dhcp-capabilities.patch

   1 From 7ea2433d716172f160c9380ed0bb852fafe845a2 Mon Sep 17 00:00:00 2001
   2 From: Pavel Zhukov <pzhukov@redhat.com>
   3 Date: Thu, 21 Feb 2019 10:30:28 +0100
   4 Subject: [PATCH 11/28] Drop unnecessary capabilities
   5
   6 dhclient (#517649, #546765), dhcpd/dhcrelay (#699713)
   7 ---
   8  client/Makefile.am       |  3 ++-
   9  client/dhclient-script.8 | 10 ++++++++++
  10  client/dhclient.8        | 29 +++++++++++++++++++++++++++++
  11  client/dhclient.c        | 24 ++++++++++++++++++++++++
  12  configure.ac             | 35 +++++++++++++++++++++++++++++++++++
  13  relay/Makefile.am        |  3 ++-
  14  relay/dhcrelay.c         | 29 +++++++++++++++++++++++++++++
  15  7 files changed, 131 insertions(+), 2 deletions(-)
  16
  17 diff -urNp -x '*.orig' dhcp-4.4.3.org/client/Makefile.am dhcp-4.4.3/client/Makefile.am
  18 --- dhcp-4.4.3.org/client/Makefile.am   2022-03-08 09:26:03.000000000 +0000
  19 +++ dhcp-4.4.3/client/Makefile.am       2022-04-03 17:02:38.643517435 +0000
  20 @@ -17,6 +17,7 @@ dhclient_LDADD = ../common/libdhcp.@A@ .
  21                  @BINDLIBIRSDIR@/libirs.@A@ \
  22                  @BINDLIBDNSDIR@/libdns.@A@ \
  23                  @BINDLIBISCCFGDIR@/libisccfg.@A@ \
  24 -                @BINDLIBISCDIR@/libisc.@A@
  25 +                @BINDLIBISCDIR@/libisc.@A@ \
  26 +                $(CAPNG_LDADD)
  27  man_MANS = dhclient.8 dhclient-script.8 dhclient.conf.5 dhclient.leases.5
  28  EXTRA_DIST = $(man_MANS)
  29 diff -urNp -x '*.orig' dhcp-4.4.3.org/client/dhclient-script.8 dhcp-4.4.3/client/dhclient-script.8
  30 --- dhcp-4.4.3.org/client/dhclient-script.8     2022-04-03 17:02:38.454517007 +0000
  31 +++ dhcp-4.4.3/client/dhclient-script.8 2022-04-03 17:02:38.643517435 +0000
  32 @@ -249,6 +249,16 @@ repeatedly initialized to the values pro
  33  the other.   Assuming the information provided by both servers is
  34  valid, this shouldn't cause any real problems, but it could be
  35  confusing.
  36 +.PP
  37 +Normally, if dhclient was compiled with libcap-ng support,
  38 +dhclient drops most capabilities immediately upon startup.
  39 +While more secure, this greatly restricts the additional actions that
  40 +hooks in dhclient-script can take. For example, any daemons that
  41 +dhclient-script starts or restarts will inherit the restricted
  42 +capabilities as well, which may interfere with their correct operation.
  43 +Thus, the
  44 +.BI \-nc
  45 +option can be used to prevent dhclient from dropping capabilities.
  46  .SH SEE ALSO
  47  dhclient(8), dhcpd(8), dhcrelay(8), dhclient.conf(5) and
  48  dhclient.leases(5).
  49 diff -urNp -x '*.orig' dhcp-4.4.3.org/client/dhclient.8 dhcp-4.4.3/client/dhclient.8
  50 --- dhcp-4.4.3.org/client/dhclient.8    2022-04-03 17:02:38.455517009 +0000
  51 +++ dhcp-4.4.3/client/dhclient.8        2022-04-03 17:02:38.643517435 +0000
  52 @@ -135,6 +135,9 @@ dhclient - Dynamic Host Configuration Pr
  53  .B -w
  54  ]
  55  [
  56 +.B -nc
  57 +]
  58 +[
  59  .B -B
  60  ]
  61  [
  62 @@ -330,6 +333,32 @@ program can then be used to notify the c
  63  has been added or removed, so that the client can attempt to configure an IP
  64  address on that interface.
  65  .TP
  66 +.BI \-nc
  67 +Do not drop capabilities.
  68 +
  69 +Normally, if
  70 +.B dhclient
  71 +was compiled with libcap-ng support,
  72 +.B dhclient
  73 +drops most capabilities immediately upon startup.  While more secure,
  74 +this greatly restricts the additional actions that hooks in
  75 +.B dhclient-script (8)
  76 +can take.  (For example, any daemons that
  77 +.B dhclient-script (8)
  78 +starts or restarts will inherit the restricted capabilities as well,
  79 +which may interfere with their correct operation.)  Thus, the
  80 +.BI \-nc
  81 +option can be used to prevent
  82 +.B dhclient
  83 +from dropping capabilities.
  84 +
  85 +The
  86 +.BI \-nc
  87 +option is ignored if
  88 +.B dhclient
  89 +was not compiled with libcap-ng support.
  90 +
  91 +.TP
  92  .BI \-n
  93  Do not configure any interfaces.  This is most likely to be useful in
  94  combination with the
  95 diff -urNp -x '*.orig' dhcp-4.4.3.org/client/dhclient.c dhcp-4.4.3/client/dhclient.c
  96 --- dhcp-4.4.3.org/client/dhclient.c    2022-04-03 17:02:38.461517023 +0000
  97 +++ dhcp-4.4.3/client/dhclient.c        2022-04-03 17:02:38.644517437 +0000
  98 @@ -41,6 +41,10 @@
  99  #include <sys/wait.h>
 100  #include <limits.h>
 101
 102 +#ifdef HAVE_LIBCAP_NG
 103 +#include <cap-ng.h>
 104 +#endif
 105 +
 106  /*
 107   * Defined in stdio.h when _GNU_SOURCE is set, but we don't want to define
 108   * that when building ISC code.
 109 @@ -269,6 +273,9 @@ main(int argc, char **argv) {
 110         int timeout_arg = 0;
 111         char *arg_conf = NULL;
 112         int arg_conf_len = 0;
 113 +#ifdef HAVE_LIBCAP_NG
 114 +       int keep_capabilities = 0;
 115 +#endif
 116
 117         /* Initialize client globals. */
 118         memset(&default_duid, 0, sizeof(default_duid));
 119 @@ -668,6 +675,10 @@ main(int argc, char **argv) {
 120
 121                         dhclient_request_options = argv[i];
 122
 123 +               } else if (!strcmp(argv[i], "-nc")) {
 124 +#ifdef HAVE_LIBCAP_NG
 125 +                  keep_capabilities = 1;
 126 +#endif
 127                 } else if (argv[i][0] == '-') {
 128                         usage("Unknown command: %s", argv[i]);
 129                 } else if (interfaces_requested < 0) {
 130 @@ -728,6 +739,19 @@ main(int argc, char **argv) {
 131                 path_dhclient_script = s;
 132         }
 133
 134 +#ifdef HAVE_LIBCAP_NG
 135 +       /* Drop capabilities */
 136 +       if (!keep_capabilities) {
 137 +               capng_clear(CAPNG_SELECT_CAPS);
 138 +               capng_update(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
 139 +                               CAP_DAC_OVERRIDE); // Drop this someday
 140 +               capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
 141 +                               CAP_NET_ADMIN, CAP_NET_RAW,
 142 +                               CAP_NET_BIND_SERVICE, CAP_SYS_ADMIN, -1);
 143 +               capng_apply(CAPNG_SELECT_CAPS);
 144 +       }
 145 +#endif
 146 +
 147         /* Set up the initial dhcp option universe. */
 148         initialize_common_option_spaces();
 149
 150 diff -urNp -x '*.orig' dhcp-4.4.3.org/configure.ac dhcp-4.4.3/configure.ac
 151 --- dhcp-4.4.3.org/configure.ac 2022-04-03 17:02:38.459517018 +0000
 152 +++ dhcp-4.4.3/configure.ac     2022-04-03 17:02:38.644517437 +0000
 153 @@ -603,6 +603,41 @@ AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]],
 154  # Look for optional headers.
 155  AC_CHECK_HEADERS(sys/socket.h net/if_dl.h net/if6.h regex.h)
 156
 157 +# look for capabilities library
 158 +AC_ARG_WITH(libcap-ng,
 159 +    [  --with-libcap-ng=[auto/yes/no]  Add Libcap-ng support [default=auto]],,
 160 +    with_libcap_ng=auto)
 161 +
 162 +# Check for Libcap-ng API
 163 +#
 164 +# libcap-ng detection
 165 +if test x$with_libcap_ng = xno ; then
 166 +    have_libcap_ng=no;
 167 +else
 168 +    # Start by checking for header file
 169 +    AC_CHECK_HEADER(cap-ng.h, capng_headers=yes, capng_headers=no)
 170 +
 171 +    # See if we have libcap-ng library
 172 +    AC_CHECK_LIB(cap-ng, capng_clear,
 173 +                 CAPNG_LDADD=-lcap-ng,)
 174 +
 175 +    # Check results are usable
 176 +    if test x$with_libcap_ng = xyes -a x$CAPNG_LDADD = x ; then
 177 +       AC_MSG_ERROR(libcap-ng support was requested and the library was not found)
 178 +    fi
 179 +    if test x$CAPNG_LDADD != x -a $capng_headers = no ; then
 180 +       AC_MSG_ERROR(libcap-ng libraries found but headers are missing)
 181 +    fi
 182 +fi
 183 +AC_SUBST(CAPNG_LDADD)
 184 +AC_MSG_CHECKING(whether to use libcap-ng)
 185 +if test x$CAPNG_LDADD != x ; then
 186 +    AC_DEFINE(HAVE_LIBCAP_NG,1,[libcap-ng support])
 187 +    AC_MSG_RESULT(yes)
 188 +else
 189 +    AC_MSG_RESULT(no)
 190 +fi
 191 +
 192  # Solaris needs some libraries for functions
 193  AC_SEARCH_LIBS(socket, [socket])
 194  AC_SEARCH_LIBS(inet_ntoa, [nsl])
 195 diff -urNp -x '*.orig' dhcp-4.4.3.org/relay/Makefile.am dhcp-4.4.3/relay/Makefile.am
 196 --- dhcp-4.4.3.org/relay/Makefile.am    2022-03-08 09:26:03.000000000 +0000
 197 +++ dhcp-4.4.3/relay/Makefile.am        2022-04-03 17:02:38.644517437 +0000
 198 @@ -8,6 +8,7 @@ dhcrelay_LDADD = ../common/libdhcp.@A@ .
 199                  @BINDLIBIRSDIR@/libirs.@A@ \
 200                  @BINDLIBDNSDIR@/libdns.@A@ \
 201                  @BINDLIBISCCFGDIR@/libisccfg.@A@ \
 202 -                @BINDLIBISCDIR@/libisc.@A@
 203 +                @BINDLIBISCDIR@/libisc.@A@ \
 204 +                $(CAPNG_LDADD)
 205  man_MANS = dhcrelay.8
 206  EXTRA_DIST = $(man_MANS)
 207 diff -urNp -x '*.orig' dhcp-4.4.3.org/relay/dhcrelay.c dhcp-4.4.3/relay/dhcrelay.c
 208 --- dhcp-4.4.3.org/relay/dhcrelay.c     2022-04-03 17:02:38.462517025 +0000
 209 +++ dhcp-4.4.3/relay/dhcrelay.c 2022-04-03 17:02:38.645517439 +0000
 210 @@ -36,6 +36,11 @@
 211  #include <systemd/sd-daemon.h>
 212  #endif
 213
 214 +#ifdef HAVE_LIBCAP_NG
 215 +#  include <cap-ng.h>
 216 +   int keep_capabilities = 0;
 217 +#endif
 218 +
 219  TIME default_lease_time = 43200; /* 12 hours... */
 220  TIME max_lease_time = 86400; /* 24 hours... */
 221  struct tree_cache *global_options[256];
 222 @@ -616,6 +621,10 @@ main(int argc, char **argv) {
 223                                 usage(use_noarg, argv[i-1]);
 224                         dhcrelay_sub_id = argv[i];
 225  #endif
 226 +               } else if (!strcmp(argv[i], "-nc")) {
 227 +#ifdef HAVE_LIBCAP_NG
 228 +                       keep_capabilities = 1;
 229 +#endif
 230                 } else if (!strcmp(argv[i], "-pf")) {
 231                         if (++i == argc)
 232                                 usage(use_noarg, argv[i-1]);
 233 @@ -685,6 +694,17 @@ main(int argc, char **argv) {
 234  #endif
 235         }
 236
 237 +#ifdef HAVE_LIBCAP_NG
 238 +       /* Drop capabilities */
 239 +       if (!keep_capabilities) {
 240 +               capng_clear(CAPNG_SELECT_BOTH);
 241 +               capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
 242 +                               CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1);
 243 +               capng_apply(CAPNG_SELECT_BOTH);
 244 +               log_info ("Dropped all unnecessary capabilities.");
 245 +       }
 246 +#endif
 247 +
 248         if (!quiet) {
 249                 log_info("%s %s", message, PACKAGE_VERSION);
 250                 log_info(copyright);
 251 @@ -849,6 +869,15 @@ main(int argc, char **argv) {
 252                     (unsigned long) getpid());
 253  #endif
 254
 255 +#ifdef HAVE_LIBCAP_NG
 256 +       /* Drop all capabilities */
 257 +       if (!keep_capabilities) {
 258 +               capng_clear(CAPNG_SELECT_BOTH);
 259 +               capng_apply(CAPNG_SELECT_BOTH);
 260 +               log_info ("Dropped all capabilities.");
 261 +       }
 262 +#endif
 263 +
 264         /* Start dispatching packets and timeouts... */
 265         dispatch();
 266