Run Security Containers Server as non root user 78/21478/20
authorMichal Witanowski <m.witanowski@samsung.com>
Mon, 12 May 2014 09:35:20 +0000 (11:35 +0200)
committerGerrit Code Review <gerrit@review.vlan103.tizen.org>
Thu, 10 Jul 2014 14:19:41 +0000 (07:19 -0700)
commitb908eed9f607c7f669bacfa020c244445088069e
treedf9ff7ecc1f6984740b96a4b0890d2971e4d7a7b
parenta5da8114776cc08b5efa02e35b0ab39f64e81d7a
Run Security Containers Server as non root user

[Bug/Feature]  Drop root privileges of the server during startup.
[Solution]     * User "security-containers" has been added to the
                 "libvirt" group.
               * CAP_SYS_ADMIN and CAP_MAC_OVERRIDE capabilities have
                 been provided using libcap-ng.
[Verification] 1. Make sure that "security-containers" user (with UID
                  == 377) exists in the conainers. If no, execute:
                      chroot /path/to/container /bin/bash \
                      -c "useradd -r security-containers -u 377"
               2. Run tests.
               3. Start SCS service as root (directly or via systemd
                  service). Verify /proc/<PID>/status of the process:
                   * Uid == 377
                   * CapPrm == CapEff == 0000000000200000
                   * Groups: <libvirt group ID>, <input group>
               4. Run the service with "--root" option. Remember to
                  change policy in dbus configuration file
                  "etc/dbus-1/system.d/com.samsung.containers.conf"
                  from "security-containers" to "root".
               5. Trigger update (via sending SIGUSR1) and check if
                  UID, groups and capabilities set did not change.

               NOTE: Latest libvirt (from "tizen" branch on
               tizen.org) is required.

Change-Id: Idfda05fb081ca48193b19a99a6628cf14ec4bf57
Signed-off-by: Michal Witanowski <m.witanowski@samsung.com>
30 files changed:
CMakeLists.txt
common/utils/environment.cpp [new file with mode: 0644]
common/utils/environment.hpp [new file with mode: 0644]
common/utils/fs.cpp
common/utils/fs.hpp
container-daemon/CMakeLists.txt
container-daemon/configs/org.tizen.containers.domain.daemon.conf.in [moved from container-daemon/configs/org.tizen.containers.domain.daemon.conf with 92% similarity]
packaging/security-containers.spec
server/CMakeLists.txt
server/configs/CMakeLists.txt
server/configs/containers/business.conf
server/configs/containers/private.conf
server/configs/daemon.conf
server/configs/dbus-1/system.d/org.tizen.containers.host.conf.in [moved from server/configs/dbus-1/system.d/org.tizen.containers.host.conf with 67% similarity]
server/configs/image-skel/etc/dbus-1/system.d/org.tizen.containers.domain.conf.in [moved from server/configs/image-skel/etc/dbus-1/system.d/org.tizen.containers.domain.conf with 91% similarity]
server/container.cpp
server/container.hpp
server/containers-manager-config.hpp
server/containers-manager.cpp
server/main.cpp
server/server.cpp
server/server.hpp
tests/unit_tests/CMakeLists.txt
tests/unit_tests/server/configs/ut-containers-manager/buggy-daemon.conf
tests/unit_tests/server/configs/ut-containers-manager/buggy-default-daemon.conf
tests/unit_tests/server/configs/ut-containers-manager/buggy-foreground-daemon.conf
tests/unit_tests/server/configs/ut-containers-manager/test-daemon.conf
tests/unit_tests/server/configs/ut-containers-manager/test-dbus-daemon.conf
tests/unit_tests/server/configs/ut-server/buggy-daemon.conf
tests/unit_tests/server/configs/ut-server/test-daemon.conf