X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fshared%2Fcapability.c;h=321952067d71469c3e9c683ff85c191695dac730;hb=b32ff512191bf873266ee8067f6f6c8a30c96a5e;hp=08b7a209da6bd4674ca5da523c1b0676a7c7c626;hpb=ec8927ca5940e809f0b72f530582c76f1db4f065;p=elogind.git

diff --git a/src/shared/capability.c b/src/shared/capability.c
index 08b7a209d..321952067 100644
--- a/src/shared/capability.c
+++ b/src/shared/capability.c
@@ -34,6 +34,7 @@
 #include "capability.h"
 #include "util.h"
 #include "log.h"
+#include "fileio.h"
 
 int have_effective_cap(int value) {
         cap_t cap;
@@ -171,3 +172,54 @@ finish:
 
         return r;
 }
+
+static int drop_from_file(const char *fn, uint64_t drop) {
+        int r, k;
+        uint32_t hi, lo;
+        uint64_t current, after;
+        char *p;
+
+        r = read_one_line_file(fn, &p);
+        if (r < 0)
+                return r;
+
+        assert_cc(sizeof(hi) == sizeof(unsigned));
+        assert_cc(sizeof(lo) == sizeof(unsigned));
+
+        k = sscanf(p, "%u %u", &lo, &hi);
+        free(p);
+
+        if (k != 2)
+                return -EIO;
+
+        current = (uint64_t) lo | ((uint64_t) hi << 32ULL);
+        after = current & ~drop;
+
+        if (current == after)
+                return 0;
+
+        lo = (unsigned) (after & 0xFFFFFFFFULL);
+        hi = (unsigned) ((after >> 32ULL) & 0xFFFFFFFFULL);
+
+        if (asprintf(&p, "%u %u", lo, hi) < 0)
+                return -ENOMEM;
+
+        r = write_string_file(fn, p);
+        free(p);
+
+        return r;
+}
+
+int capability_bounding_set_drop_usermode(uint64_t drop) {
+        int r;
+
+        r = drop_from_file("/proc/sys/kernel/usermodehelper/inheritable", drop);
+        if (r < 0)
+                return r;
+
+        r = drop_from_file("/proc/sys/kernel/usermodehelper/bset", drop);
+        if (r < 0)
+                return r;
+
+        return r;
+}