diff options
| author | Roman Arutyunyan <arut@nginx.com> | 2017-12-19 19:00:27 +0300 |
|---|---|---|
| committer | Roman Arutyunyan <arut@nginx.com> | 2017-12-19 19:00:27 +0300 |
| commit | ce45ded2a8c1b0c0e601779bcc3e54668a14e271 (patch) | |
| tree | b800a8b63114b8ed561e3044f37cf8542c804954 | |
| parent | 0e92c213f51bae95605c19dfee843902e7c8a0ad (diff) | |
| download | nginx-ce45ded2a8c1b0c0e601779bcc3e54668a14e271.tar.gz nginx-ce45ded2a8c1b0c0e601779bcc3e54668a14e271.zip | |
Fixed capabilities version.
Previously, capset(2) was called with the 64-bit capabilities version
_LINUX_CAPABILITY_VERSION_3. With this version Linux kernel expected two
copies of struct __user_cap_data_struct, while only one was submitted. As a
result, random stack memory was accessed and random capabilities were requested
by the worker. This sometimes caused capset() errors. Now the 32-bit version
_LINUX_CAPABILITY_VERSION_1 is used instead. This is OK since CAP_NET_RAW is
a 32-bit capability (CAP_NET_RAW = 13).
| -rw-r--r-- | auto/os/linux | 2 | ||||
| -rw-r--r-- | src/os/unix/ngx_process_cycle.c | 2 |
2 files changed, 2 insertions, 2 deletions
diff --git a/auto/os/linux b/auto/os/linux index 135280f99..2c8a9bb8e 100644 --- a/auto/os/linux +++ b/auto/os/linux @@ -181,7 +181,7 @@ ngx_feature_libs= ngx_feature_test="struct __user_cap_data_struct data; struct __user_cap_header_struct header; - header.version = _LINUX_CAPABILITY_VERSION_3; + header.version = _LINUX_CAPABILITY_VERSION_1; data.effective = CAP_TO_MASK(CAP_NET_RAW); data.permitted = 0; diff --git a/src/os/unix/ngx_process_cycle.c b/src/os/unix/ngx_process_cycle.c index 9b0e0421e..5817a2c23 100644 --- a/src/os/unix/ngx_process_cycle.c +++ b/src/os/unix/ngx_process_cycle.c @@ -865,7 +865,7 @@ ngx_worker_process_init(ngx_cycle_t *cycle, ngx_int_t worker) ngx_memzero(&header, sizeof(struct __user_cap_header_struct)); ngx_memzero(&data, sizeof(struct __user_cap_data_struct)); - header.version = _LINUX_CAPABILITY_VERSION_3; + header.version = _LINUX_CAPABILITY_VERSION_1; data.effective = CAP_TO_MASK(CAP_NET_RAW); data.permitted = data.effective; |