openharmony/startup_init
1
0
Fork 0
mirror of https://gitee.com/openharmony/startup_init synced 2024-11-23 16:20:00 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

修改服务进程Capability权限过大问题

Browse Source 
Signed-off-by: zhongning5 <zhongning5@huawei.com>
This commit is contained in:
zhongning5 2024-06-26 17:37:19 +08:00
parent f34701b366
commit cf034618fc
1 changed files with 51 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

63
services/init/init_common_service.c
View File

@ -22,6 +22,7 @@
#ifdef __MUSL__
#include <stropts.h>
#endif
#include <sys/prctl.h>
#include <sys/capability.h>
#include <sys/ioctl.h>
#include <sys/param.h>
@ -178,25 +179,65 @@ static int ServiceSetGid(const Service *service)
return SERVICE_SUCCESS;
}
static void GetInvalidCaps(const Service *service, unsigned int *caps)
{
int index = 0;
bool flags = false;
for (unsigned int cap = 0; cap <= CAP_LAST_CAP; cap++) {
for (unsigned int i = 0; i < service->servPerm.capsCnt; ++i) {
if (cap == service->servPerm.caps[i]) {
flags = true;
break;
}
flags = false;
}
if (!flags) {
caps[index] = cap;
index++;
}
}
}
static void DropCapability(const Service *service)
{
#if ((defined __LINUX__) || (!defined OHOS_LITE))
int invalidCnt = CAP_LAST_CAP - service->servPerm.capsCnt + 1;
unsigned int *caps = (unsigned int *)malloc(sizeof(unsigned int) * invalidCnt);
INIT_ERROR_CHECK(caps != NULL, return, "malloc caps failed! error:%d", errno);
GetInvalidCaps(service, caps);
for (int i = 0; i < invalidCnt; i++) {
if (prctl(PR_CAPBSET_DROP, caps[i])) {
INIT_LOGE("prctl PR_SET_SECUREBITS failed: %d", errno);
free(caps);
return;
}
}
free(caps);
#else
return;
#endif
}
static int SetPerms(const Service *service)
{
INIT_ERROR_CHECK(KeepCapability() == 0,
return INIT_EKEEPCAP,
INIT_ERROR_CHECK(KeepCapability() == 0, return INIT_EKEEPCAP,
"Service error %d %s, failed to set keep capability.", errno, service->name);
INIT_ERROR_CHECK(ServiceSetGid(service) == SERVICE_SUCCESS,
return INIT_EGIDSET,
INIT_ERROR_CHECK(ServiceSetGid(service) == SERVICE_SUCCESS, return INIT_EGIDSET,
"Service error %d %s, failed to set gid.", errno, service->name);
// set seccomp policy before setuid
INIT_ERROR_CHECK(SetSystemSeccompPolicy(service) == SERVICE_SUCCESS,
return INIT_ESECCOMP,
INIT_ERROR_CHECK(SetSystemSeccompPolicy(service) == SERVICE_SUCCESS, return INIT_ESECCOMP,
"Service error %d %s, failed to set system seccomp policy.", errno, service->name);
if (service->servPerm.uID != 0) {
INIT_ERROR_CHECK(setuid(service->servPerm.uID) == 0,
return INIT_EUIDSET,
INIT_ERROR_CHECK(setuid(service->servPerm.uID) == 0, return INIT_EUIDSET,
"Service error %d %s, failed to set uid.", errno, service->name);
} else {
if (service->servPerm.capsCnt != 0) {
DropCapability(service);
}
}
struct __user_cap_header_struct capHeader;
@ -222,13 +263,11 @@ static int SetPerms(const Service *service)
for (unsigned int i = 0; i < service->servPerm.capsCnt; ++i) {
if (service->servPerm.caps[i] == FULL_CAP) {
int ret = SetAllAmbientCapability();
INIT_ERROR_CHECK(ret == 0,
return INIT_ECAP,
INIT_ERROR_CHECK(ret == 0, return INIT_ECAP,
"Service error %d %s, failed to set ambient capability.", errno, service->name);
return 0;
}
INIT_ERROR_CHECK(SetAmbientCapability(service->servPerm.caps[i]) == 0,
return INIT_ECAP,
INIT_ERROR_CHECK(SetAmbientCapability(service->servPerm.caps[i]) == 0, return INIT_ECAP,
"Service error %d %s, failed to set ambient capability.", errno, service->name);
}
#ifndef OHOS_LITE