dhcp: Require CAP_NET_BIND_SERVICE and CAP_NET_RAW to open/bind sockets
authorTobias Brunner <tobias@strongswan.org>
Tue, 25 Jun 2013 06:35:06 +0000 (08:35 +0200)
committerTobias Brunner <tobias@strongswan.org>
Tue, 25 Jun 2013 15:16:32 +0000 (17:16 +0200)
src/libcharon/plugins/dhcp/dhcp_plugin.c
src/libstrongswan/utils/capabilities.h

index a31f126..31195e2 100644 (file)
@@ -107,6 +107,17 @@ plugin_t *dhcp_plugin_create()
 {
        private_dhcp_plugin_t *this;
 
+       if (!lib->caps->keep(lib->caps, CAP_NET_BIND_SERVICE))
+       {       /* required to bind DHCP socket (port 68) */
+               DBG1(DBG_NET, "dhcp plugin requires CAP_NET_BIND_SERVICE capability");
+               return NULL;
+       }
+       else if (!lib->caps->keep(lib->caps, CAP_NET_RAW))
+       {       /* required to open DHCP receive socket (AF_PACKET) */
+               DBG1(DBG_NET, "dhcp plugin requires CAP_NET_RAW capability");
+               return NULL;
+       }
+
        INIT(this,
                .public = {
                        .plugin = {
index 543af32..3493757 100644 (file)
@@ -38,6 +38,9 @@ typedef struct capabilities_t capabilities_t;
 #ifndef CAP_NET_ADMIN
 # define CAP_NET_ADMIN 12
 #endif
+#ifndef CAP_NET_RAW
+# define CAP_NET_RAW 13
+#endif
 
 /**
  * POSIX capability dropping abstraction layer.