[dovecot-cvs] dovecot/src/master Makefile.am, 1.21, 1.22 main.c, 1.99, 1.100

[tss at dovecot.org]

Update of /var/lib/cvs/dovecot/src/master
In directory talvi:/tmp/cvs-serv12570/src/master

Modified Files:
	Makefile.am main.c 
Log Message:
Drop privileges if libcap is found. Patch by David (lists edeca.net).



Index: Makefile.am
===================================================================
RCS file: /var/lib/cvs/dovecot/src/master/Makefile.am,v
retrieving revision 1.21
retrieving revision 1.22
diff -u -d -r1.21 -r1.22
--- Makefile.am	22 Feb 2007 16:08:54 -0000	1.21
+++ Makefile.am	28 Feb 2007 18:55:12 -0000	1.22
@@ -14,6 +14,7 @@
 	-DSSLDIR=\""$(ssldir)\""
 
 dovecot_LDADD = \
+	$(LIBCAP) \
 	../lib-settings/libsettings.a \
 	../lib/liblib.a
 

Index: main.c
===================================================================
RCS file: /var/lib/cvs/dovecot/src/master/main.c,v
retrieving revision 1.99
retrieving revision 1.100
diff -u -d -r1.99 -r1.100
--- main.c	27 Jan 2007 01:44:27 -0000	1.99
+++ main.c	28 Feb 2007 18:55:12 -0000	1.100
@@ -24,6 +24,9 @@
 #include <syslog.h>
 #include <sys/stat.h>
 #include <sys/wait.h>
+#ifdef HAVE_LIBCAP
+#include <sys/capability.h>
+#endif
 
 const char *process_names[PROCESS_TYPE_MAX] = {
 	"unknown",
@@ -36,6 +39,18 @@
 	"dict"
 };
 
+/* the capabilities that we *need* in order to operate */
+#ifdef HAVE_LIBCAP
+cap_t caps;
+cap_value_t suidcaps[] = {
+	CAP_CHOWN,
+	CAP_SYS_CHROOT,
+	CAP_SETUID,
+	CAP_SETGID,
+	CAP_NET_BIND_SERVICE
+};
+#endif
+
 static const char *configfile = SYSCONFDIR "/" PACKAGE ".conf";
 static const char *env_tz;
 
@@ -584,6 +599,18 @@
 	if (log_error)
 		i_fatal("This is Dovecot's error log");
 
+#ifdef HAVE_LIBCAP
+	/* drop capabilities that we don't need, be very restrictive. */
+	caps = cap_init();
+	cap_clear(caps);
+	cap_set_flag(caps, CAP_PERMITTED,
+		     sizeof(suidcaps) / sizeof(cap_value_t), suidcaps, CAP_SET);
+	cap_set_flag(caps, CAP_EFFECTIVE,
+		     sizeof(suidcaps) / sizeof(cap_value_t), suidcaps, CAP_SET);
+	cap_set_proc(caps);
+	cap_free(caps);
+#endif
+
 	lib_signals_init();
         lib_signals_set_handler(SIGINT, TRUE, sig_die, NULL);
         lib_signals_set_handler(SIGTERM, TRUE, sig_die, NULL);