[Virtio-fs] [PATCH 0/2] Convert to cap-ng

[Virtio-fs] [PATCH 0/2] Convert to cap-ng

[Dr. David Alan Gilbert (git)]

From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

Hi,
  This changes virtiofsd to use cap-ng rather than cap
(qemu is moving in that direction).  It's a little painful
because of an interaction with our sandboxing.

I intend to flatten the conversion into Vivek's patch that
adds the libcap use.

Dave

Dr. David Alan Gilbert (2):
  virtiofsd: cap-ng helpers
  virtiofsd: Convert to libcap-ng

 Makefile                           |   2 +-
 contrib/virtiofsd/Makefile.objs    |   2 -
 contrib/virtiofsd/passthrough_ll.c | 162 +++++++++++++++++++----------
 3 files changed, 106 insertions(+), 60 deletions(-)

-- 
2.23.0

[Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers

[Dr. David Alan Gilbert (git)]

From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's
sandboxing doesn't have /proc mounted; thus we have to do the
caps read before we sandbox it and save/restore the state.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
 Makefile                           |  2 +-
 contrib/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++
 2 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 237cbdfee1..1484c23a9b 100644
--- a/Makefile
+++ b/Makefile
@@ -323,7 +323,7 @@ HELPERS-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_LINUX)) = qemu-bridge-helper$(EXE
 
 ifdef CONFIG_LINUX
 ifdef CONFIG_SECCOMP
-ifdef CONFIG_LIBCAP
+ifdef CONFIG_LIBCAP_NG
 HELPERS-y += virtiofsd$(EXESUF)
 vhost-user-json-y += contrib/virtiofsd/50-qemu-virtiofsd.json
 endif
diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c
index 1688071c10..139261efc1 100644
--- a/contrib/virtiofsd/passthrough_ll.c
+++ b/contrib/virtiofsd/passthrough_ll.c
@@ -47,6 +47,7 @@
 #include <string.h>
 #include <syslog.h>
 #include <limits.h>
+#include <cap-ng.h>
 #include <dirent.h>
 #include <assert.h>
 #include <errno.h>
@@ -216,6 +217,13 @@ static const struct fuse_opt lo_opts[] = {
 };
 static bool use_syslog = false;
 static int current_log_level;
+static struct {
+	pthread_mutex_t mutex;
+	void *saved;
+} cap;
+/* That we loaded cap-ng in the current thread from the saved */
+static __thread bool cap_loaded = 0;
+
 static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode, uint64_t n);
 static void put_shared(struct lo_data *lo, struct lo_inode *inode);
 
@@ -242,6 +250,37 @@ static struct lo_data *lo_data(fuse_req_t req)
 	return (struct lo_data *) fuse_req_userdata(req);
 }
 
+/*
+ * Load capng's state from our saved state if the current thread
+ * hadn't previously been loaded.
+ * returns 0 on success
+ */
+static int load_capng(void)
+{
+	if (!cap_loaded) {
+		pthread_mutex_lock(&cap.mutex);
+		capng_restore_state(&cap.saved);
+		/*
+		 * restore_state free's the saved copy
+		 * so make another.
+		 */
+		cap.saved = capng_save_state();
+		if (!cap.saved) {
+			fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
+			return -EINVAL;
+		}
+		pthread_mutex_unlock(&cap.mutex);
+
+		/*
+		 * We want to use the loaded state for our pid,
+		 * not the original
+		 */
+		capng_setpid(gettid());
+		cap_loaded = true;
+	}
+	return 0;
+}
+
 /* Helpers for dropping and regaining effective capabilities. Returns 0
  * on success, error otherwise  */
 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
@@ -2754,6 +2793,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
 	}
 }
 
+/*
+ * Capture the capability state, we'll need to restore this for individual
+ * threads later; see load_capng.
+ */
+static void setup_capng(void)
+{
+	/* Note this accesses /proc so has to happen before the sandbox */
+	if (capng_get_caps_process()) {
+		fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
+		exit(1);
+	}
+	pthread_mutex_init(&cap.mutex, NULL);
+	pthread_mutex_lock(&cap.mutex);
+	cap.saved = capng_save_state();
+	if (!cap.saved) {
+		fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
+		exit(1);
+	}
+	pthread_mutex_unlock(&cap.mutex);
+}
+
+static void cleanup_capng(void)
+{
+	free(cap.saved);
+	cap.saved = NULL;
+	pthread_mutex_destroy(&cap.mutex);
+}
+
+
 /*
  * Make the source directory our root so symlinks cannot escape and no other
  * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
@@ -3173,6 +3241,9 @@ int main(int argc, char *argv[])
 
 	setup_nofile_rlimit();
 
+	/* Must be before sandbox since it wants /proc */
+	setup_capng();
+
 	setup_sandbox(&lo, se, opts.syslog);
 
 	setup_root(&lo, &lo.root);
@@ -3195,6 +3266,7 @@ int main(int argc, char *argv[])
 
 err_out4:
 	fuse_session_unmount(se);
+	cleanup_capng();
 err_out3:
 	fuse_remove_signal_handlers(se);
 err_out2:
-- 
2.23.0

Re: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers

[misono.tomohiro]

> -----Original Message-----
> From: virtio-fs-bounces@redhat.com [mailto:virtio-fs-bounces@redhat.com] On Behalf Of Dr. David Alan Gilbert (git)
> Sent: Tuesday, December 3, 2019 10:14 PM
> To: virtio-fs@redhat.com; vgoyal@redhat.com
> Subject: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers
> 
> From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
> 
> libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's
> sandboxing doesn't have /proc mounted; thus we have to do the
> caps read before we sandbox it and save/restore the state.
> 
> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
> ---
>  Makefile                           |  2 +-
>  contrib/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++
>  2 files changed, 73 insertions(+), 1 deletion(-)
> 
> diff --git a/Makefile b/Makefile
> index 237cbdfee1..1484c23a9b 100644
> --- a/Makefile
> +++ b/Makefile
> @@ -323,7 +323,7 @@ HELPERS-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_LINUX)) = qemu-bridge-helper$(EXE
> 
>  ifdef CONFIG_LINUX
>  ifdef CONFIG_SECCOMP
> -ifdef CONFIG_LIBCAP
> +ifdef CONFIG_LIBCAP_NG
>  HELPERS-y += virtiofsd$(EXESUF)
>  vhost-user-json-y += contrib/virtiofsd/50-qemu-virtiofsd.json
>  endif
> diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c
> index 1688071c10..139261efc1 100644
> --- a/contrib/virtiofsd/passthrough_ll.c
> +++ b/contrib/virtiofsd/passthrough_ll.c
> @@ -47,6 +47,7 @@
>  #include <string.h>
>  #include <syslog.h>
>  #include <limits.h>
> +#include <cap-ng.h>
>  #include <dirent.h>
>  #include <assert.h>
>  #include <errno.h>
> @@ -216,6 +217,13 @@ static const struct fuse_opt lo_opts[] = {
>  };
>  static bool use_syslog = false;
>  static int current_log_level;
> +static struct {
> +	pthread_mutex_t mutex;
> +	void *saved;
> +} cap;
> +/* That we loaded cap-ng in the current thread from the saved */
> +static __thread bool cap_loaded = 0;
> +
>  static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode, uint64_t n);
>  static void put_shared(struct lo_data *lo, struct lo_inode *inode);
> 
> @@ -242,6 +250,37 @@ static struct lo_data *lo_data(fuse_req_t req)
>  	return (struct lo_data *) fuse_req_userdata(req);
>  }
> 
> +/*
> + * Load capng's state from our saved state if the current thread
> + * hadn't previously been loaded.
> + * returns 0 on success
> + */
> +static int load_capng(void)
> +{
> +	if (!cap_loaded) {
> +		pthread_mutex_lock(&cap.mutex);
> +		capng_restore_state(&cap.saved);
> +		/*
> +		 * restore_state free's the saved copy
> +		 * so make another.
> +		 */
> +		cap.saved = capng_save_state();
> +		if (!cap.saved) {
> +			fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
> +			return -EINVAL;
> +		}
> +		pthread_mutex_unlock(&cap.mutex);
> +
> +		/*
> +		 * We want to use the loaded state for our pid,
> +		 * not the original
> +		 */
> +		capng_setpid(gettid());

Hi,

I got build error on Fedora 30 with glibc 2.29 since gettid() wrapper is introduced in glibc 2.30.
How about using syscall(__NR_gettid) directly? Or is 2.30 required?

Thanks,
Misono

> +		cap_loaded = true;
> +	}
> +	return 0;
> +}
> +
>  /* Helpers for dropping and regaining effective capabilities. Returns 0
>   * on success, error otherwise  */
>  static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
> @@ -2754,6 +2793,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
>  	}
>  }
> 
> +/*
> + * Capture the capability state, we'll need to restore this for individual
> + * threads later; see load_capng.
> + */
> +static void setup_capng(void)
> +{
> +	/* Note this accesses /proc so has to happen before the sandbox */
> +	if (capng_get_caps_process()) {
> +		fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
> +		exit(1);
> +	}
> +	pthread_mutex_init(&cap.mutex, NULL);
> +	pthread_mutex_lock(&cap.mutex);
> +	cap.saved = capng_save_state();
> +	if (!cap.saved) {
> +		fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
> +		exit(1);
> +	}
> +	pthread_mutex_unlock(&cap.mutex);
> +}
> +
> +static void cleanup_capng(void)
> +{
> +	free(cap.saved);
> +	cap.saved = NULL;
> +	pthread_mutex_destroy(&cap.mutex);
> +}
> +
> +
>  /*
>   * Make the source directory our root so symlinks cannot escape and no other
>   * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
> @@ -3173,6 +3241,9 @@ int main(int argc, char *argv[])
> 
>  	setup_nofile_rlimit();
> 
> +	/* Must be before sandbox since it wants /proc */
> +	setup_capng();
> +
>  	setup_sandbox(&lo, se, opts.syslog);
> 
>  	setup_root(&lo, &lo.root);
> @@ -3195,6 +3266,7 @@ int main(int argc, char *argv[])
> 
>  err_out4:
>  	fuse_session_unmount(se);
> +	cleanup_capng();
>  err_out3:
>  	fuse_remove_signal_handlers(se);
>  err_out2:
> --
> 2.23.0
> 
> _______________________________________________
> Virtio-fs mailing list
> Virtio-fs@redhat.com
> https://www.redhat.com/mailman/listinfo/virtio-fs

Re: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers

[Dr. David Alan Gilbert]

* misono.tomohiro@fujitsu.com (misono.tomohiro@fujitsu.com) wrote:
> > -----Original Message-----
> > From: virtio-fs-bounces@redhat.com [mailto:virtio-fs-bounces@redhat.com] On Behalf Of Dr. David Alan Gilbert (git)
> > Sent: Tuesday, December 3, 2019 10:14 PM
> > To: virtio-fs@redhat.com; vgoyal@redhat.com
> > Subject: [Virtio-fs] [PATCH 1/2] virtiofsd: cap-ng helpers
> > 
> > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
> > 
> > libcap-ng reads /proc during capng_get_caps_process, and virtiofsd's
> > sandboxing doesn't have /proc mounted; thus we have to do the
> > caps read before we sandbox it and save/restore the state.
> > 
> > Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
> > ---
> >  Makefile                           |  2 +-
> >  contrib/virtiofsd/passthrough_ll.c | 72 ++++++++++++++++++++++++++++++
> >  2 files changed, 73 insertions(+), 1 deletion(-)
> > 
> > diff --git a/Makefile b/Makefile
> > index 237cbdfee1..1484c23a9b 100644
> > --- a/Makefile
> > +++ b/Makefile
> > @@ -323,7 +323,7 @@ HELPERS-$(call land,$(CONFIG_SOFTMMU),$(CONFIG_LINUX)) = qemu-bridge-helper$(EXE
> > 
> >  ifdef CONFIG_LINUX
> >  ifdef CONFIG_SECCOMP
> > -ifdef CONFIG_LIBCAP
> > +ifdef CONFIG_LIBCAP_NG
> >  HELPERS-y += virtiofsd$(EXESUF)
> >  vhost-user-json-y += contrib/virtiofsd/50-qemu-virtiofsd.json
> >  endif
> > diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c
> > index 1688071c10..139261efc1 100644
> > --- a/contrib/virtiofsd/passthrough_ll.c
> > +++ b/contrib/virtiofsd/passthrough_ll.c
> > @@ -47,6 +47,7 @@
> >  #include <string.h>
> >  #include <syslog.h>
> >  #include <limits.h>
> > +#include <cap-ng.h>
> >  #include <dirent.h>
> >  #include <assert.h>
> >  #include <errno.h>
> > @@ -216,6 +217,13 @@ static const struct fuse_opt lo_opts[] = {
> >  };
> >  static bool use_syslog = false;
> >  static int current_log_level;
> > +static struct {
> > +	pthread_mutex_t mutex;
> > +	void *saved;
> > +} cap;
> > +/* That we loaded cap-ng in the current thread from the saved */
> > +static __thread bool cap_loaded = 0;
> > +
> >  static void unref_inode_lolocked(struct lo_data *lo, struct lo_inode *inode, uint64_t n);
> >  static void put_shared(struct lo_data *lo, struct lo_inode *inode);
> > 
> > @@ -242,6 +250,37 @@ static struct lo_data *lo_data(fuse_req_t req)
> >  	return (struct lo_data *) fuse_req_userdata(req);
> >  }
> > 
> > +/*
> > + * Load capng's state from our saved state if the current thread
> > + * hadn't previously been loaded.
> > + * returns 0 on success
> > + */
> > +static int load_capng(void)
> > +{
> > +	if (!cap_loaded) {
> > +		pthread_mutex_lock(&cap.mutex);
> > +		capng_restore_state(&cap.saved);
> > +		/*
> > +		 * restore_state free's the saved copy
> > +		 * so make another.
> > +		 */
> > +		cap.saved = capng_save_state();
> > +		if (!cap.saved) {
> > +			fuse_log(FUSE_LOG_ERR, "capng_save_state (thread)\n");
> > +			return -EINVAL;
> > +		}
> > +		pthread_mutex_unlock(&cap.mutex);
> > +
> > +		/*
> > +		 * We want to use the loaded state for our pid,
> > +		 * not the original
> > +		 */
> > +		capng_setpid(gettid());
> 
> Hi,
> 
> I got build error on Fedora 30 with glibc 2.29 since gettid() wrapper is introduced in glibc 2.30.
> How about using syscall(__NR_gettid) directly? Or is 2.30 required?

Thanks for reporting, I'm on Fedora 31 so didn't notice.
I'll change it to syscall(__NR_gettid).

Dave

> Thanks,
> Misono
> 
> > +		cap_loaded = true;
> > +	}
> > +	return 0;
> > +}
> > +
> >  /* Helpers for dropping and regaining effective capabilities. Returns 0
> >   * on success, error otherwise  */
> >  static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
> > @@ -2754,6 +2793,35 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
> >  	}
> >  }
> > 
> > +/*
> > + * Capture the capability state, we'll need to restore this for individual
> > + * threads later; see load_capng.
> > + */
> > +static void setup_capng(void)
> > +{
> > +	/* Note this accesses /proc so has to happen before the sandbox */
> > +	if (capng_get_caps_process()) {
> > +		fuse_log(FUSE_LOG_ERR, "capng_get_caps_process\n");
> > +		exit(1);
> > +	}
> > +	pthread_mutex_init(&cap.mutex, NULL);
> > +	pthread_mutex_lock(&cap.mutex);
> > +	cap.saved = capng_save_state();
> > +	if (!cap.saved) {
> > +		fuse_log(FUSE_LOG_ERR, "capng_save_state\n");
> > +		exit(1);
> > +	}
> > +	pthread_mutex_unlock(&cap.mutex);
> > +}
> > +
> > +static void cleanup_capng(void)
> > +{
> > +	free(cap.saved);
> > +	cap.saved = NULL;
> > +	pthread_mutex_destroy(&cap.mutex);
> > +}
> > +
> > +
> >  /*
> >   * Make the source directory our root so symlinks cannot escape and no other
> >   * files are accessible.  Assumes unshare(CLONE_NEWNS) was already called.
> > @@ -3173,6 +3241,9 @@ int main(int argc, char *argv[])
> > 
> >  	setup_nofile_rlimit();
> > 
> > +	/* Must be before sandbox since it wants /proc */
> > +	setup_capng();
> > +
> >  	setup_sandbox(&lo, se, opts.syslog);
> > 
> >  	setup_root(&lo, &lo.root);
> > @@ -3195,6 +3266,7 @@ int main(int argc, char *argv[])
> > 
> >  err_out4:
> >  	fuse_session_unmount(se);
> > +	cleanup_capng();
> >  err_out3:
> >  	fuse_remove_signal_handlers(se);
> >  err_out2:
> > --
> > 2.23.0
> > 
> > _______________________________________________
> > Virtio-fs mailing list
> > Virtio-fs@redhat.com
> > https://www.redhat.com/mailman/listinfo/virtio-fs
> 
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK

[Virtio-fs] [PATCH 2/2] virtiofsd: Convert to libcap-ng

[Dr. David Alan Gilbert (git)]

From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>

QEMU is moving to libcap-ng, so lets move as well.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
---
 contrib/virtiofsd/Makefile.objs    |  2 -
 contrib/virtiofsd/passthrough_ll.c | 90 +++++++++++-------------------
 2 files changed, 33 insertions(+), 59 deletions(-)

diff --git a/contrib/virtiofsd/Makefile.objs b/contrib/virtiofsd/Makefile.objs
index 25f1e8dd73..941b19f18e 100644
--- a/contrib/virtiofsd/Makefile.objs
+++ b/contrib/virtiofsd/Makefile.objs
@@ -11,5 +11,3 @@ virtiofsd-obj-y = buffer.o \
 
 seccomp.o-cflags := $(SECCOMP_CFLAGS)
 seccomp.o-libs := $(SECCOMP_LIBS)
-
-passthrough_ll.o-libs += -lcap
diff --git a/contrib/virtiofsd/passthrough_ll.c b/contrib/virtiofsd/passthrough_ll.c
index 139261efc1..a081a91b85 100644
--- a/contrib/virtiofsd/passthrough_ll.c
+++ b/contrib/virtiofsd/passthrough_ll.c
@@ -59,7 +59,6 @@
 #include <sys/prctl.h>
 #include <sys/syscall.h>
 #include <sys/xattr.h>
-#include <sys/capability.h>
 #include <sys/mount.h>
 #include <sys/mman.h>
 #include <sys/resource.h>
@@ -285,107 +284,82 @@ static int load_capng(void)
  * on success, error otherwise  */
 static int drop_effective_cap(const char *cap_name, bool *cap_dropped)
 {
-	cap_t caps;
-	cap_value_t cap;
-	cap_flag_value_t cap_value;
-	int ret = 0;
+	int cap, ret;
 
-	ret = cap_from_name(cap_name, &cap);
-	if (ret == -1) {
+	cap = capng_name_to_capability(cap_name);
+	if (cap < 0) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n", cap_name,
+		fuse_log(FUSE_LOG_ERR,
+			 "capng_name_to_capability(%s) failed:%s\n", cap_name,
 			 strerror(errno));
 		goto out;
 	}
 
-	if (!CAP_IS_SUPPORTED(cap)) {
-		fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n", cap_name);
-		return EINVAL;
-	}
-
-	caps = cap_get_proc();
-	if (caps == NULL) {
+	if (load_capng()) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n");
+		fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 		goto out;
 	}
 
-	if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &cap_value) == -1) {
-		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_get_flag() failed\n");
-		goto out_cap_free;
-	}
-
 	/* We dont have this capability in effective set already. */
-	if (cap_value == CAP_CLEAR) {
+	if (!capng_have_capability(CAPNG_EFFECTIVE, cap)) {
 		ret = 0;
-		goto out_cap_free;
+		goto out;
 	}
 
-	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_CLEAR) == -1) {
+	if (capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, cap)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "capng_update(DROP,) failed\n");
+		goto out;
 	}
 
-	if (cap_set_proc(caps) == -1) {
+	if (capng_apply(CAPNG_SELECT_CAPS)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "drop:capng_apply() failed\n");
+		goto out;
 	}
 
 	ret = 0;
 	if (cap_dropped)
 		*cap_dropped = true;
 
-out_cap_free:
-	cap_free(caps);
 out:
 	return ret;
 }
 
 static int gain_effective_cap(const char *cap_name)
 {
-	cap_t caps;
-	cap_value_t cap;
+	int cap;
 	int ret = 0;
 
-	ret = cap_from_name(cap_name, &cap);
-	if (ret == -1) {
+	cap = capng_name_to_capability(cap_name);
+	if (cap < 0) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_from_name(%s) failed:%s\n", cap_name,
+		fuse_log(FUSE_LOG_ERR,
+			 "capng_name_to_capability(%s) failed:%s\n", cap_name,
 			 strerror(errno));
 		goto out;
 	}
 
-	if (!CAP_IS_SUPPORTED(cap)) {
-		fuse_log(FUSE_LOG_ERR, "capability(%s) is not supported\n", cap_name);
-		return EINVAL;
-	}
-
-	caps = cap_get_proc();
-	if (caps == NULL) {
+	if (load_capng()) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_get_proc() failed\n");
+		fuse_log(FUSE_LOG_ERR, "load_capng() failed\n");
 		goto out;
 	}
 
-
-	if (cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, CAP_SET) == -1) {
+	if (capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, cap)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_flag() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "capng_update(ADD,) failed\n");
+		goto out;
 	}
 
-	if (cap_set_proc(caps) == -1) {
+	if (capng_apply(CAPNG_SELECT_CAPS)) {
 		ret = errno;
-		fuse_log(FUSE_LOG_ERR, "cap_set_procs() failed\n");
-		goto out_cap_free;
+		fuse_log(FUSE_LOG_ERR, "gain:capng_apply() failed\n");
+		goto out;
 	}
 	ret = 0;
 
-out_cap_free:
-	cap_free(caps);
 out:
 	return ret;
 }
@@ -2186,9 +2160,11 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
 	 * clearing setuid/setgid on file.
 	 */
 	if (fi->kill_priv) {
-		res = drop_effective_cap("cap_fsetid", &cap_fsetid_dropped);
-		if (res != 0)
+		res = drop_effective_cap("FSETID", &cap_fsetid_dropped);
+		if (res != 0) {
 			fuse_reply_err(req, res);
+			return;
+		}
 	}
 
 	res = fuse_buf_copy(req, &out_buf, in_buf, 0);
@@ -2207,7 +2183,7 @@ static void lo_write_buf(fuse_req_t req, fuse_ino_t ino,
 	}
 
 	if (cap_fsetid_dropped) {
-		res = gain_effective_cap("cap_fsetid");
+		res = gain_effective_cap("FSETID");
 		if (res)
 			fuse_log(FUSE_LOG_ERR, "Failed to gain CAP_FSETID\n");
 	}
-- 
2.23.0

Re: [Virtio-fs] [PATCH 0/2] Convert to cap-ng

[Vivek Goyal]

On Tue, Dec 03, 2019 at 01:14:21PM +0000, Dr. David Alan Gilbert (git) wrote:
> From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
> 
> Hi,
>   This changes virtiofsd to use cap-ng rather than cap
> (qemu is moving in that direction).  It's a little painful
> because of an interaction with our sandboxing.
> 
> I intend to flatten the conversion into Vivek's patch that
> adds the libcap use.

It feels ugly that we store the parent process's state in a global
variable and all the threads load their state from there. At the
same time I don't have any good idea how to solve this problem given
libcap-ng relies on /proc being there. So I am fine with the patches.

Thanks
Vivek
> 
> Dave
> 
> Dr. David Alan Gilbert (2):
>   virtiofsd: cap-ng helpers
>   virtiofsd: Convert to libcap-ng
> 
>  Makefile                           |   2 +-
>  contrib/virtiofsd/Makefile.objs    |   2 -
>  contrib/virtiofsd/passthrough_ll.c | 162 +++++++++++++++++++----------
>  3 files changed, 106 insertions(+), 60 deletions(-)
> 
> -- 
> 2.23.0
> 

Re: [Virtio-fs] [PATCH 0/2] Convert to cap-ng

[Dr. David Alan Gilbert]

* Vivek Goyal (vgoyal@redhat.com) wrote:
> On Tue, Dec 03, 2019 at 01:14:21PM +0000, Dr. David Alan Gilbert (git) wrote:
> > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
> > 
> > Hi,
> >   This changes virtiofsd to use cap-ng rather than cap
> > (qemu is moving in that direction).  It's a little painful
> > because of an interaction with our sandboxing.
> > 
> > I intend to flatten the conversion into Vivek's patch that
> > adds the libcap use.
> 
> It feels ugly that we store the parent process's state in a global
> variable and all the threads load their state from there. At the
> same time I don't have any good idea how to solve this problem given
> libcap-ng relies on /proc being there. So I am fine with the patches.

Yep; I raised a cap-ng bug to show the issue, and Steve agrees it's a
pain; so at least it's recorded.

Dave

> 
> Thanks
> Vivek
> > 
> > Dave
> > 
> > Dr. David Alan Gilbert (2):
> >   virtiofsd: cap-ng helpers
> >   virtiofsd: Convert to libcap-ng
> > 
> >  Makefile                           |   2 +-
> >  contrib/virtiofsd/Makefile.objs    |   2 -
> >  contrib/virtiofsd/passthrough_ll.c | 162 +++++++++++++++++++----------
> >  3 files changed, 106 insertions(+), 60 deletions(-)
> > 
> > -- 
> > 2.23.0
> > 
--
Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK