mirror of
https://git.kernel.org/pub/scm/libs/libcap/libcap.git
synced 2026-01-26 15:39:08 +00:00
806b53d13a
Lorenz Bauer found a race condition in the cap.Launcher teardown process and reported it here: https://bugzilla.kernel.org/show_bug.cgi?id=215283 This seems to significantly improve the situation. I'm going to study the test case some more, but this is definitely part of the solution. Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
48 lines
1.2 KiB
Go
48 lines
1.2 KiB
Go
// Program b215283 requires privilege to execute and is a minimally adapted
|
|
// version of a test case provided by Lorenz Bauer as a reproducer for a
|
|
// problem he found and reported in:
|
|
//
|
|
// https://bugzilla.kernel.org/show_bug.cgi?id=215283
|
|
package main
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
|
|
"kernel.org/pub/linux/libs/security/libcap/cap"
|
|
)
|
|
|
|
func main() {
|
|
const secbits = cap.SecbitNoRoot | cap.SecbitNoSetUIDFixup
|
|
|
|
if v, err := cap.GetProc().GetFlag(cap.Permitted, cap.SETPCAP); err != nil {
|
|
panic(fmt.Sprintf("failed to get flag value: %v", err))
|
|
os.Exit(1)
|
|
} else if !v {
|
|
fmt.Printf("test requires cap_setpcap: found %q\n", cap.GetProc())
|
|
os.Exit(1)
|
|
}
|
|
if bits := cap.GetSecbits(); bits != 0 {
|
|
fmt.Printf("test expects secbits=0 to run; found: 0%o\n", bits)
|
|
os.Exit(1)
|
|
}
|
|
|
|
fmt.Println("secbits:", cap.GetSecbits(), " caps:", cap.GetProc())
|
|
|
|
l := cap.FuncLauncher(func(interface{}) error {
|
|
return cap.NewSet().SetProc()
|
|
})
|
|
|
|
if _, err := l.Launch(nil); err != nil {
|
|
fmt.Printf("launch failed: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
fmt.Println("secbits:", cap.GetSecbits(), " caps:", cap.GetProc())
|
|
|
|
if err := secbits.Set(); err != nil {
|
|
fmt.Printf("set securebits: %v", err.Error())
|
|
os.Exit(1)
|
|
}
|
|
}
|