aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDrew DeVault <sir@cmpwn.com>2017-01-12 11:39:14 -0500
committerGitHub <noreply@github.com>2017-01-12 11:39:14 -0500
commit307e8afde29fcd4b51cd25d34b465980a0bfd686 (patch)
treebcfca21ab99e7ad31f0805cc08a80b6c15c3d287
parent527c259d063a4d7ca2bfd62b3b877bb70419535b (diff)
parentd9ba61d7e91c5aceef1a6a736dc65f0594b9be2a (diff)
downloadsway-307e8afde29fcd4b51cd25d34b465980a0bfd686.zip
sway-307e8afde29fcd4b51cd25d34b465980a0bfd686.tar.gz
sway-307e8afde29fcd4b51cd25d34b465980a0bfd686.tar.bz2
Merge pull request #1043 from Hummer12007/caps
Keep CAP_SYS_PTRACE with suid binary
-rw-r--r--sway/main.c29
1 files changed, 29 insertions, 0 deletions
diff --git a/sway/main.c b/sway/main.c
index e8a02e7..7bf71b5 100644
--- a/sway/main.c
+++ b/sway/main.c
@@ -10,6 +10,9 @@
#include <unistd.h>
#include <getopt.h>
#include <sys/capability.h>
+#ifdef __linux__
+#include <sys/prctl.h>
+#endif
#include "sway/extensions.h"
#include "sway/layout.h"
#include "sway/config.h"
@@ -289,6 +292,18 @@ int main(int argc, char **argv) {
return 0;
}
+#ifdef __linux__
+ bool suid = false;
+ if (getuid() != geteuid() || getgid() != getegid()) {
+ // Retain capabilities after setuid()
+ if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0)) {
+ sway_log(L_ERROR, "Cannot keep caps after setuid()");
+ exit(EXIT_FAILURE);
+ }
+ suid = true;
+ }
+#endif
+
// we need to setup logging before wlc_init in case it fails.
if (debug) {
init_log(L_DEBUG);
@@ -311,6 +326,20 @@ int main(int argc, char **argv) {
}
register_extensions();
+#ifdef __linux__
+ if (suid) {
+ // Drop every cap except CAP_SYS_PTRACE
+ cap_t caps = cap_init();
+ cap_value_t keep = CAP_SYS_PTRACE;
+ sway_log(L_INFO, "Dropping extra capabilities");
+ if (cap_set_flag(caps, CAP_PERMITTED, 1, &keep, CAP_SET) ||
+ cap_set_flag(caps, CAP_EFFECTIVE, 1, &keep, CAP_SET) ||
+ cap_set_proc(caps)) {
+ sway_log(L_ERROR, "Failed to drop extra capabilities");
+ exit(EXIT_FAILURE);
+ }
+ }
+#endif
// handle SIGTERM signals
signal(SIGTERM, sig_handler);