diff options
| author | Lennart Poettering <lennart@poettering.net> | 2014-06-01 09:12:00 +0200 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2014-06-01 09:12:00 +0200 |
| commit | d3cf48f4bd3d69a276f17aa7c910e0b35215caba (patch) | |
| tree | dc25842b40016380d9efa24afe7e7aa56d68ce02 | |
| parent | 40393d5247c4cd28625fdccbc2b78f3406d44c45 (diff) | |
| download | systemd-d3cf48f4bd3d69a276f17aa7c910e0b35215caba.tar.gz | |
networkd: run as unpriviliged "systemd-network" user
This allows us to run networkd mostly unpriviliged with the exception of
CAP_NET_* and CAP_SYS_MODULE. I'd really like to get rid of the latter
though...
| -rw-r--r-- | Makefile.am | 1 | ||||
| -rw-r--r-- | src/network/networkd.c | 25 | ||||
| -rw-r--r-- | units/systemd-networkd.service.in | 2 |
3 files changed, 24 insertions, 4 deletions
diff --git a/Makefile.am b/Makefile.am index f66ef4275b..5158bbc776 100644 --- a/Makefile.am +++ b/Makefile.am @@ -4253,6 +4253,7 @@ systemd_networkd_SOURCES = \ systemd_networkd_LDADD = \ libsystemd-networkd-core.la \ + libsystemd-capability.la \ $(KMOD_LIBS) noinst_LTLIBRARIES += \ diff --git a/src/network/networkd.c b/src/network/networkd.c index 6985dcaa4a..cd7dd3ca0f 100644 --- a/src/network/networkd.c +++ b/src/network/networkd.c @@ -19,6 +19,7 @@ along with systemd; If not, see <http://www.gnu.org/licenses/>. ***/ +#include "capability.h" #include "sd-event.h" #include "sd-daemon.h" @@ -26,6 +27,9 @@ int main(int argc, char *argv[]) { _cleanup_manager_free_ Manager *m = NULL; + const char *user = "systemd-network"; + uid_t uid; + gid_t gid; int r; log_set_target(LOG_TARGET_AUTO); @@ -40,23 +44,38 @@ int main(int argc, char *argv[]) { goto out; } + r = get_user_creds(&user, &uid, &gid, NULL, NULL); + if (r < 0) { + log_error("Cannot resolve user name %s: %s", user, strerror(-r)); + goto out; + } + /* Always create the directories people can create inotify * watches in. */ - r = mkdir_label("/run/systemd/network", 0755); + r = mkdir_safe_label("/run/systemd/network", 0755, uid, gid); if (r < 0) log_error("Could not create runtime directory: %s", strerror(-r)); - r = mkdir_label("/run/systemd/network/links", 0755); + r = mkdir_safe_label("/run/systemd/network/links", 0755, uid, gid); if (r < 0) log_error("Could not create runtime directory 'links': %s", strerror(-r)); - r = mkdir_label("/run/systemd/network/leases", 0755); + r = mkdir_safe_label("/run/systemd/network/leases", 0755, uid, gid); if (r < 0) log_error("Could not create runtime directory 'leases': %s", strerror(-r)); + r = drop_privileges(uid, gid, + (1ULL << CAP_NET_ADMIN) | + (1ULL << CAP_NET_BIND_SERVICE) | + (1ULL << CAP_NET_BROADCAST) | + (1ULL << CAP_NET_RAW) | + (1ULL << CAP_SYS_MODULE)); + if (r < 0) + goto out; + r = manager_new(&m); if (r < 0) { log_error("Could not create manager: %s", strerror(-r)); diff --git a/units/systemd-networkd.service.in b/units/systemd-networkd.service.in index 40ec90ef85..33c3fca488 100644 --- a/units/systemd-networkd.service.in +++ b/units/systemd-networkd.service.in @@ -19,7 +19,7 @@ Type=notify Restart=always RestartSec=0 ExecStart=@rootlibexecdir@/systemd-networkd -CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_MODULE +CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_MODULE CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER WatchdogSec=1min [Install] |