mirror/haproxy
1
0
Fork 0
mirror of http://git.haproxy.org/git/haproxy.git synced 2026-02-15 08:52:09 +02:00
Code Issues Packages Projects Releases Wiki Activity

MINOR: capabilities: export capget and __user_cap_header_struct

Browse Source 
To be able to show process capabilities before applying its configuration and
also at runtime in 'show dev' command output, we need to export the wrapper
around capget() syscall. It also seems more handy to place
__user_cap_header_struct in .data section and declare it as globally
accessible, as we always fill it with the same values. This avoids allocate
and fill these 8 bytes each time on the stack frame, when capget() or capset()
wrappers are called.
This commit is contained in:
Valentine Krasnobaeva
2024-05-31 18:01:07 +02:00
committed by Willy Tarreau
parent a14c7d194a
commit fcf1a0bcf5
2 changed files with 28 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
include/haproxy/linuxcap.h
View File

@@ -1,6 +1,23 @@
#ifndef _HAPROXY_LINUXCAP_H
#define _HAPROXY_LINUXCAP_H
#include <syscall.h>
#include <linux/capability.h>
/* for haproxy process itself, allocate this 8 byte-size struct only once in
* .data and makes it accessible from other compile-units, because we always
* fill it with the same values and because we could use it to collect
* capabilities for post_mortem debug info.
*/
extern struct __user_cap_header_struct cap_hdr_haproxy;
/* provided by sys/capability.h on some distros, declared here, as could be used
* in debug.c, in order to collect info about process capabilities before
* applying its configuration and at runtime.
*/
static inline int capget(cap_user_header_t hdrp, const cap_user_data_t datap)
{
return syscall(SYS_capget, hdrp, datap);
}
int prepare_caps_for_setuid(int from_uid, int to_uid);
int finalize_caps_after_setuid(int from_uid, int to_uid);
int prepare_caps_from_permitted_set(int from_uid, int to_uid, const char *program_name);