ForkMaster/zapret
1
0
Fork 0
mirror of https://github.com/bol-van/zapret.git synced 2025-03-21 14:07:56 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

nfqws,tpws: separate droproot from dropcaps

Browse Source
This commit is contained in:
bol-van 2025-03-13 21:54:28 +03:00
parent 2db1ebafe3
commit bd8decddc5
5 changed files with 8 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
docs/changes.txt
View File

@ -464,3 +464,4 @@ v70.4
nfqws,tpws: ^ prefix in hostlist to disable subdomain matches nfqws,tpws: ^ prefix in hostlist to disable subdomain matches
nfqws,tpws: optional systemd notify support. compile using 'make systemd' nfqws,tpws: optional systemd notify support. compile using 'make systemd'
nfqws,tpws: systemd instance templates for nfqws and tpws nfqws,tpws: systemd instance templates for nfqws and tpws
nfqws,tpws: separate droproot from dropcaps

2
nfq/nfqws.c
View File

@ -293,7 +293,7 @@ static int nfq_main(void)
ssize_t rd; ssize_t rd;
sec_harden(); sec_harden();
if (params.droproot && !droproot(params.uid, params.gid)) if (params.droproot && !droproot(params.uid, params.gid) || !dropcaps())
return 1; return 1;
print_id(); print_id();
if (params.droproot && !test_list_files()) if (params.droproot && !test_list_files())

6
nfq/sec.c
View File

@ -287,7 +287,7 @@ bool can_drop_root(void)
{ {
#ifdef __linux__ #ifdef __linux__
// has some caps // has some caps
return checkpcap((1<<CAP_SETUID)|(1<<CAP_SETGID)|(1<<CAP_SETPCAP)); return checkpcap((1<<CAP_SETUID)|(1<<CAP_SETGID));
#else #else
// effective root // effective root
return !geteuid(); return !geteuid();
@ -319,11 +319,7 @@ bool droproot(uid_t uid, gid_t gid)
DLOG_PERROR("setuid"); DLOG_PERROR("setuid");
return false; return false;
} }
#ifdef __linux__
return dropcaps();
#else
return true; return true;
#endif
} }
void print_id(void) void print_id(void)

6
tpws/sec.c
View File

@ -263,7 +263,7 @@ bool can_drop_root(void)
{ {
#ifdef __linux__ #ifdef __linux__
// has some caps // has some caps
return checkpcap((1<<CAP_SETUID)|(1<<CAP_SETGID)|(1<<CAP_SETPCAP)); return checkpcap((1<<CAP_SETUID)|(1<<CAP_SETGID));
#else #else
// effective root // effective root
return !geteuid(); return !geteuid();
@ -295,11 +295,7 @@ bool droproot(uid_t uid, gid_t gid)
DLOG_PERROR("setuid"); DLOG_PERROR("setuid");
return false; return false;
} }
#ifdef __linux__
return dropcaps();
#else
return true; return true;
#endif
} }
void print_id(void) void print_id(void)

4
tpws/tpws.c
View File

@ -1947,6 +1947,10 @@ int main(int argc, char *argv[])
sec_harden(); sec_harden();
if (params.droproot && !droproot(params.uid,params.gid)) if (params.droproot && !droproot(params.uid,params.gid))
goto exiterr; goto exiterr;
#ifdef __linux__
if (!dropcaps())
goto exiterr;
#endif
print_id(); print_id();
if (params.droproot && !test_list_files()) if (params.droproot && !test_list_files())
goto exiterr; goto exiterr;