All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Dr. David Alan Gilbert (git)" <dgilbert@redhat.com>
To: virtio-fs@redhat.com, vgoyal@redhat.com
Subject: [Virtio-fs] [PATCH 2/2] virtiofsd: Convert to libcap-ng
Date: Tue,  3 Dec 2019 13:14:23 +0000	[thread overview]
Message-ID: <20191203131423.40962-3-dgilbert@redhat.com> (raw)
In-Reply-To: <20191203131423.40962-1-dgilbert@redhat.com>

From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

QEMU is moving to libcap-ng, so lets move as well.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
 contrib/virtiofsd/Makefile.objs    |  2 -
 contrib/virtiofsd/passthrough_ll.c | 90 +++++++++++-------------------
 2 files changed, 33 insertions(+), 59 deletions(-)

diff --git a/contrib/virtiofsd/Makefile.objs b/contrib/virtiofsd/Makefile.objs
index 25f1e8dd73..941b19f18e 100644
--- a/contrib/virtiofsd/Makefile.objs
+++ b/contrib/virtiofsd/Makefile.objs
@@ -11,5 +11,3 @@ virtiofsd-obj-y = buffer.o \
 
 seccomp.o-cflags := $(SECCOMP_CFLAGS)
 seccomp.o-libs := $(SECCOMP_LIBS)
-
-passthrough_ll.o-libs += -lcap
diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c
index 139261efc1..a081a91b85 100644
--- a/contrib/virtiofsd/passthrough_ll.c
+++ b/contrib/virtiofsd/passthrough_ll.c
@@ -59,7 +59,6 @@
 #include <sys/prctl.h>
 #include <sys/syscall.h>
 #include <sys/xattr.h>
-#include <sys/capability.h>
 #include <sys/mount.h>
 #include <sys/mman.h>
 #include <sys/resource.h>
@@ -285,107 +284,82 @@ static int load_capng(void)
  * on success, error otherwise  */
 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
 {
-	cap_t caps;
-	cap_value_t cap;
-	cap_flag_value_t cap_value;
-	int ret = 0;
+	int cap, ret;
 
-	ret = cap_from_name(cap_name, &cap);
-	if (ret == -1) {
+	cap = capng_name_to_capability(cap_name);
+	if (cap < 0) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n", cap_name,
+		fuse_log(FUSE_LOG_ERR,
+			 "capng_name_to_capability(%s) failed:%s\n", cap_name,
 			 strerror(errno));
 		goto out;
 	}
 
-	if (!CAP_IS_SUPPORTED(cap)) {
-		fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n", cap_name);
-		return EINVAL;
-	}
-
-	caps = cap_get_proc();
-	if (caps == NULL) {
+	if (load_capng()) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n");
+		fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 		goto out;
 	}
 
-	if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &cap_value) == -1) {
-		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_get_flag() failed\n");
-		goto out_cap_free;
-	}
-
 	/* We dont have this capability in effective set already. */
-	if (cap_value == CAP_CLEAR) {
+	if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
 		ret = 0;
-		goto out_cap_free;
+		goto out;
 	}
 
-	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_CLEAR) == -1) {
+	if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
+		goto out;
 	}
 
-	if (cap_set_proc(caps) == -1) {
+	if (capng_apply(CAPNG_SELECT_CAPS)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
+		goto out;
 	}
 
 	ret = 0;
 	if (cap_dropped)
 		*cap_dropped = true;
 
-out_cap_free:
-	cap_free(caps);
 out:
 	return ret;
 }
 
 static int gain_effective_cap(const char *cap_name)
 {
-	cap_t caps;
-	cap_value_t cap;
+	int cap;
 	int ret = 0;
 
-	ret = cap_from_name(cap_name, &cap);
-	if (ret == -1) {
+	cap = capng_name_to_capability(cap_name);
+	if (cap < 0) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n", cap_name,
+		fuse_log(FUSE_LOG_ERR,
+			 "capng_name_to_capability(%s) failed:%s\n", cap_name,
 			 strerror(errno));
 		goto out;
 	}
 
-	if (!CAP_IS_SUPPORTED(cap)) {
-		fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n", cap_name);
-		return EINVAL;
-	}
-
-	caps = cap_get_proc();
-	if (caps == NULL) {
+	if (load_capng()) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n");
+		fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 		goto out;
 	}
 
-
-	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_SET) == -1) {
+	if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
+		goto out;
 	}
 
-	if (cap_set_proc(caps) == -1) {
+	if (capng_apply(CAPNG_SELECT_CAPS)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
+		goto out;
 	}
 	ret = 0;
 
-out_cap_free:
-	cap_free(caps);
 out:
 	return ret;
 }
@@ -2186,9 +2160,11 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
 	 * clearing setuid/setgid on file.
 	 */
 	if (fi->kill_priv) {
-		res = drop_effective_cap("cap_fsetid", &cap_fsetid_dropped);
-		if (res != 0)
+		res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
+		if (res != 0) {
 			fuse_reply_err(req, res);
+			return;
+		}
 	}
 
 	res = fuse_buf_copy(req, &out_buf, in_buf, 0);
@@ -2207,7 +2183,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
 	}
 
 	if (cap_fsetid_dropped) {
-		res = gain_effective_cap("cap_fsetid");
+		res = gain_effective_cap("FSETID");
 		if (res)
 			fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
 	}
-- 
2.23.0


  parent reply	other threads:[~2019-12-03 13:14 UTC|newest]

Thread overview: 7+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-12-03 13:14 [Virtio-fs] [PATCH 0/2] Convert to cap-ng Dr. David Alan Gilbert (git)
2019-12-03 13:14 ` [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers Dr. David Alan Gilbert (git)
2019-12-04  7:20   ` misono.tomohiro
2019-12-04  9:11     ` Dr. David Alan Gilbert
2019-12-03 13:14 ` Dr. David Alan Gilbert (git) [this message]
2019-12-03 14:17 ` [Virtio-fs] [PATCH 0/2] Convert to cap-ng Vivek Goyal
2019-12-03 14:52   ` Dr. David Alan Gilbert

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20191203131423.40962-3-dgilbert@redhat.com \
    --to=dgilbert@redhat.com \
    --cc=vgoyal@redhat.com \
    --cc=virtio-fs@redhat.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.