From 03ee5e2b445becf823dc4dd3db1599849e8c6c06 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Thu, 23 Sep 2004 15:47:11 +0000 Subject: add support for capabilities git-svn-id: file:///home/lennart/svn/public/pulseaudio/trunk@233 fefdeb5f-60dc-0310-8127-8f9354f1896f --- configure.ac | 5 +++ doc/modules.html.in | 4 +- polyp/Makefile.am | 7 ++-- polyp/caps.c | 106 +++++++++++++++++++++++++++++++++++++++++++++++++++ polyp/caps.h | 29 ++++++++++++++ polyp/main.c | 13 ++----- polyp/polyplib-def.h | 3 ++ polyp/tagstruct.h | 2 + polyp/util.c | 5 +++ polyp/util.h | 1 + 10 files changed, 161 insertions(+), 14 deletions(-) create mode 100644 polyp/caps.c create mode 100644 polyp/caps.h diff --git a/configure.ac b/configure.ac index e74cc64b..5e63d1e0 100644 --- a/configure.ac +++ b/configure.ac @@ -78,6 +78,11 @@ AC_HEADER_SYS_WAIT AC_C_BIGENDIAN +AC_CHECK_LIB(cap, cap_init, [CAP_LIBS='-lcap'], [CAP_LIBS='']) +AC_SUBST(CAP_LIBS) + +AC_CHECK_HEADERS(sys/capability.h) + PKG_CHECK_MODULES(LIBSAMPLERATE, [ samplerate >= 0.1.0 ]) AC_SUBST(LIBSAMPLERATE_CFLAGS) AC_SUBST(LIBSAMPLERATE_LIBS) diff --git a/doc/modules.html.in b/doc/modules.html.in index 6967b2a1..00fe3388 100644 --- a/doc/modules.html.in +++ b/doc/modules.html.in @@ -106,8 +106,8 @@ resampling required for this may be very CPU intensive.

sink_name=The name for the combined sink. (defaults to combined) master=The name of the first sink to link into the combined think. The sample rate/type is taken from this sink. slaves=Name of additional sinks to link into the combined think, seperated by commas. - adjust_time=Time in seconds when to readjust the sample rate of all sinks. (defaults to 20) - resample_method=Resampling algorithm to + adjust_time=Time in seconds when to readjust the sample rate of all sinks. (defaults to 20) + resample_method=Resampling algorithm to use. See libsamplerate's documentation for more information. Use one of sinc-best-quality, sinc-medium-quality, sinc-fastest, diff --git a/polyp/Makefile.am b/polyp/Makefile.am index af324dd3..e52d9ab8 100644 --- a/polyp/Makefile.am +++ b/polyp/Makefile.am @@ -22,7 +22,7 @@ polypconfdir=$(sysconfdir)/polypaudio modlibdir=$(libdir)/polypaudio-@PA_MAJORMINOR@ -AM_CFLAGS=-D_GNU_SOURCE -I$(top_srcdir) $(PTHREAD_CFLAGS) +AM_CFLAGS=-D_GNU_SOURCE -I$(top_srcdir) $(PTHREAD_CFLAGS) AM_CFLAGS+=-DDLSEARCHPATH=\"$(modlibdir)\" AM_CFLAGS+=-DDEFAULT_SCRIPT_FILE=\"$(polypconfdir)/default.pa\" AM_CFLAGS+=-DDEFAULT_CONFIG_FILE=\"$(polypconfdir)/daemon.conf\" @@ -161,11 +161,12 @@ polypaudio_SOURCES = idxset.c idxset.h \ modinfo.c modinfo.h \ daemon-conf.c daemon-conf.h \ dumpmodules.c dumpmodules.h \ - conf-parser.h conf-parser.c + conf-parser.h conf-parser.c \ + caps.h caps.c polypaudio_CFLAGS = $(AM_CFLAGS) $(LIBSAMPLERATE_CFLAGS) $(LIBSNDFILE_CFLAGS) polypaudio_INCLUDES = $(INCLTDL) -polypaudio_LDADD = $(AM_LDADD) $(LIBLTDL) $(LIBSAMPLERATE_LIBS) $(LIBSNDFILE_LIBS) $(LEXLIB) +polypaudio_LDADD = $(AM_LDADD) $(LIBLTDL) $(LIBSAMPLERATE_LIBS) $(LIBSNDFILE_LIBS) $(CAP_LIBS) polypaudio_LDFLAGS=-export-dynamic libprotocol_simple_la_SOURCES = protocol-simple.c protocol-simple.h diff --git a/polyp/caps.c b/polyp/caps.c new file mode 100644 index 00000000..db00c604 --- /dev/null +++ b/polyp/caps.c @@ -0,0 +1,106 @@ +/* $Id$ */ + +/*** + This file is part of polypaudio. + + polypaudio is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published + by the Free Software Foundation; either version 2 of the License, + or (at your option) any later version. + + polypaudio is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with polypaudio; if not, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 + USA. +***/ + +#ifdef HAVE_CONFIG_H +#include +#endif + +#include +#include +#include +#include + +#ifdef HAVE_SYS_CAPABILITY_H +#include +#endif + +#include "log.h" +#include "caps.h" + +void pa_drop_root(void) { + if (getuid() != 0 && geteuid() == 0) { + pa_log(__FILE__": Started SUID root, dropping root rights.\n"); + setuid(getuid()); + seteuid(getuid()); + } +} + +#ifdef HAVE_SYS_CAPABILITY_H +int pa_limit_caps(void) { + int r = -1; + cap_t caps; + cap_value_t nice_cap = CAP_SYS_NICE; + + caps = cap_init(); + assert(caps); + + cap_clear(caps); + cap_set_flag(caps, CAP_EFFECTIVE, 1, &nice_cap, CAP_SET); + cap_set_flag(caps, CAP_PERMITTED, 1, &nice_cap, CAP_SET); + + if (cap_set_proc(caps) < 0) + goto fail; + + pa_log(__FILE__": Started SUID root, capabilities limited.\n"); + + r = 0; + +fail: + cap_free (caps); + + return r; +} + +int pa_drop_caps(void) { + cap_t caps; + int r = -1; + + caps = cap_init(); + assert(caps); + + cap_clear(caps); + + if (cap_set_proc(caps) < 0) + goto fail; + + pa_drop_root(); + + r = 0; + +fail: + cap_free (caps); + + return r; +} + +#else + +int pa_limit_caps(void) { + return 0; +} + +int pa_drop_caps(void) { + pa_drop_root(); + return 0; +} + +#endif + diff --git a/polyp/caps.h b/polyp/caps.h new file mode 100644 index 00000000..473462fb --- /dev/null +++ b/polyp/caps.h @@ -0,0 +1,29 @@ +#ifndef foocapshfoo +#define foocapshfoo + +/* $Id$ */ + +/*** + This file is part of polypaudio. + + polypaudio is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published + by the Free Software Foundation; either version 2 of the License, + or (at your option) any later version. + + polypaudio is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + General Public License for more details. + + You should have received a copy of the GNU General Public License + along with polypaudio; if not, write to the Free Software + Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 + USA. +***/ + +void pa_drop_root(void); +int pa_limit_caps(void); +int pa_drop_caps(void); + +#endif diff --git a/polyp/main.c b/polyp/main.c index dfbd1e4b..2a45ad37 100644 --- a/polyp/main.c +++ b/polyp/main.c @@ -47,17 +47,10 @@ #include "log.h" #include "daemon-conf.h" #include "dumpmodules.h" +#include "caps.h" static struct pa_mainloop *mainloop; -static void drop_root(void) { - if (getuid() != 0 && geteuid() == 0) { - pa_log(__FILE__": Started SUID root, dropping root rights.\n"); - setuid(getuid()); - seteuid(getuid()); - } -} - static void signal_callback(struct pa_mainloop_api*m, struct pa_signal_event *e, int sig, void *userdata) { pa_log(__FILE__": Got signal %s.\n", pa_strsignal(sig)); @@ -95,6 +88,8 @@ int main(int argc, char *argv[]) { int r, retval = 1, d = 0; int daemon_pipe[2] = { -1, -1 }; + pa_limit_caps(); + r = lt_dlinit(); assert(r == 0); @@ -118,7 +113,7 @@ int main(int argc, char *argv[]) { if (conf->high_priority && conf->cmd == PA_CMD_DAEMON) pa_raise_priority(); - drop_root(); + pa_drop_caps(); if (conf->dl_search_path) lt_dlsetsearchpath(conf->dl_search_path); diff --git a/polyp/polyplib-def.h b/polyp/polyplib-def.h index 591d237d..bab23e47 100644 --- a/polyp/polyplib-def.h +++ b/polyp/polyplib-def.h @@ -23,6 +23,9 @@ ***/ #include +#include +#include + #include "cdecl.h" #include "sample.h" diff --git a/polyp/tagstruct.h b/polyp/tagstruct.h index 02df74e4..e50551c4 100644 --- a/polyp/tagstruct.h +++ b/polyp/tagstruct.h @@ -24,6 +24,8 @@ #include #include +#include +#include #include "sample.h" diff --git a/polyp/util.c b/polyp/util.c index 9b74ee75..cc132dbb 100644 --- a/polyp/util.c +++ b/polyp/util.c @@ -40,6 +40,11 @@ #include #include #include +#include +#include +#include +#include + #include diff --git a/polyp/util.h b/polyp/util.h index c842a1c3..4a387cef 100644 --- a/polyp/util.h +++ b/polyp/util.h @@ -66,4 +66,5 @@ const char *pa_strsignal(int sig); int pa_parse_resample_method(const char *string); + #endif -- cgit