picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #6672 from yuwata/drop-priv 

use !! prefix in networkd and timesyncd
This commit is contained in:
Lennart Poettering 2017-08-30 10:45:24 +02:00 committed by GitHub
parent 73e669e0fd 5ed0dcf4d5
commit 6d405b6909
8 changed files with 54 additions and 30 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
man/systemd-timesyncd.service.xml
View File

@ -88,7 +88,7 @@
<variablelist>
<varlistentry>
<term><filename>/var/lib/systemd/clock</filename></term>
<term><filename>/var/lib/systemd/timesync/clock</filename></term>
<listitem>
<para>This file contains the timestamp of the last successful

18
src/network/networkd.c
View File

@ -70,13 +70,17 @@ int main(int argc, char *argv[]) {
if (r < 0)
log_warning_errno(r, "Could not create runtime directory 'lldp': %m");
r = drop_privileges(uid, gid,
(1ULL << CAP_NET_ADMIN) |
(1ULL << CAP_NET_BIND_SERVICE) |
(1ULL << CAP_NET_BROADCAST) |
(1ULL << CAP_NET_RAW));
if (r < 0)
goto out;
/* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
* privileges are already dropped. */
if (geteuid() == 0) {
r = drop_privileges(uid, gid,
(1ULL << CAP_NET_ADMIN) |
(1ULL << CAP_NET_BIND_SERVICE) |
(1ULL << CAP_NET_BROADCAST) |
(1ULL << CAP_NET_RAW));
if (r < 0)
goto out;
}
assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);

2
src/timesync/timesyncd-manager.c
View File

@ -373,7 +373,7 @@ static int manager_adjust_clock(Manager *m, double offset, int leap_sec) {
return -errno;
/* If touch fails, there isn't much we can do. Maybe it'll work next time. */
(void) touch("/var/lib/systemd/clock");
(void) touch("/var/lib/systemd/timesync/clock");
m->drift_ppm = tmx.freq / 65536;

37
src/timesync/timesyncd.c
View File

@ -24,6 +24,7 @@
#include "clock-util.h"
#include "fd-util.h"
#include "fs-util.h"
#include "mkdir.h"
#include "network-util.h"
#include "process-util.h"
#include "signal-util.h"
@ -44,7 +45,7 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) {
* systems lacking a battery backed RTC. We also will adjust
* the time to at least the build time of systemd. */
fd = open("/var/lib/systemd/clock", O_RDWR|O_CLOEXEC, 0644);
fd = open("/var/lib/systemd/timesync/clock", O_RDWR|O_CLOEXEC, 0644);
if (fd >= 0) {
struct stat st;
usec_t stamp;
@ -57,14 +58,24 @@ static int load_clock_timestamp(uid_t uid, gid_t gid) {
min = stamp;
}
/* Try to fix the access mode, so that we can still
touch the file after dropping priviliges */
(void) fchmod(fd, 0644);
(void) fchown(fd, uid, gid);
if (geteuid() == 0) {
/* Try to fix the access mode, so that we can still
touch the file after dropping priviliges */
r = fchmod(fd, 0644);
if (r < 0)
return log_error_errno(errno, "Failed to change file access mode: %m");
r = fchown(fd, uid, gid);
return log_error_errno(errno, "Failed to change file owner: %m");
}
} else {
r = mkdir_safe_label("/var/lib/systemd/timesync", 0755, uid, gid);
if (r < 0)
return log_error_errno(r, "Failed to create state directory: %m");
} else
/* create stamp file with the compiled-in date */
(void) touch_file("/var/lib/systemd/clock", true, min, uid, gid, 0644);
(void) touch_file("/var/lib/systemd/timesync/clock", false, min, uid, gid, 0644);
}
ct = now(CLOCK_REALTIME);
if (ct < min) {
@ -111,9 +122,13 @@ int main(int argc, char *argv[]) {
if (r < 0)
goto finish;
r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME));
if (r < 0)
goto finish;
/* Drop privileges, but only if we have been started as root. If we are not running as root we assume all
* privileges are already dropped. */
if (geteuid() == 0) {
r = drop_privileges(uid, gid, (1ULL << CAP_SYS_TIME));
if (r < 0)
goto finish;
}
assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
@ -158,7 +173,7 @@ int main(int argc, char *argv[]) {
/* if we got an authoritative time, store it in the file system */
if (m->sync)
(void) touch("/var/lib/systemd/clock");
(void) touch("/var/lib/systemd/timesync/clock");
sd_event_get_exit_code(m->event, &r);

2
test/networkd-test.py
View File

@ -752,7 +752,7 @@ DNS=192.168.5.1
EOF
# run networkd as in systemd-networkd.service
exec $(systemctl cat systemd-networkd.service | sed -n '/^ExecStart=/ { s/^.*=//; p}')
exec $(systemctl cat systemd-networkd.service | sed -n '/^ExecStart=/ { s/^.*=//; s/^[@+-]//; s/^!*//; p}')
''' % {'ifr': self.if_router, 'ifc': self.iface, 'addr6': ipv6 and 'Address=2600::1/64' or '',
'dhopts': dhcpserver_opts or ''})

2
test/test-functions
View File

@ -426,7 +426,7 @@ install_execs() {
systemduserunitdir=$(pkg-config --variable=systemduserunitdir systemd)
egrep -ho '^Exec[^ ]*=[^ ]+' $initdir/{$systemdsystemunitdir,$systemduserunitdir}/*.service \
| while read i; do
i=${i##Exec*=}; i=${i##-}
i=${i##Exec*=}; i=${i##[@+\!-]}; i=${i##\!}
# some {rc,halt}.local scripts and programs are okay to not exist, the rest should
inst $i || [ "${i%.local}" != "$i" ] || [ "${i%systemd-update-done}" != "$i" ]
done

9
units/systemd-networkd.service.in
View File

@ -20,9 +20,11 @@ Wants=network.target
Type=notify
Restart=on-failure
RestartSec=0
ExecStart=@rootlibexecdir@/systemd-networkd
ExecStart=!!@rootlibexecdir@/systemd-networkd
WatchdogSec=3min
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
User=systemd-network
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW
ProtectSystem=strict
ProtectHome=yes
ProtectControlGroups=yes
@ -32,7 +34,8 @@ RestrictRealtime=yes
RestrictAddressFamilies=AF_UNIX AF_NETLINK AF_INET AF_INET6 AF_PACKET
SystemCallFilter=~@clock @cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
ReadWritePaths=/run/systemd
RuntimeDirectory=systemd/netif
RuntimeDirectoryPreserve=yes
[Install]
WantedBy=multi-user.target

12
units/systemd-timesyncd.service.in
View File

@ -11,8 +11,8 @@ Documentation=man:systemd-timesyncd.service(8)
ConditionCapability=CAP_SYS_TIME
ConditionVirtualization=!container
DefaultDependencies=no
RequiresMountsFor=/var/lib/systemd/clock
After=systemd-remount-fs.service systemd-tmpfiles-setup.service systemd-sysusers.service
RequiresMountsFor=/var/lib/systemd/timesync/clock
After=systemd-remount-fs.service systemd-sysusers.service
Before=time-sync.target sysinit.target shutdown.target
Conflicts=shutdown.target
Wants=time-sync.target
@ -21,9 +21,11 @@ Wants=time-sync.target
Type=notify
Restart=always
RestartSec=0
ExecStart=@rootlibexecdir@/systemd-timesyncd
ExecStart=!!@rootlibexecdir@/systemd-timesyncd
WatchdogSec=3min
CapabilityBoundingSet=CAP_SYS_TIME CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
User=systemd-timesync
CapabilityBoundingSet=CAP_SYS_TIME
AmbientCapabilities=CAP_SYS_TIME
PrivateTmp=yes
PrivateDevices=yes
ProtectSystem=strict
@ -37,7 +39,7 @@ RestrictNamespaces=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
SystemCallFilter=~@cpu-emulation @debug @keyring @module @mount @obsolete @raw-io @reboot @swap
SystemCallArchitectures=native
ReadWritePaths=/var/lib/systemd
StateDirectory=systemd/timesync
[Install]
WantedBy=sysinit.target