From 4a627847d36afedfca20026fb763fbb71005b92f Mon Sep 17 00:00:00 2001 From: Eric Garver Date: Mon, 30 Aug 2021 13:24:47 -0400 Subject: [PATCH 3/3] fix(firewalld): check capng_apply() return code If dropping capabilities is blocked by SELinux, e.g. old selinux-policy, then capng_apply() will return non-zero. Also check other things that may fail, i.e. capng_update(). Fixes: rhbz 1999090 (cherry picked from commit 36749f512bbcfc55f0e9e46354009073941d7363) (cherry picked from commit cf7f3320c78a8b3f2b8f22779c5747f113d25c57) --- src/firewalld.in | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/src/firewalld.in b/src/firewalld.in index b1c886c6f02f..38331a0b49a9 100755 --- a/src/firewalld.in +++ b/src/firewalld.in @@ -140,14 +140,16 @@ def startup(args): try: import capng capng.capng_clear(capng.CAPNG_SELECT_BOTH) - capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, - capng.CAP_NET_ADMIN) - capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, - capng.CAP_NET_RAW) - capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, - capng.CAP_SYS_MODULE) - capng.capng_apply(capng.CAPNG_SELECT_BOTH) - log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") + if capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, + capng.CAP_NET_ADMIN) or \ + capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, + capng.CAP_NET_RAW) or \ + capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET, + capng.CAP_SYS_MODULE) or \ + capng.capng_apply(capng.CAPNG_SELECT_BOTH): + log.info(log.INFO1, "libcap-ng failed to drop Linux capabilities.") + else: + log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.") except ImportError: pass -- 2.31.1