| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| |
|
|
|
|
| |
Of course Solaris doesn't have getgrouplist()...
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
|
| |
|
|
|
|
|
|
|
|
| |
It may be requred for quagga process to belong to additional
groups. E.g. nhrp module will need to talk to strongSwan using
vici and may require additional permissions. Initialize groups
from the system group database.
Signed-off-by: Timo Teräs <timo.teras@iki.fi>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
|
| |
|
|
|
|
|
|
|
|
|
|
| |
From what I can tell, CAP_NET_BROADCAST has never been required for any
functionality in the Linux kernel, so we do not really need it.
However, it causes breakage in contexts where Quagga is started with a
limited set of capabilities, e.g. in Docker, because these may not
include CAP_NET_BROADCAST and in the case of Docker do not even support
adding CAP_NET_BROADCAST.
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
|
| |
|
|
| |
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
When using POSIX capabilities on SunOS the capabilities are too
restricitve resulting in quagga processes not being able to read their
own config files. Credit goes to Oracle where this patch was originally
authored and included in OpenSolaris.
lib/privs.c: Include additional capabilities, better checking of
missing capabilities.
Fixes: #820
Acked-by: Greg Troxel <gdt@ir.bbn.com>
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
Quagga sources have inherited a slew of Page Feed (^L, \xC) characters
from ancient history. Among other things, these break patchwork's
XML-RPC API because \xC is not a valid character in XML documents.
Nuke them from high orbit.
Patches can be adapted simply by:
sed -e 's%^L%%' -i filename.patch
(you can type page feeds in some environments with Ctrl-V Ctrl-L)
Signed-off-by: David Lamparter <equinox@opensourcerouting.org>
|
| |
|
|
|
|
|
|
|
| |
2007-09-18 Paul Jakma <paul.jakma@sun.com>
* privs.c: definition of ZCAP_NET_ADMIN on Solaris should
be PRIV_SYS_IP_CONFIG, when that's available. Thus allowing
Quagga to work with in Solaris zones with exclusive IP
instances.
|
| |
|
|
|
|
|
|
|
| |
2006-03-14 Paul Jakma <paul.jakma@sun.com>
* privs.c: (zprivs_caps_init) Change user IDs before lowering
privileges, while this seems to work on Linux, on Solaris
it rightfully refuses due to PRIV_PROC_SETID having been
dropped.
|
| |
|
|
|
|
|
|
| |
2005-11-24 Paul Jakma <paul.jakma@sun.com>
* privs.c: (zcaps2sys/solaris) remove unused variable.
(zprivs_state_caps/solaris) Format string missing a
specifier.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
* configure.ac: Add the test for Solaris least-privileges. Set
defines for whether capabilities are supported and whether of
the linux or solaris variety.
Add missing-prototypes, missing-declarations, char-subscripts
and cast-qual warnings to default cflags, cause Hasso enjoys warnings,
and we really should clean the remaining ones up. (ie isisd..).
* (*/*main.c) Update the zebra_capabilities_t arrays in the various
daemons to match the changes made in lib/privs.h.
* zebra.h: Solaris capabilities requires priv.h to be included.
* privs.{c,h}: Add support for Solaris Least-Privileges.
privs.h: Reduce some of the abstract capabilities, which do
not have rough equivalents on both systems. Rename the net
related caps to _NET, as they should have been in first
place.
(zprivs_terminate) should take the zebra_privs_t as argument so
that it can update change pointer.
Add an additional privilege state, ZPRIVS_UNKNOWN.
* privs.c: (various capability functions) Add
Solaris privileges variants.
(zprivs_state) Use privs.c specific generic types to
represent various capability/privilege related types, so that
each can be typedef'd as appropriate on each platform.
(zprivs_null_state) static added, to hold the state the null
method should report (should be raised by default, and
LOWERED if zprivs_terminate has been called)
(zprivs_state_null) Report back the zprivs_null_state.
(cap_map) Make it able to map abstract capability to multiple
system capabilities.
(zcaps2sys) Map to abstract capabilities to multiple system
privileges/capabilities.
(zprivs_init) move capability related init to seperate
function, zprivs_caps_init.
(zprivs_terminate) ditto, moved to zprivs_caps_terminate.
Set the change_state callback to the NULL state, so the
user can continue to run and use the callbacks.
|
| |
|
|
|
| |
* global: Replace strerror with safe_strerror. And vtysh/vtysh.c
needs to include "log.h" to pick up the declaration.
|
| |
|
|
|
|
| |
* lib/privs.h (zprivs_init): do not use zlog() as it depends on
vty having been initialised (zlog calls vty_log). print to stderr
directly instead.
|
| |
|
|
| |
in zebra.h to make it compile in debian.
|
| | |
|
| | |
|
| | |
|
|
|
Linux capabilities enabled (if libcap is enabled).
|
