system/systemd
system/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd synced 2024-07-21 10:17:21 +00:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

core: do not drop CAP_SETUID if it is in AmbientCapabilities=

Browse source 
Follow-up for 24832d10b6
This commit is contained in:
Luca Boccassi 2023-12-01 01:44:54 +00:00 committed by Luca Boccassi
parent 3f3ec0b8e8
commit f4a35f2ad9
3 changed files with 19 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

10
src/core/exec-invoke.c
View file

@ -4918,10 +4918,12 @@ int exec_invoke(
}
if (keep_seccomp_privileges) {
r = drop_capability(CAP_SETUID);
if (r < 0) {
*exit_status = EXIT_USER;
return log_exec_error_errno(context, params, r, "Failed to drop CAP_SETUID: %m");
if (!FLAGS_SET(capability_ambient_set, (UINT64_C(1) << CAP_SETUID))) {
r = drop_capability(CAP_SETUID);
if (r < 0) {
*exit_status = EXIT_USER;
return log_exec_error_errno(context, params, r, "Failed to drop CAP_SETUID: %m");
}
}
r = keep_capability(CAP_SYS_ADMIN);

3
src/test/test-execute.c
View file

@ -1070,6 +1070,9 @@ static void test_exec_ambientcapabilities(Manager *m) {
test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED);
test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED);
if (have_effective_cap(CAP_SETUID) > 0)
test(m, "exec-ambientcapabilities-dynuser.service", can_unshare ? 0 : EXIT_NAMESPACE, CLD_EXITED);
if (!check_nobody_user_and_group()) {
log_notice("nobody user/group is not synthesized or may conflict to other entries, skipping remaining tests in %s", __func__);
return;

10
test/test-execute/exec-ambientcapabilities-dynuser.service Normal file
View file

@ -0,0 +1,10 @@
# SPDX-License-Identifier: LGPL-2.1-or-later
[Unit]
Description=Test for AmbientCapabilities (dynamic user)
[Service]
ExecStart=/bin/sh -x -c 'c=$$(grep "CapAmb:" /proc/self/status); test "$$c" = "CapAmb: 0000000000002081"'
Type=oneshot
AmbientCapabilities=CAP_CHOWN CAP_SETUID CAP_NET_RAW
DynamicUser=yes
PrivateUsers=yes