --- dhcp-4.2.2b1/relay/dhcrelay.c.capability    2011-07-01 15:09:06.626784295 +0200
 169 +++ dhcp-4.2.2b1/relay/dhcrelay.c       2011-07-01 15:12:05.362223794 +0200
 170 @@ -36,6 +36,11 @@
 171  #include <syslog.h>
 172  #include <sys/time.h>
 173
 174 +#ifdef HAVE_LIBCAP_NG
 175 +#  include <cap-ng.h>
 176 +   int keep_capabilities = 0;
 177 +#endif
 178 +
 179  TIME default_lease_time = 43200; /* 12 hours... */
 180  TIME max_lease_time = 86400; /* 24 hours... */
 181  struct tree_cache *global_options[256];
 182 @@ -356,6 +361,10 @@ main(int argc, char **argv) {
 183                         sl->next = upstreams;
 184                         upstreams = sl;
 185  #endif
 186 +               } else if (!strcmp(argv[i], "-nc")) {
 187 +#ifdef HAVE_LIBCAP_NG
 188 +                       keep_capabilities = 1;
 189 +#endif
 190                 } else if (!strcmp(argv[i], "-pf")) {
 191                         if (++i == argc)
 192                                 usage();
 193 @@ -426,6 +435,17 @@ main(int argc, char **argv) {
 194  #endif
 195         }
 196
 197 +#ifdef HAVE_LIBCAP_NG
 198 +       /* Drop capabilities */
 199 +       if (!keep_capabilities) {
 200 +               capng_clear(CAPNG_SELECT_BOTH);
 201 +               capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
 202 +                               CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1);
 203 +               capng_apply(CAPNG_SELECT_BOTH);
 204 +               log_info ("Dropped all unnecessary capabilities.");
 205 +       }
 206 +#endif
 207 +
 208         if (!quiet) {
 209                 log_info("%s %s", message, PACKAGE_VERSION);
 210                 log_info(copyright);
 211 @@ -573,6 +593,15 @@ main(int argc, char **argv) {
 212                 dhcpv6_packet_handler = do_packet6;
 213  #endif
 214
 215 +#ifdef HAVE_LIBCAP_NG
 216 +       /* Drop all capabilities */
 217 +       if (!keep_capabilities) {
 218 +               capng_clear(CAPNG_SELECT_BOTH);
 219 +               capng_apply(CAPNG_SELECT_BOTH);
 220 +               log_info ("Dropped all capabilities.");
 221 +       }
 222 +#endif
 223 +
 224         /* Start dispatching packets and timeouts... */
 225         dispatch();
 226