From: Marc Fournier Date: Tue, 17 May 2016 05:36:34 +0000 (+0200) Subject: check_capability: explicitly target recent linux implementations X-Git-Tag: collectd-5.6.0~57^2~4 X-Git-Url: https://git.tokkee.org/?a=commitdiff_plain;h=448627953c;p=collectd.git check_capability: explicitly target recent linux implementations There are several, incompatible, capabilities implementations, all exposed through ``. Currently only Linux's V3 function and capability sets are supported. This patch guards against using Linux-specific functions & capabilities on other implementations, while structring the code to allow adding support for them. --- diff --git a/src/ceph.c b/src/ceph.c index e9bb960d..8cda764f 100644 --- a/src/ceph.c +++ b/src/ceph.c @@ -1577,7 +1577,7 @@ static int ceph_init(void) { int ret; -#ifdef HAVE_SYS_CAPABILITY_H +#if defined(HAVE_SYS_CAPABILITY_H) && defined(CAP_DAC_OVERRIDE) if (check_capability (CAP_DAC_OVERRIDE) != 0) { if (getuid () == 0) diff --git a/src/daemon/common.c b/src/daemon/common.c index 3e2db15a..76561916 100644 --- a/src/daemon/common.c +++ b/src/daemon/common.c @@ -1676,6 +1676,7 @@ void strarray_free (char **array, size_t array_len) /* {{{ */ #ifdef HAVE_SYS_CAPABILITY_H int check_capability (int capability) /* {{{ */ { +#ifdef _LINUX_CAPABILITY_VERSION_3 struct __user_cap_header_struct cap_header_data; cap_user_header_t cap_header = &cap_header_data; struct __user_cap_data_struct cap_data_data; @@ -1693,5 +1694,10 @@ int check_capability (int capability) /* {{{ */ return (-1); else return (0); +#else + WARNING ("check_capability: unsupported capability implementation. " + "Some plugin(s) may require elevated privileges to work properly."); + return (0); +#endif /* _LINUX_CAPABILITY_VERSION_3 */ } /* }}} int check_capability */ -#endif +#endif /* HAVE_SYS_CAPABILITY_H */ diff --git a/src/dns.c b/src/dns.c index be6d0dcb..53128396 100644 --- a/src/dns.c +++ b/src/dns.c @@ -351,7 +351,7 @@ static int dns_init (void) listen_thread_init = 1; -#ifdef HAVE_SYS_CAPABILITY_H +#if defined(HAVE_SYS_CAPABILITY_H) && defined(CAP_NET_RAW) if (check_capability (CAP_NET_RAW) != 0) { if (getuid () == 0) diff --git a/src/exec.c b/src/exec.c index c51465b8..1a14293e 100644 --- a/src/exec.c +++ b/src/exec.c @@ -810,7 +810,7 @@ static int exec_init (void) /* {{{ */ sigaction (SIGCHLD, &sa, NULL); -#ifdef HAVE_SYS_CAPABILITY_H +#if defined(HAVE_SYS_CAPABILITY_H) && defined(CAP_SETUID) && defined(CAP_SETGID) if ((check_capability (CAP_SETUID) != 0) || (check_capability (CAP_SETGID) != 0)) { diff --git a/src/iptables.c b/src/iptables.c index 66dbab7f..c0854b3f 100644 --- a/src/iptables.c +++ b/src/iptables.c @@ -505,7 +505,7 @@ static int iptables_shutdown (void) static int iptables_init (void) { -#ifdef HAVE_SYS_CAPABILITY_H +#if defined(HAVE_SYS_CAPABILITY_H) && defined(CAP_NET_ADMIN) if (check_capability (CAP_NET_ADMIN) != 0) { if (getuid () == 0) diff --git a/src/ping.c b/src/ping.c index 9b5d5ca5..7b28ed37 100644 --- a/src/ping.c +++ b/src/ping.c @@ -452,7 +452,7 @@ static int ping_init (void) /* {{{ */ "Will use a timeout of %gs.", ping_timeout); } -#ifdef HAVE_SYS_CAPABILITY_H +#if defined(HAVE_SYS_CAPABILITY_H) && defined(CAP_NET_RAW) if (check_capability (CAP_NET_RAW) != 0) { if (getuid () == 0) diff --git a/src/turbostat.c b/src/turbostat.c index 6e0405d0..a1faac48 100644 --- a/src/turbostat.c +++ b/src/turbostat.c @@ -1480,13 +1480,13 @@ check_permissions(void) if (getuid() == 0) { /* We have everything we need */ return 0; -#ifndef HAVE_SYS_CAPABILITY_H +#if !defined(HAVE_SYS_CAPABILITY_H) && !defined(CAP_SYS_RAWIO) } else { ERROR("turbostat plugin: Initialization failed: this plugin " "requires collectd to run as root"); return -1; } -#else /* HAVE_SYS_CAPABILITY_H */ +#else /* HAVE_SYS_CAPABILITY_H && CAP_SYS_RAWIO */ } if (check_capability(CAP_SYS_RAWIO) != 0) { @@ -1511,7 +1511,7 @@ check_permissions(void) "collectd a special capability (CAP_SYS_RAWIO) and read " "access to /dev/cpu/*/msr (see previous warnings)"); return ret; -#endif /* HAVE_SYS_CAPABILITY_H */ +#endif /* HAVE_SYS_CAPABILITY_H && CAP_SYS_RAWIO */ } static int