diff options
| author | Tobias Brunner <tobias@strongswan.org> | 2013-06-25 08:35:06 +0200 |
|---|---|---|
| committer | Tobias Brunner <tobias@strongswan.org> | 2013-06-25 17:16:32 +0200 |
| commit | 6f15f5e632917775db9ecf2826532884f34877e8 (patch) | |
| tree | b7524c97b9d820685dadc70a0812011c00496f36 /src | |
| parent | 1dd61bf13d688dfa71b25d3eb7872dc784f1e57c (diff) | |
| download | strongswan-6f15f5e632917775db9ecf2826532884f34877e8.tar.bz2 strongswan-6f15f5e632917775db9ecf2826532884f34877e8.tar.xz | |
dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets
Diffstat (limited to 'src')
| -rw-r--r-- | src/libcharon/plugins/dhcp/dhcp_plugin.c | 11 | ||||
| -rw-r--r-- | src/libstrongswan/utils/capabilities.h | 3 |
2 files changed, 14 insertions, 0 deletions
diff --git a/src/libcharon/plugins/dhcp/dhcp_plugin.c b/src/libcharon/plugins/dhcp/dhcp_plugin.c index a31f12689..31195e25b 100644 --- a/src/libcharon/plugins/dhcp/dhcp_plugin.c +++ b/src/libcharon/plugins/dhcp/dhcp_plugin.c @@ -107,6 +107,17 @@ plugin_t *dhcp_plugin_create() { private_dhcp_plugin_t *this; + if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE)) + { /* required to bind DHCP socket (port 68) */ + DBG1(DBG_NET, "dhcp plugin requires CAP_NET_BIND_SERVICE capability"); + return NULL; + } + else if (!lib->caps->keep(lib->caps, CAP_NET_RAW)) + { /* required to open DHCP receive socket (AF_PACKET) */ + DBG1(DBG_NET, "dhcp plugin requires CAP_NET_RAW capability"); + return NULL; + } + INIT(this, .public = { .plugin = { diff --git a/src/libstrongswan/utils/capabilities.h b/src/libstrongswan/utils/capabilities.h index 543af32cc..34937577a 100644 --- a/src/libstrongswan/utils/capabilities.h +++ b/src/libstrongswan/utils/capabilities.h @@ -38,6 +38,9 @@ typedef struct capabilities_t capabilities_t; #ifndef CAP_NET_ADMIN # define CAP_NET_ADMIN 12 #endif +#ifndef CAP_NET_RAW +# define CAP_NET_RAW 13 +#endif /** * POSIX capability dropping abstraction layer. |