Pi-Hole/dnsmasq
1
0
Fork 0
mirror of https://github.com/pi-hole/dnsmasq.git synced 2025-12-20 02:38:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Keep suitable capabilities if we may bind server sockets to interface or port.

Browse Source
This commit is contained in:
Simon Kelley
2019-09-14 21:13:03 +01:00
parent e24abf28a2
commit 90d7c6b97d
1 changed files with 26 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
src/dnsmasq.c
View File

@@ -57,6 +57,7 @@ int main (int argc, char **argv)
int need_cap_net_bind_service = 0; int need_cap_net_bind_service = 0;
char *bound_device = NULL; char *bound_device = NULL;
int did_bind = 0; int did_bind = 0;
struct server *serv;
#endif #endif
#if defined(HAVE_DHCP) || defined(HAVE_DHCP6) #if defined(HAVE_DHCP) || defined(HAVE_DHCP6)
struct dhcp_context *context; struct dhcp_context *context;
@@ -474,12 +475,35 @@ int main (int argc, char **argv)
/* We keep CAP_NETADMIN (for ARP-injection) and /* We keep CAP_NETADMIN (for ARP-injection) and
CAP_NET_RAW (for icmp) if we're doing dhcp, CAP_NET_RAW (for icmp) if we're doing dhcp,
if we have yet to bind ports because of DAD, if we have yet to bind ports because of DAD,
or we're doing it dynamically, or we're doing it dynamically, we need CAP_NET_BIND_SERVICE. */
we need CAP_NET_BIND_SERVICE. */
if ((is_dad_listeners() || option_bool(OPT_CLEVERBIND)) && if ((is_dad_listeners() || option_bool(OPT_CLEVERBIND)) &&
(option_bool(OPT_TFTP) || (daemon->port != 0 && daemon->port <= 1024))) (option_bool(OPT_TFTP) || (daemon->port != 0 && daemon->port <= 1024)))
need_cap_net_bind_service = 1; need_cap_net_bind_service = 1;
/* usptream servers which bind to an interface call SO_BINDTODEVICE
for each TCP connection, so need CAP_NET_ADMIN */
for (serv = daemon->servers; serv; serv = serv->next)
if (serv->interface[0] != 0)
need_cap_net_admin = 1;
/* If we're doing Dbus or UBus, the above can be set dynamically,
(as can ports) so always (potentially) needed. */
#ifdef HAVE_DBUS
if (option_bool(OPT_DBUS))
{
need_cap_net_bind_service = 1;
need_cap_net_admin = 1;
}
#endif
#ifdef HAVE_UBUS
if (option_bool(OPT_UBUS))
{
need_cap_net_bind_service = 1;
need_cap_net_admin = 1;
}
#endif
/* determine capability API version here, while we can still /* determine capability API version here, while we can still
call safe_malloc */ call safe_malloc */
int capsize = 1; /* for header version 1 */ int capsize = 1; /* for header version 1 */