picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

networkd: run as unpriviliged "systemd-network" user 

This allows us to run networkd mostly unpriviliged with the exception of
CAP_NET_* and CAP_SYS_MODULE. I'd really like to get rid of the latter
though...
This commit is contained in:
Lennart Poettering 2014-06-01 09:12:00 +02:00
parent 40393d5247
commit d3cf48f4bd
3 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
Makefile.am
View File

@ -4253,6 +4253,7 @@ systemd_networkd_SOURCES = \
systemd_networkd_LDADD = \
libsystemd-networkd-core.la \
libsystemd-capability.la \
$(KMOD_LIBS)
noinst_LTLIBRARIES += \

25
src/network/networkd.c
View File

@ -19,6 +19,7 @@
along with systemd; If not, see <http://www.gnu.org/licenses/>.
***/
#include "capability.h"
#include "sd-event.h"
#include "sd-daemon.h"
@ -26,6 +27,9 @@
int main(int argc, char *argv[]) {
_cleanup_manager_free_ Manager *m = NULL;
const char *user = "systemd-network";
uid_t uid;
gid_t gid;
int r;
log_set_target(LOG_TARGET_AUTO);
@ -40,23 +44,38 @@ int main(int argc, char *argv[]) {
goto out;
}
r = get_user_creds(&user, &uid, &gid, NULL, NULL);
if (r < 0) {
log_error("Cannot resolve user name %s: %s", user, strerror(-r));
goto out;
}
/* Always create the directories people can create inotify
* watches in. */
r = mkdir_label("/run/systemd/network", 0755);
r = mkdir_safe_label("/run/systemd/network", 0755, uid, gid);
if (r < 0)
log_error("Could not create runtime directory: %s",
strerror(-r));
r = mkdir_label("/run/systemd/network/links", 0755);
r = mkdir_safe_label("/run/systemd/network/links", 0755, uid, gid);
if (r < 0)
log_error("Could not create runtime directory 'links': %s",
strerror(-r));
r = mkdir_label("/run/systemd/network/leases", 0755);
r = mkdir_safe_label("/run/systemd/network/leases", 0755, uid, gid);
if (r < 0)
log_error("Could not create runtime directory 'leases': %s",
strerror(-r));
r = drop_privileges(uid, gid,
(1ULL << CAP_NET_ADMIN) |
(1ULL << CAP_NET_BIND_SERVICE) |
(1ULL << CAP_NET_BROADCAST) |
(1ULL << CAP_NET_RAW) |
(1ULL << CAP_SYS_MODULE));
if (r < 0)
goto out;
r = manager_new(&m);
if (r < 0) {
log_error("Could not create manager: %s", strerror(-r));

2
units/systemd-networkd.service.in
View File

@ -19,7 +19,7 @@ Type=notify
Restart=always
RestartSec=0
ExecStart=@rootlibexecdir@/systemd-networkd
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_MODULE
CapabilityBoundingSet=CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW CAP_SYS_MODULE CAP_SETUID CAP_SETGID CAP_SETPCAP CAP_CHOWN CAP_DAC_OVERRIDE CAP_FOWNER
WatchdogSec=1min
[Install]