From patchwork Thu Feb 16 14:59:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeff Layton X-Patchwork-Id: 9577369 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id AE12760244 for ; Thu, 16 Feb 2017 14:59:44 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 993D128600 for ; Thu, 16 Feb 2017 14:59:44 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8DE9E28602; Thu, 16 Feb 2017 14:59:44 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7C03728601 for ; Thu, 16 Feb 2017 14:59:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932120AbdBPO7l (ORCPT ); Thu, 16 Feb 2017 09:59:41 -0500 Received: from hr2.samba.org ([144.76.82.148]:33944 "EHLO hr2.samba.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932103AbdBPO7k (ORCPT ); Thu, 16 Feb 2017 09:59:40 -0500 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=samba.org; s=42627210; h=Message-Id:Date:Cc:To:From; bh=bsGUdh7cMsp2d549VFeg71rm9Bvf3VakegdImo9NecI=; b=Sk2FwupMawTCjStl+nHq76GzSx Mwu90q+S1Og+gKA9t+Jj9wt/TXZY5tVSThtL96yHCEEC3Qmep4MJiwpxP9Ds7x0KBcptt1GQ7lt5l aFq70/4tfhyUuo51tHsi7TA+FuorGgRrHPdZunVqO2jkj0SOx0JuL7pXVLru5yo3IK9w=; Received: from [127.0.0.2] (localhost [127.0.0.1]) by hr2.samba.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim) id 1ceNX4-00024l-Kh; Thu, 16 Feb 2017 14:59:42 +0000 From: Jeff Layton To: linux-cifs@vger.kernel.org, samba-technical@lists.samba.org Cc: simo@redhat.com Subject: [cifs-utils PATCH] cifs.upcall: trim even more capabilities Date: Thu, 16 Feb 2017 09:59:13 -0500 Message-Id: <20170216145913.15848-1-jlayton@samba.org> X-Mailer: git-send-email 2.9.3 Sender: linux-cifs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-cifs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP We really only need CAP_DAC_READ_SEARCH, not CAP_DAC_OVERRIDE, and only when we are going to probe the environ file. Also, fix the non-libcap-ng trim_capabilities prototype. Signed-off-by: Jeff Layton Reviewed-by: Simo Sorce --- cifs.upcall.c | 17 ++++++++--------- 1 file changed, 8 insertions(+), 9 deletions(-) diff --git a/cifs.upcall.c b/cifs.upcall.c index 6d9c427b7032..dae58b919408 100644 --- a/cifs.upcall.c +++ b/cifs.upcall.c @@ -70,22 +70,21 @@ typedef enum _sectype { #ifdef HAVE_LIBCAP_NG static int -trim_capabilities(bool need_ptrace) +trim_capabilities(bool need_environ) { capng_clear(CAPNG_SELECT_BOTH); - /* - * Need PTRACE and DAC_OVERRIDE for environment scraping, SETGID to - * change gid and grouplist, and SETUID to change uid. - */ + /* SETUID and SETGID to change uid, gid, and grouplist */ if (capng_updatev(CAPNG_ADD, CAPNG_PERMITTED|CAPNG_EFFECTIVE, - CAP_SETUID, CAP_SETGID, CAP_DAC_OVERRIDE, -1)) { + CAP_SETUID, CAP_SETGID, -1)) { syslog(LOG_ERR, "%s: Unable to update capability set: %m\n", __func__); return 1; } - if (need_ptrace && - capng_update(CAPNG_ADD, CAPNG_PERMITTED|CAPNG_EFFECTIVE, CAP_SYS_PTRACE)) { + /* Need PTRACE and DAC_OVERRIDE for environment scraping */ + if (need_environ && + capng_updatev(CAPNG_ADD, CAPNG_PERMITTED|CAPNG_EFFECTIVE, + CAP_SYS_PTRACE, CAP_DAC_READ_SEARCH, -1)) { syslog(LOG_ERR, "%s: Unable to update capability set: %m\n", __func__); return 1; } @@ -109,7 +108,7 @@ drop_all_capabilities(void) } #else /* HAVE_LIBCAP_NG */ static int -trim_capabilities(void) +trim_capabilities(bool unused) { return 0; }