upstream/openvpn
1
0
Fork 0
mirror of https://github.com/OpenVPN/openvpn.git synced 2026-05-28 04:03:29 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 1

Don't clear capability bounding set on capng_change_id

Browse source 
The bounding set being empty will overpower the likes of su/sudo
and will make it impossible for any child processes to ever gain
additional privileges again.

Github: fixes OpenVPN/openvpn#220

Signed-off-by: Timo Rothenpieler <timo@rothenpieler.org>
Acked-by: Gert Doering <gert@greenie.muc.de>
Message-Id: <20230118142428.162-1-timo@rothenpieler.org>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg26048.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>
This commit is contained in:
Timo Rothenpieler 2023-01-18 15:24:28 +01:00 committed by Gert Doering
parent adc54f483b
commit d8523119b9
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/openvpn/platform.c
View file

@ -246,7 +246,7 @@ platform_user_group_set(const struct platform_state_user *user_state,
/* Change to new UID/GID.
* capng_change_id() internally calls capng_apply() to apply prepared capabilities.
*/
res = capng_change_id(new_uid, new_gid, CAPNG_DROP_SUPP_GRP | CAPNG_CLEAR_BOUNDING);
res = capng_change_id(new_uid, new_gid, CAPNG_DROP_SUPP_GRP);
if (res == -4 || res == -6)
{
/* -4 and -6 mean failure of setuid/gid respectively.