commit 128bdac94fe8173845e162c61ddb83cb4b8ed8de · pyrox.dev/nixpkgs

+22 -13
nixos/modules/security/wrappers/wrapper.c
···

       26
       26
        
       static char * sourceProg = SOURCE_PROG;

     

       27
       27
        
       static char * wrapperDir = WRAPPER_DIR;

     

       28
       28
        
       

     

       29
       29
       +
       // Wrapper debug variable name

     

       30
       30
       +
       static char * wrapperDebug = "WRAPPER_DEBUG";

     

       31
       31
       +
       

     

       29
       32
        
       // Update the capabilities of the running process to include the given

     

       30
       33
        
       // capability in the Ambient set.

     

       31
       34
        
       static void set_ambient_cap(cap_value_t cap)

     
···

       34
       37
        
       

     

       35
       38
        
           if (capng_update(CAPNG_ADD, CAPNG_INHERITABLE, (unsigned long) cap))

     

       36
       39
        
           {

     

       37
       37
       -
               printf("cannot raise the capability into the Inheritable set\n");

     

       40
       40
       +
               perror("cannot raise the capability into the Inheritable set\n");

     

       38
       41
        
               exit(1);

     

       39
       42
        
           }

     

       40
       43
        
       

     
···

       56
       59
        
       

     

       57
       60
        
           if(!caps)

     

       58
       61
        
           {

     

       59
       59
       -
               fprintf(stderr, "no caps set or could not retrieve the caps for this file, not doing anything...\n");

     

       62
       62
       +
               if(getenv(wrapperDebug))

     

       63
       63
       +
                   fprintf(stderr, "no caps set or could not retrieve the caps for this file, not doing anything...");

     

       64
       64
       +
       

     

       60
       65
        
               return 1;

     

       61
       66
        
           }

     

       62
       67
        
       

     
···

       127
       132
        
             cap_value_t capnum;

     

       128
       133
        
             if (cap_from_name(tok, &capnum))

     

       129
       134
        
             {

     

       130
       130
       -
                 fprintf(stderr, "cap_from_name failed, skipping: %s\n", tok);

     

       135
       135
       +
                 if(getenv(wrapperDebug))

     

       136
       136
       +
                     fprintf(stderr, "cap_from_name failed, skipping: %s", tok);

     

       131
       137
        
             }

     

       132
       138
        
             else if (capnum == CAP_SETPCAP)

     

       133
       139
        
             {

     

       134
       134
       -
               // Check for the cap_setpcap capability, we set this on the

     

       135
       135
       -
               // wrapper so it can elevate the capabilities to the Ambient

     

       136
       136
       -
               // set but we do not want to propagate it down into the

     

       137
       137
       -
               // wrapped program.

     

       138
       138
       -
               //

     

       139
       139
       -
               // TODO: what happens if that's the behavior you want

     

       140
       140
       -
               // though???? I'm preferring a strict vs. loose policy here.

     

       141
       141
       -
               fprintf(stderr, "cap_setpcap in set, skipping it\n");

     

       140
       140
       +
                 // Check for the cap_setpcap capability, we set this on the

     

       141
       141
       +
                 // wrapper so it can elevate the capabilities to the Ambient

     

       142
       142
       +
                 // set but we do not want to propagate it down into the

     

       143
       143
       +
                 // wrapped program.

     

       144
       144
       +
                 //

     

       145
       145
       +
                 // TODO: what happens if that's the behavior you want

     

       146
       146
       +
                 // though???? I'm preferring a strict vs. loose policy here.

     

       147
       147
       +
                 if(getenv(wrapperDebug))

     

       148
       148
       +
                     fprintf(stderr, "cap_setpcap in set, skipping it\n");

     

       142
       149
        
             }

     

       143
       150
        
             else

     

       144
       151
        
             {

     

       145
       145
       -
               set_ambient_cap(capnum);

     

       146
       146
       -
               printf("raised %s into the Ambient capability set\n", tok);

     

       152
       152
       +
                 set_ambient_cap(capnum);

     

       153
       153
       +
       

     

       154
       154
       +
                 if(getenv(wrapperDebug))

     

       155
       155
       +
                     fprintf(stderr, "raised %s into the Ambient capability set\n", tok);

     

       147
       156
        
             }

     

       148
       157
        
           }

     

       149
       158
        
           cap_free(capstr);