1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
|
/*
* Copyright (C) Igor Sysoev
* Copyright (C) NGINX, Inc.
*/
#include <nxt_main.h>
#if (NXT_HAVE_LINUX_CAPABILITY)
#include <linux/capability.h>
#include <sys/syscall.h>
#if (_LINUX_CAPABILITY_VERSION_3)
#define NXT_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_3
#elif (_LINUX_CAPABILITY_VERSION_2)
#define NXT_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION_2
#else
#define NXT_CAPABILITY_VERSION _LINUX_CAPABILITY_VERSION
#endif
#define nxt_capget(hdrp, datap) \
syscall(SYS_capget, hdrp, datap)
#define nxt_capset(hdrp, datap) \
syscall(SYS_capset, hdrp, datap)
#endif /* NXT_HAVE_LINUX_CAPABILITY */
static nxt_int_t nxt_capability_specific_set(nxt_task_t *task,
nxt_capabilities_t *cap);
nxt_int_t
nxt_capability_set(nxt_task_t *task, nxt_capabilities_t *cap)
{
nxt_assert(cap->setid == 0);
if (geteuid() == 0) {
cap->setid = 1;
cap->chroot = 1;
return NXT_OK;
}
return nxt_capability_specific_set(task, cap);
}
#if (NXT_HAVE_LINUX_CAPABILITY)
static uint32_t
nxt_capability_linux_get_version(void)
{
struct __user_cap_header_struct hdr;
hdr.version = NXT_CAPABILITY_VERSION;
hdr.pid = nxt_pid;
nxt_capget(&hdr, NULL);
return hdr.version;
}
static nxt_int_t
nxt_capability_specific_set(nxt_task_t *task, nxt_capabilities_t *cap)
{
struct __user_cap_data_struct *val, data[2];
struct __user_cap_header_struct hdr;
/*
* Linux capability v1 fills an u32 struct.
* Linux capability v2 and v3 fills an u64 struct.
* We allocate data[2] for compatibility, we waste 4 bytes on v1.
*
* This is safe as we only need to check CAP_SETUID and CAP_SETGID
* that resides in the first 32-bit chunk.
*/
val = &data[0];
/*
* Ask the kernel the preferred capability version
* instead of using _LINUX_CAPABILITY_VERSION from header.
* This is safer when distributing a pre-compiled Unit binary.
*/
hdr.version = nxt_capability_linux_get_version();
hdr.pid = nxt_pid;
if (nxt_slow_path(nxt_capget(&hdr, val) == -1)) {
nxt_alert(task, "failed to get process capabilities: %E", nxt_errno);
return NXT_ERROR;
}
if ((val->effective & (1 << CAP_SYS_CHROOT)) != 0) {
cap->chroot = 1;
}
if ((val->effective & (1 << CAP_SETUID)) == 0) {
return NXT_OK;
}
if ((val->effective & (1 << CAP_SETGID)) == 0) {
return NXT_OK;
}
cap->setid = 1;
return NXT_OK;
}
#else
static nxt_int_t
nxt_capability_specific_set(nxt_task_t *task, nxt_capabilities_t *cap)
{
return NXT_OK;
}
#endif
|
