system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-21 18:24:38 +00:00
Code Issues Actions 6 Packages Projects Releases Wiki Activity

resolve: Skip creating stubs if missing CAP_NET_BIND_SERVICE

Browse source 
If we don't have CAP_NET_BIND_SERVICE, we won't be able to bind
the stub listener socket, so let's skip creating it and log a warning.

We do the same for the extra stubs if they're configured on privileged
ports.
This commit is contained in:
Daan De Meyer 2023-01-26 22:20:01 +01:00
parent 2642d22adc
commit 0398c084ef
1 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

9
src/resolve/resolved-dns-stub.c
View file

@ -3,6 +3,7 @@
#include <net/if_arp.h>
#include <netinet/tcp.h>
#include "capability-util.h"
#include "errno-util.h"
#include "fd-util.h"
#include "missing_network.h"
@ -1237,6 +1238,12 @@ static int manager_dns_stub_fd_extra(Manager *m, DnsStubListenerExtra *l, int ty
if (*event_source)
return sd_event_source_get_io_fd(*event_source);
if (!have_effective_cap(CAP_NET_BIND_SERVICE) && dns_stub_listener_extra_port(l) < 1024) {
log_warning("Missing CAP_NET_BIND_SERVICE capability, not creating extra stub listener on port %hu.",
dns_stub_listener_extra_port(l));
return 0;
}
if (l->family == AF_INET)
sa = (union sockaddr_union) {
.in.sin_family = l->family,
@ -1332,6 +1339,8 @@ int manager_dns_stub_start(Manager *m) {
if (m->dns_stub_listener_mode == DNS_STUB_LISTENER_NO)
log_debug("Not creating stub listener.");
else if (!have_effective_cap(CAP_NET_BIND_SERVICE))
log_warning("Missing CAP_NET_BIND_SERVICE capability, not creating stub listener on port 53.");
else {
static const struct {
uint32_t addr;