Add drop_privileges() for Linux

Implement an aggressive version of drop_privileges(). Additionally add
similar initialization function for threads drop_worker_privileges().

This version is similar to Solaris one and prohibits memcached from
making any not approved syscalls. Current list narrows down the allowed
calls to socket sends/recvs, accept, epoll handling, futex (and
dependencies - mmap), getrusage (for stats), and signal / exit
handling.

Any incorrect behaviour will result in EACCES returned. This should be
restricted further to KILL in the future (after more testing).

The feature is only tested for i386 and x86_64. It depends on bpf
filters and seccomp enabled in the kernel. It also requires libsecomp
for abstraction to seccomp filters. All are available since Linux 3.5.

Seccomp filtering can be enabled at compile time with --enable-seccomp.

In case of local customisations which require more rights, memcached
allows disabling drop_privileges() with "-o no_drop_privileges" at
startup.

Tests have to run with "-o relaxed_privileges", since they require
disk access after the tests complete. This adds a few allowed syscalls,
but does not disable the protection system completely.

1 files changed, 4 insertions, 0 deletions

diff --git a/testapp.c b/testapp.c
index 7e3fe0e..ea8081b 100644
--- a/testapp.c
+++ b/testapp.c
@@ -352,6 +352,10 @@ static pid_t start_server(in_port_t *port_out, bool daemon, int timeout) {
 #ifdef MESSAGE_DEBUG
          argv[arg++] = "-vvv";
 #endif
+#ifdef HAVE_DROP_PRIVILEGES
+        argv[arg++] = "-o";
+        argv[arg++] = "relaxed_privileges";
+#endif
         argv[arg++] = NULL;
         assert(execv(argv[0], argv) != -1);
     }