|
 |
d06f9c |
From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001
|
|
|
d06f9c |
From: Eric Garver <eric@garver.life>
|
|
|
d06f9c |
Date: Mon, 30 Aug 2021 13:24:47 -0400
|
|
|
d06f9c |
Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code
|
|
|
d06f9c |
|
|
|
d06f9c |
If dropping capabilities is blocked by SELinux, e.g. old selinux-policy,
|
|
|
d06f9c |
then capng_apply() will return non-zero. Also check other things that
|
|
|
d06f9c |
may fail, i.e. capng_update().
|
|
|
d06f9c |
|
|
|
d06f9c |
Fixes: rhbz 1999090
|
|
|
d06f9c |
(cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363)
|
|
|
d06f9c |
(cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57)
|
|
|
d06f9c |
---
|
|
|
d06f9c |
src/firewalld.in | 18 ++++++++++--------
|
|
|
d06f9c |
1 file changed, 10 insertions(+), 8 deletions(-)
|
|
|
d06f9c |
|
|
|
d06f9c |
diff --git a/src/firewalld.in b/src/firewalld.in
|
|
|
d06f9c |
index b1c886c6f02f..38331a0b49a9 100755
|
|
|
d06f9c |
--- a/src/firewalld.in
|
|
|
d06f9c |
+++ b/src/firewalld.in
|
|
|
d06f9c |
@@ -140,14 +140,16 @@ def startup(args):
|
|
|
d06f9c |
try:
|
|
|
d06f9c |
import capng
|
|
|
d06f9c |
capng.capng_clear(capng.CAPNG_SELECT_BOTH)
|
|
|
d06f9c |
- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
d06f9c |
- capng.CAP_NET_ADMIN)
|
|
|
d06f9c |
- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
d06f9c |
- capng.CAP_NET_RAW)
|
|
|
d06f9c |
- capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
d06f9c |
- capng.CAP_SYS_MODULE)
|
|
|
d06f9c |
- capng.capng_apply(capng.CAPNG_SELECT_BOTH)
|
|
|
d06f9c |
- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
|
|
|
d06f9c |
+ if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
d06f9c |
+ capng.CAP_NET_ADMIN) or \
|
|
|
d06f9c |
+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
d06f9c |
+ capng.CAP_NET_RAW) or \
|
|
|
d06f9c |
+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
d06f9c |
+ capng.CAP_SYS_MODULE) or \
|
|
|
d06f9c |
+ capng.capng_apply(capng.CAPNG_SELECT_BOTH):
|
|
|
d06f9c |
+ log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.")
|
|
|
d06f9c |
+ else:
|
|
|
d06f9c |
+ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
|
|
|
d06f9c |
except ImportError:
|
|
|
d06f9c |
pass
|
|
|
d06f9c |
|
|
|
d06f9c |
--
|
|
|
d06f9c |
2.31.1
|
|
|
d06f9c |
|