trim away all capabilities of this process that are not explicitly set in merge_set
| 100 | |
| 101 | // trim away all capabilities of this process that are not explicitly set in merge_set |
| 102 | int trim_caps(CephContext *cct, cap_t &merge_caps) |
| 103 | { |
| 104 | cap_t proc_caps = nullptr; |
| 105 | auto close_caps_on_return = make_scope_guard([&] { |
| 106 | if (proc_caps != nullptr) { |
| 107 | cap_free(proc_caps); |
| 108 | } |
| 109 | }); |
| 110 | bool changed = false; |
| 111 | // get process capability set |
| 112 | proc_caps = cap_get_proc(); |
| 113 | if (proc_caps == nullptr) { |
| 114 | dout(1) << " cap_get_proc failed with errno: " << errno << dendl; |
| 115 | return -errno; |
| 116 | } |
| 117 | { |
| 118 | char *cap_str = cap_to_text(proc_caps, 0); |
| 119 | if (cap_str != nullptr){ |
| 120 | dout(10) << " cap_get_proc yields: " << cap_str << dendl; |
| 121 | cap_free(cap_str); |
| 122 | } |
| 123 | } |
| 124 | // iterate over capabilities |
| 125 | for (int i = 0; i <= CAP_LAST_CAP; ++i) { |
| 126 | cap_flag_value_t val; |
| 127 | if (cap_get_flag(merge_caps, i, CAP_PERMITTED, &val) < 0) { |
| 128 | return -errno; |
| 129 | } |
| 130 | if (val == CAP_CLEAR) { |
| 131 | if (cap_get_flag(proc_caps, i, CAP_PERMITTED, &val) < 0) { |
| 132 | return -errno; |
| 133 | } |
| 134 | if (val != CAP_CLEAR) { |
| 135 | // if bit clear in merged set, but set in process set, clear in process set |
| 136 | changed = true; |
| 137 | cap_value_t arr[1]; |
| 138 | arr[0] = i; |
| 139 | if (cap_set_flag(proc_caps, CAP_PERMITTED, 1, arr, CAP_CLEAR) < 0) { |
| 140 | return -errno; |
| 141 | } |
| 142 | if (cap_set_flag(proc_caps, CAP_EFFECTIVE, 1, arr, CAP_CLEAR) < 0) { |
| 143 | return -errno; |
| 144 | } |
| 145 | } |
| 146 | } |
| 147 | } |
| 148 | // apply reduced capability set to process |
| 149 | if (changed) { |
| 150 | char *cap_str = cap_to_text(proc_caps, 0); |
| 151 | if (cap_str != nullptr){ |
| 152 | dout(10) << " new caps for cap_set_proc: " << cap_str << dendl; |
| 153 | cap_free(cap_str); |
| 154 | } |
| 155 | if (cap_set_proc(proc_caps) < 0) { |
| 156 | dout(1) << " cap_set_proc failed with errno: " << errno << dendl; |
| 157 | return -errno; |
| 158 | } |
| 159 | } |
no test coverage detected