From 8e04538cae48d44ab6c917d4428303de44e7f0b2 Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Thu, 21 Jun 2018 11:22:51 -0400 Subject: [PATCH 1/2] lib: Fix privs when using HAVE_CAPABILITIES If your daemon does not need any special privileges and you are compiling with HAVE_CAPABILIES, the zprivs->change pointer will end up NULL due to the way zprivs_caps_init. So as a check let's add a NULL check for zprivs->change and set it to a function that will do nothing. This change prevents a crash if you raise privileges when your daemon needs no special privileges. Signed-off-by: Donald Sharp --- lib/privs.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/lib/privs.c b/lib/privs.c index cfe7d6d6f8..7c99742d34 100644 --- a/lib/privs.c +++ b/lib/privs.c @@ -824,6 +824,19 @@ void zprivs_init(struct zebra_privs_t *zprivs) #ifdef HAVE_CAPABILITIES zprivs_caps_init(zprivs); + + /* + * If we have initialized the system with no requested + * capabilities, change will not have been set + * to anything by zprivs_caps_init, As such + * we should make sure that when we attempt + * to raize privileges that we actually have + * a do nothing function to call instead of a + * crash :). + */ + if (!zprivs->change) + zprivs->change = zprivs_change_null; + #else /* !HAVE_CAPABILITIES */ /* we dont have caps. we'll need to maintain rid and saved uid * and change euid back to saved uid (who we presume has all neccessary From 38e72ffa9a104a5739482fc641882d296be11a30 Mon Sep 17 00:00:00 2001 From: Donald Sharp Date: Thu, 21 Jun 2018 11:28:16 -0400 Subject: [PATCH 2/2] sharpd: Does not need any special priv's Remove the unnecessary privs that we were requesting for the sharp daemon. Signed-off-by: Donald Sharp --- sharpd/sharp_main.c | 1 - 1 file changed, 1 deletion(-) diff --git a/sharpd/sharp_main.c b/sharpd/sharp_main.c index a478b416bf..22a19da0b3 100644 --- a/sharpd/sharp_main.c +++ b/sharpd/sharp_main.c @@ -51,7 +51,6 @@ uint32_t installed_routes = 0; uint32_t removed_routes = 0; zebra_capabilities_t _caps_p[] = { - ZCAP_NET_RAW, ZCAP_BIND, ZCAP_NET_ADMIN, }; struct zebra_privs_t sharp_privs = {