diff --git a/bind.changes b/bind.changes index 453ba83..74c41e0 100644 --- a/bind.changes +++ b/bind.changes @@ -1,3 +1,8 @@ +------------------------------------------------------------------- +Tue May 6 13:46:43 CEST 2008 - ug@suse.de + +- capset support fixed (bnc#386653) + ------------------------------------------------------------------- Thu Apr 10 12:54:45 CEST 2008 - ro@suse.de diff --git a/bind.spec b/bind.spec index d2643a8..1ea609c 100644 --- a/bind.spec +++ b/bind.spec @@ -15,10 +15,10 @@ Name: bind %define pkg_name bind %define pkg_vers 9.4.2 #BuildRequires: openldap2 openldap2-devel -BuildRequires: openssl openssl-devel +BuildRequires: libcap libcap-devel openssl openssl-devel Summary: Domain Name System (DNS) Server (named) Version: 9.4.2 -Release: 27 +Release: 33 %define SDB_LDAP_VERSION 1.0-beta License: BSD 3-Clause; X11/MIT Group: Productivity/Networking/DNS/Servers @@ -40,6 +40,7 @@ Patch4: perl-path.diff #Patch50: sdb_ldap.diff Patch51: pie_compile.diff Patch52: named-bootconf.diff +Patch53: capset.diff %if %ul_version >= 1 %define VENDOR UL %else @@ -197,6 +198,7 @@ Authors: %patch51 %endif %patch52 +%patch53 # modify settings of some files regarding to OS version and vendor function replaceStrings() { @@ -678,6 +680,8 @@ fi %doc %{_mandir}/man5/idnrc.5.gz %changelog +* Tue May 06 2008 ug@suse.de +- capset support fixed (bnc#386653) * Thu Apr 10 2008 ro@suse.de - added baselibs.conf file to build xxbit packages for multilib support diff --git a/capset.diff b/capset.diff new file mode 100644 index 0000000..b05f40a --- /dev/null +++ b/capset.diff @@ -0,0 +1,265 @@ +--- bin/named/unix/os.c ++++ bin/named/unix/os.c 2008/05/06 10:18:34 +@@ -60,16 +60,16 @@ + #endif + + /* +- * If there's no , we don't care about ++ * If there's no , we don't care about + */ +-#ifndef HAVE_LINUX_CAPABILITY_H ++#ifndef HAVE_SYS_CAPABILITY_H + #undef HAVE_SYS_PRCTL_H + #endif + + /* + * Linux defines: + * (T) HAVE_LINUXTHREADS +- * (C) HAVE_LINUX_CAPABILITY_H ++ * (C) HAVE_SYS_CAPABILITY_H + * (P) HAVE_SYS_PRCTL_H + * The possible cases are: + * none: setuid() normally +@@ -111,7 +111,7 @@ + static isc_boolean_t done_setuid = ISC_FALSE; + static int dfd[2] = { -1, -1 }; + +-#ifdef HAVE_LINUX_CAPABILITY_H ++#ifdef HAVE_SYS_CAPABILITY_H + + static isc_boolean_t non_root = ISC_FALSE; + static isc_boolean_t non_root_caps = ISC_FALSE; +@@ -125,7 +125,7 @@ + #define _LINUX_FS_H + + #include /* Required for syscall(). */ +-#include /* Required for _LINUX_CAPABILITY_VERSION. */ ++#include /* Required for _LINUX_CAPABILITY_VERSION. */ + + #ifdef HAVE_SYS_PRCTL_H + #include /* Required for prctl(). */ +@@ -142,32 +142,16 @@ + + #endif /* HAVE_SYS_PRCTL_H */ + +-#ifndef SYS_capset +-#ifndef __NR_capset +-#include /* Slackware 4.0 needs this. */ +-#endif +-#define SYS_capset __NR_capset +-#endif +- + static void +-linux_setcaps(unsigned int caps) { +- struct __user_cap_header_struct caphead; +- struct __user_cap_data_struct cap; ++linux_setcaps(cap_t caps) { + char strbuf[ISC_STRERRORSIZE]; + + if ((getuid() != 0 && !non_root_caps) || non_root) + return; + +- memset(&caphead, 0, sizeof(caphead)); +- caphead.version = _LINUX_CAPABILITY_VERSION; +- caphead.pid = 0; +- memset(&cap, 0, sizeof(cap)); +- cap.effective = caps; +- cap.permitted = caps; +- cap.inheritable = 0; +- if (syscall(SYS_capset, &caphead, &cap) < 0) { ++ if (cap_set_proc(caps) < 0) { + isc__strerror(errno, strbuf, sizeof(strbuf)); +- ns_main_earlyfatal("capset failed: %s:" ++ ns_main_earlyfatal("cap_set_proc failed: %s:" + " please ensure that the capset kernel" + " module is loaded. see insmod(8)", + strbuf); +@@ -176,7 +160,9 @@ + + static void + linux_initialprivs(void) { +- unsigned int caps; ++ cap_t caps; ++ cap_value_t capval; ++ char strbuf[ISC_STRERRORSIZE]; + + /*% + * We don't need most privileges, so we drop them right away. +@@ -184,17 +170,26 @@ + * capabilities to the minimum needed to run the server. + */ + +- caps = 0; ++ if ( (caps = cap_init()) == NULL) { ++ isc__strerror(errno, strbuf, sizeof (strbuf)); ++ ns_main_earlyfatal("cap_init failed: %s", strbuf); ++ } + + /* + * We need to be able to bind() to privileged ports, notably port 53! + */ +- caps |= (1 << CAP_NET_BIND_SERVICE); ++ ++ capval = CAP_NET_BIND_SERVICE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * We need chroot() initially too. + */ +- caps |= (1 << CAP_SYS_CHROOT); ++ ++ capval = CAP_SYS_CHROOT; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + #if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS) + /* +@@ -203,19 +198,25 @@ + * tried) or we're not using threads. If either of these is + * true, we want the setuid capability. + */ +- caps |= (1 << CAP_SETUID); ++ capval = CAP_SETUID; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + #endif + + /* + * Since we call initgroups, we need this. + */ +- caps |= (1 << CAP_SETGID); ++ capval = CAP_SETGID; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * Without this, we run into problems reading a configuration file + * owned by a non-root user and non-world-readable on startup. + */ +- caps |= (1 << CAP_DAC_READ_SEARCH); ++ capval = CAP_DAC_READ_SEARCH; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * XXX We might want to add CAP_SYS_RESOURCE, though it's not +@@ -224,14 +225,18 @@ + * of files, the stack size, data size, and core dump size to + * support named.conf options, this is now being added to test. + */ +- caps |= (1 << CAP_SYS_RESOURCE); ++ capval = CAP_SYS_RESOURCE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + linux_setcaps(caps); + } + + static void + linux_minprivs(void) { +- unsigned int caps; ++ cap_t caps; ++ cap_value_t capval; ++ char strbuf[ISC_STRERRORSIZE]; + + /*% + * Drop all privileges except the ability to bind() to privileged +@@ -241,8 +246,14 @@ + * chroot() could be used to escape from the chrooted area. + */ + +- caps = 0; +- caps |= (1 << CAP_NET_BIND_SERVICE); ++ if ( (caps = cap_init()) == NULL) { ++ isc__strerror(errno, strbuf, sizeof (strbuf)); ++ ns_main_earlyfatal("cap_init failed: %s", strbuf); ++ } ++ ++ capval = CAP_NET_BIND_SERVICE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + /* + * XXX We might want to add CAP_SYS_RESOURCE, though it's not +@@ -251,7 +262,9 @@ + * of files, the stack size, data size, and core dump size to + * support named.conf options, this is now being added to test. + */ +- caps |= (1 << CAP_SYS_RESOURCE); ++ capval = CAP_SYS_RESOURCE; ++ cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); ++ cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); + + linux_setcaps(caps); + } +@@ -278,7 +291,7 @@ + } + #endif + +-#endif /* HAVE_LINUX_CAPABILITY_H */ ++#endif /* HAVE_SYS_CAPABILITY_H */ + + + static void +@@ -295,7 +308,7 @@ + void + ns_os_init(const char *progname) { + setup_syslog(progname); +-#ifdef HAVE_LINUX_CAPABILITY_H ++#ifdef HAVE_SYS_CAPABILITY_H + linux_initialprivs(); + #endif + #ifdef HAVE_LINUXTHREADS +@@ -474,7 +487,7 @@ + done_setuid = ISC_TRUE; + + #ifdef HAVE_LINUXTHREADS +-#ifdef HAVE_LINUX_CAPABILITY_H ++#ifdef HAVE_SYS_CAPABILITY_H + if (!non_root_caps) + ns_main_earlyfatal("-u with Linux threads not supported: " + "requires kernel support for " +@@ -496,7 +509,7 @@ + ns_main_earlyfatal("setuid(): %s", strbuf); + } + +-#if defined(HAVE_LINUX_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS) ++#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS) + linux_minprivs(); + #endif + #if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE) +@@ -518,7 +531,7 @@ + ns_os_changeuser(); /* Call setuid() before threads are started */ + #endif + +-#if defined(HAVE_LINUX_CAPABILITY_H) && defined(HAVE_LINUXTHREADS) ++#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS) + linux_minprivs(); + #endif + } +--- config.h.in ++++ config.h.in 2008/05/06 10:17:46 +@@ -187,8 +187,8 @@ + /* Define to 1 if you have the `thr' library (-lthr). */ + #undef HAVE_LIBTHR + +-/* Define to 1 if you have the header file. */ +-#undef HAVE_LINUX_CAPABILITY_H ++/* Define to 1 if you have the header file. */ ++#undef HAVE_SYS_CAPABILITY_H + + /* Define to 1 if you have the header file. */ + #undef HAVE_LOCALE_H +--- configure.in ++++ configure.in 2008/05/06 10:17:46 +@@ -1695,7 +1695,8 @@ + [ --disable-linux-caps disable linux capabilities]) + case "$enable_linux_caps" in + yes|'') +- AC_CHECK_HEADERS(linux/capability.h) ++ AC_CHECK_HEADERS(sys/capability.h) ++ AC_CHECK_LIB(cap, cap_set_proc, LIBS="-lcap $LIBS") + ;; + no) + ;;