diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2013-06-25 17:17:40 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-06-25 17:17:40 +0200 |
| commit | 9da5a2ed1e72d1b68feefd5811a089d0881dd87d (patch) | |
| tree | 2eeb8375e6ffb24321e1d7e3a4ba06183bf9eaec /src/libhydra | |
| parent | a65024264379bacc2733282f2b59b8c14e3897c0 (diff) | |
| parent | ac2ffde4ae8ceaddeab8b6f740804536033153e6 (diff) | |
| download | strongswan-9da5a2ed1e72d1b68feefd5811a089d0881dd87d.tar.bz2 strongswan-9da5a2ed1e72d1b68feefd5811a089d0881dd87d.tar.xz | |
Merge branch 'check-caps'
Plugins may now ensure the process has all the required capabilities.
Some minor changes to UID/GID handling are also included.
Diffstat (limited to 'src/libhydra')
| -rw-r--r-- | src/libhydra/hydra.c | 1 | ||||
| -rw-r--r-- | src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c | 8 | ||||
| -rw-r--r-- | src/libhydra/plugins/kernel_pfkey/kernel_pfkey_plugin.c | 6 |
3 files changed, 14 insertions, 1 deletions
diff --git a/src/libhydra/hydra.c b/src/libhydra/hydra.c index b199b2ffb..f531bd5f4 100644 --- a/src/libhydra/hydra.c +++ b/src/libhydra/hydra.c @@ -97,4 +97,3 @@ bool libhydra_init(const char *daemon) } return !this->integrity_failed; } - diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c index 0eb00dadf..8d5a0d5e8 100644 --- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c +++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c @@ -65,6 +65,14 @@ plugin_t *kernel_netlink_plugin_create() { private_kernel_netlink_plugin_t *this; + if (!lib->caps->keep(lib->caps, CAP_NET_ADMIN)) + { /* required to bind/use XFRM sockets / create/modify routing tables, but + * not if only the read-only parts of kernel-netlink-net are used, so + * we don't fail here */ + DBG1(DBG_KNL, "kernel-netlink plugin might require CAP_NET_ADMIN " + "capability"); + } + INIT(this, .public = { .plugin = { diff --git a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_plugin.c b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_plugin.c index 894175402..d2c00b0f2 100644 --- a/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_plugin.c +++ b/src/libhydra/plugins/kernel_pfkey/kernel_pfkey_plugin.c @@ -62,6 +62,12 @@ plugin_t *kernel_pfkey_plugin_create() { private_kernel_pfkey_plugin_t *this; + if (!lib->caps->keep(lib->caps, CAP_NET_ADMIN)) + { /* required to open PF_KEY sockets */ + DBG1(DBG_KNL, "kernel-pfkey plugin requires CAP_NET_ADMIN capability"); + return NULL; + } + INIT(this, .public = { .plugin = { |