* [Virtio-fs] [PATCH 0/2] Convert to cap-ng @ 2019-12-03 13:14 Dr. David Alan Gilbert (git) 2019-12-03 13:14 ` [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers Dr. David Alan Gilbert (git) ` (2 more replies) 0 siblings, 3 replies; 7+ messages in thread From: Dr. David Alan Gilbert (git) @ 2019-12-03 13:14 UTC (permalink / raw) To: virtio-fs, vgoyal From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> Hi, This changes virtiofsd to use cap-ng rather than cap (qemu is moving in that direction). It's a little painful because of an interaction with our sandboxing. I intend to flatten the conversion into Vivek's patch that adds the libcap use. Dave Dr. David Alan Gilbert (2): virtiofsd: cap-ng helpers virtiofsd: Convert to libcap-ng Makefile | 2 +- contrib/virtiofsd/Makefile.objs | 2 - contrib/virtiofsd/passthrough_ll.c | 162 +++++++++++++++++++---------- 3 files changed, 106 insertions(+), 60 deletions(-) -- 2.23.0 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers 2019-12-03 13:14 [Virtio-fs] [PATCH 0/2] Convert to cap-ng Dr. David Alan Gilbert (git) @ 2019-12-03 13:14 ` Dr. David Alan Gilbert (git) 2019-12-04 7:20 ` misono.tomohiro 2019-12-03 13:14 ` [Virtio-fs] [PATCH 2/2] virtiofsd: Convert to libcap-ng Dr. David Alan Gilbert (git) 2019-12-03 14:17 ` [Virtio-fs] [PATCH 0/2] Convert to cap-ng Vivek Goyal 2 siblings, 1 reply; 7+ messages in thread From: Dr. David Alan Gilbert (git) @ 2019-12-03 13:14 UTC (permalink / raw) To: virtio-fs, vgoyal From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's sandboxing doesn't have /proc mounted; thus we have to do the caps read before we sandbox it and save/restore the state. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> --- Makefile | 2 +- contrib/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++ 2 files changed, 73 insertions(+), 1 deletion(-) diff --git a/Makefile b/Makefile index 237cbdfee1..1484c23a9b 100644 --- a/Makefile +++ b/Makefile @@ -323,7 +323,7 @@ HELPERS-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_LINUX)) = qemu-bridge-helper$(EXE ifdef CONFIG_LINUX ifdef CONFIG_SECCOMP -ifdef CONFIG_LIBCAP +ifdef CONFIG_LIBCAP_NG HELPERS-y += virtiofsd$(EXESUF) vhost-user-json-y += contrib/virtiofsd/50-qemu-virtiofsd.json endif diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c index 1688071c10..139261efc1 100644 --- a/contrib/virtiofsd/passthrough_ll.c +++ b/contrib/virtiofsd/passthrough_ll.c @@ -47,6 +47,7 @@ #include <string.h> #include <syslog.h> #include <limits.h> +#include <cap-ng.h> #include <dirent.h> #include <assert.h> #include <errno.h> @@ -216,6 +217,13 @@ static const struct fuse_opt lo_opts[] = { }; static bool use_syslog = false; static int current_log_level; +static struct { + pthread_mutex_t mutex; + void *saved; +} cap; +/* That we loaded cap-ng in the current thread from the saved */ +static __thread bool cap_loaded = 0; + static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode, uint64_t n); static void put_shared(struct lo_data *lo, struct lo_inode *inode); @@ -242,6 +250,37 @@ static struct lo_data *lo_data(fuse_req_t req) return (struct lo_data *) fuse_req_userdata(req); } +/* + * Load capng's state from our saved state if the current thread + * hadn't previously been loaded. + * returns 0 on success + */ +static int load_capng(void) +{ + if (!cap_loaded) { + pthread_mutex_lock(&cap.mutex); + capng_restore_state(&cap.saved); + /* + * restore_state free's the saved copy + * so make another. + */ + cap.saved = capng_save_state(); + if (!cap.saved) { + fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n"); + return -EINVAL; + } + pthread_mutex_unlock(&cap.mutex); + + /* + * We want to use the loaded state for our pid, + * not the original + */ + capng_setpid(gettid()); + cap_loaded = true; + } + return 0; +} + /* Helpers for dropping and regaining effective capabilities. Returns 0 * on success, error otherwise */ static int drop_effective_cap(const char *cap_name, bool *cap_dropped) @@ -2754,6 +2793,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se) } } +/* + * Capture the capability state, we'll need to restore this for individual + * threads later; see load_capng. + */ +static void setup_capng(void) +{ + /* Note this accesses /proc so has to happen before the sandbox */ + if (capng_get_caps_process()) { + fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n"); + exit(1); + } + pthread_mutex_init(&cap.mutex, NULL); + pthread_mutex_lock(&cap.mutex); + cap.saved = capng_save_state(); + if (!cap.saved) { + fuse_log(FUSE_LOG_ERR, "capng_save_state\n"); + exit(1); + } + pthread_mutex_unlock(&cap.mutex); +} + +static void cleanup_capng(void) +{ + free(cap.saved); + cap.saved = NULL; + pthread_mutex_destroy(&cap.mutex); +} + + /* * Make the source directory our root so symlinks cannot escape and no other * files are accessible. Assumes unshare(CLONE_NEWNS) was already called. @@ -3173,6 +3241,9 @@ int main(int argc, char *argv[]) setup_nofile_rlimit(); + /* Must be before sandbox since it wants /proc */ + setup_capng(); + setup_sandbox(&lo, se, opts.syslog); setup_root(&lo, &lo.root); @@ -3195,6 +3266,7 @@ int main(int argc, char *argv[]) err_out4: fuse_session_unmount(se); + cleanup_capng(); err_out3: fuse_remove_signal_handlers(se); err_out2: -- 2.23.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers 2019-12-03 13:14 ` [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers Dr. David Alan Gilbert (git) @ 2019-12-04 7:20 ` misono.tomohiro 2019-12-04 9:11 ` Dr. David Alan Gilbert 0 siblings, 1 reply; 7+ messages in thread From: misono.tomohiro @ 2019-12-04 7:20 UTC (permalink / raw) To: 'Dr. David Alan Gilbert (git)', virtio-fs, vgoyal > -----Original Message----- > From: virtio-fs-bounces@redhat.com [mailto:virtio-fs-bounces@redhat.com] On Behalf Of Dr. David Alan Gilbert (git) > Sent: Tuesday, December 3, 2019 10:14 PM > To: virtio-fs@redhat.com; vgoyal@redhat.com > Subject: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers > > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> > > libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's > sandboxing doesn't have /proc mounted; thus we have to do the > caps read before we sandbox it and save/restore the state. > > Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> > --- > Makefile | 2 +- > contrib/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++ > 2 files changed, 73 insertions(+), 1 deletion(-) > > diff --git a/Makefile b/Makefile > index 237cbdfee1..1484c23a9b 100644 > --- a/Makefile > +++ b/Makefile > @@ -323,7 +323,7 @@ HELPERS-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_LINUX)) = qemu-bridge-helper$(EXE > > ifdef CONFIG_LINUX > ifdef CONFIG_SECCOMP > -ifdef CONFIG_LIBCAP > +ifdef CONFIG_LIBCAP_NG > HELPERS-y += virtiofsd$(EXESUF) > vhost-user-json-y += contrib/virtiofsd/50-qemu-virtiofsd.json > endif > diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c > index 1688071c10..139261efc1 100644 > --- a/contrib/virtiofsd/passthrough_ll.c > +++ b/contrib/virtiofsd/passthrough_ll.c > @@ -47,6 +47,7 @@ > #include <string.h> > #include <syslog.h> > #include <limits.h> > +#include <cap-ng.h> > #include <dirent.h> > #include <assert.h> > #include <errno.h> > @@ -216,6 +217,13 @@ static const struct fuse_opt lo_opts[] = { > }; > static bool use_syslog = false; > static int current_log_level; > +static struct { > + pthread_mutex_t mutex; > + void *saved; > +} cap; > +/* That we loaded cap-ng in the current thread from the saved */ > +static __thread bool cap_loaded = 0; > + > static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode, uint64_t n); > static void put_shared(struct lo_data *lo, struct lo_inode *inode); > > @@ -242,6 +250,37 @@ static struct lo_data *lo_data(fuse_req_t req) > return (struct lo_data *) fuse_req_userdata(req); > } > > +/* > + * Load capng's state from our saved state if the current thread > + * hadn't previously been loaded. > + * returns 0 on success > + */ > +static int load_capng(void) > +{ > + if (!cap_loaded) { > + pthread_mutex_lock(&cap.mutex); > + capng_restore_state(&cap.saved); > + /* > + * restore_state free's the saved copy > + * so make another. > + */ > + cap.saved = capng_save_state(); > + if (!cap.saved) { > + fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n"); > + return -EINVAL; > + } > + pthread_mutex_unlock(&cap.mutex); > + > + /* > + * We want to use the loaded state for our pid, > + * not the original > + */ > + capng_setpid(gettid()); Hi, I got build error on Fedora 30 with glibc 2.29 since gettid() wrapper is introduced in glibc 2.30. How about using syscall(__NR_gettid) directly? Or is 2.30 required? Thanks, Misono > + cap_loaded = true; > + } > + return 0; > +} > + > /* Helpers for dropping and regaining effective capabilities. Returns 0 > * on success, error otherwise */ > static int drop_effective_cap(const char *cap_name, bool *cap_dropped) > @@ -2754,6 +2793,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se) > } > } > > +/* > + * Capture the capability state, we'll need to restore this for individual > + * threads later; see load_capng. > + */ > +static void setup_capng(void) > +{ > + /* Note this accesses /proc so has to happen before the sandbox */ > + if (capng_get_caps_process()) { > + fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n"); > + exit(1); > + } > + pthread_mutex_init(&cap.mutex, NULL); > + pthread_mutex_lock(&cap.mutex); > + cap.saved = capng_save_state(); > + if (!cap.saved) { > + fuse_log(FUSE_LOG_ERR, "capng_save_state\n"); > + exit(1); > + } > + pthread_mutex_unlock(&cap.mutex); > +} > + > +static void cleanup_capng(void) > +{ > + free(cap.saved); > + cap.saved = NULL; > + pthread_mutex_destroy(&cap.mutex); > +} > + > + > /* > * Make the source directory our root so symlinks cannot escape and no other > * files are accessible. Assumes unshare(CLONE_NEWNS) was already called. > @@ -3173,6 +3241,9 @@ int main(int argc, char *argv[]) > > setup_nofile_rlimit(); > > + /* Must be before sandbox since it wants /proc */ > + setup_capng(); > + > setup_sandbox(&lo, se, opts.syslog); > > setup_root(&lo, &lo.root); > @@ -3195,6 +3266,7 @@ int main(int argc, char *argv[]) > > err_out4: > fuse_session_unmount(se); > + cleanup_capng(); > err_out3: > fuse_remove_signal_handlers(se); > err_out2: > -- > 2.23.0 > > _______________________________________________ > Virtio-fs mailing list > Virtio-fs@redhat.com > https://www.redhat.com/mailman/listinfo/virtio-fs ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers 2019-12-04 7:20 ` misono.tomohiro @ 2019-12-04 9:11 ` Dr. David Alan Gilbert 0 siblings, 0 replies; 7+ messages in thread From: Dr. David Alan Gilbert @ 2019-12-04 9:11 UTC (permalink / raw) To: misono.tomohiro; +Cc: virtio-fs, vgoyal * misono.tomohiro@fujitsu.com (misono.tomohiro@fujitsu.com) wrote: > > -----Original Message----- > > From: virtio-fs-bounces@redhat.com [mailto:virtio-fs-bounces@redhat.com] On Behalf Of Dr. David Alan Gilbert (git) > > Sent: Tuesday, December 3, 2019 10:14 PM > > To: virtio-fs@redhat.com; vgoyal@redhat.com > > Subject: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers > > > > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> > > > > libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's > > sandboxing doesn't have /proc mounted; thus we have to do the > > caps read before we sandbox it and save/restore the state. > > > > Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> > > --- > > Makefile | 2 +- > > contrib/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++ > > 2 files changed, 73 insertions(+), 1 deletion(-) > > > > diff --git a/Makefile b/Makefile > > index 237cbdfee1..1484c23a9b 100644 > > --- a/Makefile > > +++ b/Makefile > > @@ -323,7 +323,7 @@ HELPERS-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_LINUX)) = qemu-bridge-helper$(EXE > > > > ifdef CONFIG_LINUX > > ifdef CONFIG_SECCOMP > > -ifdef CONFIG_LIBCAP > > +ifdef CONFIG_LIBCAP_NG > > HELPERS-y += virtiofsd$(EXESUF) > > vhost-user-json-y += contrib/virtiofsd/50-qemu-virtiofsd.json > > endif > > diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c > > index 1688071c10..139261efc1 100644 > > --- a/contrib/virtiofsd/passthrough_ll.c > > +++ b/contrib/virtiofsd/passthrough_ll.c > > @@ -47,6 +47,7 @@ > > #include <string.h> > > #include <syslog.h> > > #include <limits.h> > > +#include <cap-ng.h> > > #include <dirent.h> > > #include <assert.h> > > #include <errno.h> > > @@ -216,6 +217,13 @@ static const struct fuse_opt lo_opts[] = { > > }; > > static bool use_syslog = false; > > static int current_log_level; > > +static struct { > > + pthread_mutex_t mutex; > > + void *saved; > > +} cap; > > +/* That we loaded cap-ng in the current thread from the saved */ > > +static __thread bool cap_loaded = 0; > > + > > static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode, uint64_t n); > > static void put_shared(struct lo_data *lo, struct lo_inode *inode); > > > > @@ -242,6 +250,37 @@ static struct lo_data *lo_data(fuse_req_t req) > > return (struct lo_data *) fuse_req_userdata(req); > > } > > > > +/* > > + * Load capng's state from our saved state if the current thread > > + * hadn't previously been loaded. > > + * returns 0 on success > > + */ > > +static int load_capng(void) > > +{ > > + if (!cap_loaded) { > > + pthread_mutex_lock(&cap.mutex); > > + capng_restore_state(&cap.saved); > > + /* > > + * restore_state free's the saved copy > > + * so make another. > > + */ > > + cap.saved = capng_save_state(); > > + if (!cap.saved) { > > + fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n"); > > + return -EINVAL; > > + } > > + pthread_mutex_unlock(&cap.mutex); > > + > > + /* > > + * We want to use the loaded state for our pid, > > + * not the original > > + */ > > + capng_setpid(gettid()); > > Hi, > > I got build error on Fedora 30 with glibc 2.29 since gettid() wrapper is introduced in glibc 2.30. > How about using syscall(__NR_gettid) directly? Or is 2.30 required? Thanks for reporting, I'm on Fedora 31 so didn't notice. I'll change it to syscall(__NR_gettid). Dave > Thanks, > Misono > > > + cap_loaded = true; > > + } > > + return 0; > > +} > > + > > /* Helpers for dropping and regaining effective capabilities. Returns 0 > > * on success, error otherwise */ > > static int drop_effective_cap(const char *cap_name, bool *cap_dropped) > > @@ -2754,6 +2793,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se) > > } > > } > > > > +/* > > + * Capture the capability state, we'll need to restore this for individual > > + * threads later; see load_capng. > > + */ > > +static void setup_capng(void) > > +{ > > + /* Note this accesses /proc so has to happen before the sandbox */ > > + if (capng_get_caps_process()) { > > + fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n"); > > + exit(1); > > + } > > + pthread_mutex_init(&cap.mutex, NULL); > > + pthread_mutex_lock(&cap.mutex); > > + cap.saved = capng_save_state(); > > + if (!cap.saved) { > > + fuse_log(FUSE_LOG_ERR, "capng_save_state\n"); > > + exit(1); > > + } > > + pthread_mutex_unlock(&cap.mutex); > > +} > > + > > +static void cleanup_capng(void) > > +{ > > + free(cap.saved); > > + cap.saved = NULL; > > + pthread_mutex_destroy(&cap.mutex); > > +} > > + > > + > > /* > > * Make the source directory our root so symlinks cannot escape and no other > > * files are accessible. Assumes unshare(CLONE_NEWNS) was already called. > > @@ -3173,6 +3241,9 @@ int main(int argc, char *argv[]) > > > > setup_nofile_rlimit(); > > > > + /* Must be before sandbox since it wants /proc */ > > + setup_capng(); > > + > > setup_sandbox(&lo, se, opts.syslog); > > > > setup_root(&lo, &lo.root); > > @@ -3195,6 +3266,7 @@ int main(int argc, char *argv[]) > > > > err_out4: > > fuse_session_unmount(se); > > + cleanup_capng(); > > err_out3: > > fuse_remove_signal_handlers(se); > > err_out2: > > -- > > 2.23.0 > > > > _______________________________________________ > > Virtio-fs mailing list > > Virtio-fs@redhat.com > > https://www.redhat.com/mailman/listinfo/virtio-fs > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK ^ permalink raw reply [flat|nested] 7+ messages in thread
* [Virtio-fs] [PATCH 2/2] virtiofsd: Convert to libcap-ng 2019-12-03 13:14 [Virtio-fs] [PATCH 0/2] Convert to cap-ng Dr. David Alan Gilbert (git) 2019-12-03 13:14 ` [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers Dr. David Alan Gilbert (git) @ 2019-12-03 13:14 ` Dr. David Alan Gilbert (git) 2019-12-03 14:17 ` [Virtio-fs] [PATCH 0/2] Convert to cap-ng Vivek Goyal 2 siblings, 0 replies; 7+ messages in thread From: Dr. David Alan Gilbert (git) @ 2019-12-03 13:14 UTC (permalink / raw) To: virtio-fs, vgoyal From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> QEMU is moving to libcap-ng, so lets move as well. Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> --- contrib/virtiofsd/Makefile.objs | 2 - contrib/virtiofsd/passthrough_ll.c | 90 +++++++++++------------------- 2 files changed, 33 insertions(+), 59 deletions(-) diff --git a/contrib/virtiofsd/Makefile.objs b/contrib/virtiofsd/Makefile.objs index 25f1e8dd73..941b19f18e 100644 --- a/contrib/virtiofsd/Makefile.objs +++ b/contrib/virtiofsd/Makefile.objs @@ -11,5 +11,3 @@ virtiofsd-obj-y = buffer.o \ seccomp.o-cflags := $(SECCOMP_CFLAGS) seccomp.o-libs := $(SECCOMP_LIBS) - -passthrough_ll.o-libs += -lcap diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c index 139261efc1..a081a91b85 100644 --- a/contrib/virtiofsd/passthrough_ll.c +++ b/contrib/virtiofsd/passthrough_ll.c @@ -59,7 +59,6 @@ #include <sys/prctl.h> #include <sys/syscall.h> #include <sys/xattr.h> -#include <sys/capability.h> #include <sys/mount.h> #include <sys/mman.h> #include <sys/resource.h> @@ -285,107 +284,82 @@ static int load_capng(void) * on success, error otherwise */ static int drop_effective_cap(const char *cap_name, bool *cap_dropped) { - cap_t caps; - cap_value_t cap; - cap_flag_value_t cap_value; - int ret = 0; + int cap, ret; - ret = cap_from_name(cap_name, &cap); - if (ret == -1) { + cap = capng_name_to_capability(cap_name); + if (cap < 0) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n", cap_name, + fuse_log(FUSE_LOG_ERR, + "capng_name_to_capability(%s) failed:%s\n", cap_name, strerror(errno)); goto out; } - if (!CAP_IS_SUPPORTED(cap)) { - fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n", cap_name); - return EINVAL; - } - - caps = cap_get_proc(); - if (caps == NULL) { + if (load_capng()) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n"); + fuse_log(FUSE_LOG_ERR, "load_capng() failed\n"); goto out; } - if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &cap_value) == -1) { - ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_get_flag() failed\n"); - goto out_cap_free; - } - /* We dont have this capability in effective set already. */ - if (cap_value == CAP_CLEAR) { + if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) { ret = 0; - goto out_cap_free; + goto out; } - if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_CLEAR) == -1) { + if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n"); - goto out_cap_free; + fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n"); + goto out; } - if (cap_set_proc(caps) == -1) { + if (capng_apply(CAPNG_SELECT_CAPS)) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n"); - goto out_cap_free; + fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n"); + goto out; } ret = 0; if (cap_dropped) *cap_dropped = true; -out_cap_free: - cap_free(caps); out: return ret; } static int gain_effective_cap(const char *cap_name) { - cap_t caps; - cap_value_t cap; + int cap; int ret = 0; - ret = cap_from_name(cap_name, &cap); - if (ret == -1) { + cap = capng_name_to_capability(cap_name); + if (cap < 0) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n", cap_name, + fuse_log(FUSE_LOG_ERR, + "capng_name_to_capability(%s) failed:%s\n", cap_name, strerror(errno)); goto out; } - if (!CAP_IS_SUPPORTED(cap)) { - fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n", cap_name); - return EINVAL; - } - - caps = cap_get_proc(); - if (caps == NULL) { + if (load_capng()) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n"); + fuse_log(FUSE_LOG_ERR, "load_capng() failed\n"); goto out; } - - if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_SET) == -1) { + if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n"); - goto out_cap_free; + fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n"); + goto out; } - if (cap_set_proc(caps) == -1) { + if (capng_apply(CAPNG_SELECT_CAPS)) { ret = errno; - fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n"); - goto out_cap_free; + fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n"); + goto out; } ret = 0; -out_cap_free: - cap_free(caps); out: return ret; } @@ -2186,9 +2160,11 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino, * clearing setuid/setgid on file. */ if (fi->kill_priv) { - res = drop_effective_cap("cap_fsetid", &cap_fsetid_dropped); - if (res != 0) + res = drop_effective_cap("FSETID", &cap_fsetid_dropped); + if (res != 0) { fuse_reply_err(req, res); + return; + } } res = fuse_buf_copy(req, &out_buf, in_buf, 0); @@ -2207,7 +2183,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino, } if (cap_fsetid_dropped) { - res = gain_effective_cap("cap_fsetid"); + res = gain_effective_cap("FSETID"); if (res) fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n"); } -- 2.23.0 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [Virtio-fs] [PATCH 0/2] Convert to cap-ng 2019-12-03 13:14 [Virtio-fs] [PATCH 0/2] Convert to cap-ng Dr. David Alan Gilbert (git) 2019-12-03 13:14 ` [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers Dr. David Alan Gilbert (git) 2019-12-03 13:14 ` [Virtio-fs] [PATCH 2/2] virtiofsd: Convert to libcap-ng Dr. David Alan Gilbert (git) @ 2019-12-03 14:17 ` Vivek Goyal 2019-12-03 14:52 ` Dr. David Alan Gilbert 2 siblings, 1 reply; 7+ messages in thread From: Vivek Goyal @ 2019-12-03 14:17 UTC (permalink / raw) To: Dr. David Alan Gilbert (git); +Cc: virtio-fs On Tue, Dec 03, 2019 at 01:14:21PM +0000, Dr. David Alan Gilbert (git) wrote: > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> > > Hi, > This changes virtiofsd to use cap-ng rather than cap > (qemu is moving in that direction). It's a little painful > because of an interaction with our sandboxing. > > I intend to flatten the conversion into Vivek's patch that > adds the libcap use. It feels ugly that we store the parent process's state in a global variable and all the threads load their state from there. At the same time I don't have any good idea how to solve this problem given libcap-ng relies on /proc being there. So I am fine with the patches. Thanks Vivek > > Dave > > Dr. David Alan Gilbert (2): > virtiofsd: cap-ng helpers > virtiofsd: Convert to libcap-ng > > Makefile | 2 +- > contrib/virtiofsd/Makefile.objs | 2 - > contrib/virtiofsd/passthrough_ll.c | 162 +++++++++++++++++++---------- > 3 files changed, 106 insertions(+), 60 deletions(-) > > -- > 2.23.0 > ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [Virtio-fs] [PATCH 0/2] Convert to cap-ng 2019-12-03 14:17 ` [Virtio-fs] [PATCH 0/2] Convert to cap-ng Vivek Goyal @ 2019-12-03 14:52 ` Dr. David Alan Gilbert 0 siblings, 0 replies; 7+ messages in thread From: Dr. David Alan Gilbert @ 2019-12-03 14:52 UTC (permalink / raw) To: Vivek Goyal; +Cc: virtio-fs * Vivek Goyal (vgoyal@redhat.com) wrote: > On Tue, Dec 03, 2019 at 01:14:21PM +0000, Dr. David Alan Gilbert (git) wrote: > > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> > > > > Hi, > > This changes virtiofsd to use cap-ng rather than cap > > (qemu is moving in that direction). It's a little painful > > because of an interaction with our sandboxing. > > > > I intend to flatten the conversion into Vivek's patch that > > adds the libcap use. > > It feels ugly that we store the parent process's state in a global > variable and all the threads load their state from there. At the > same time I don't have any good idea how to solve this problem given > libcap-ng relies on /proc being there. So I am fine with the patches. Yep; I raised a cap-ng bug to show the issue, and Steve agrees it's a pain; so at least it's recorded. Dave > > Thanks > Vivek > > > > Dave > > > > Dr. David Alan Gilbert (2): > > virtiofsd: cap-ng helpers > > virtiofsd: Convert to libcap-ng > > > > Makefile | 2 +- > > contrib/virtiofsd/Makefile.objs | 2 - > > contrib/virtiofsd/passthrough_ll.c | 162 +++++++++++++++++++---------- > > 3 files changed, 106 insertions(+), 60 deletions(-) > > > > -- > > 2.23.0 > > -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2019-12-04 9:11 UTC | newest] Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2019-12-03 13:14 [Virtio-fs] [PATCH 0/2] Convert to cap-ng Dr. David Alan Gilbert (git) 2019-12-03 13:14 ` [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers Dr. David Alan Gilbert (git) 2019-12-04 7:20 ` misono.tomohiro 2019-12-04 9:11 ` Dr. David Alan Gilbert 2019-12-03 13:14 ` [Virtio-fs] [PATCH 2/2] virtiofsd: Convert to libcap-ng Dr. David Alan Gilbert (git) 2019-12-03 14:17 ` [Virtio-fs] [PATCH 0/2] Convert to cap-ng Vivek Goyal 2019-12-03 14:52 ` Dr. David Alan Gilbert
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.