Changeset 364

Timestamp:

03/06/06 15:30:46 (3 years ago)

Author:

common

Message:

Nepenthes:
- added support for linux capabilities
as capabilities do not work when the kernel module capability is not loaded, but using capabilities when availible is recommended, using capabilities is default
when the kernel module is not loaded, setting capabilities will fail, but nepenthes will not fail
if you want to make nepenthes stopp when using capabilities, use the -C flag to enforce capabilities
enforcing capabilities will stopp the process upon error

when using capabilities, don't change the process user or group with the -u -g flags, it breaks the capabilities

Files:

• nepenthes/trunk/nepenthes-core/include/Nepenthes.hpp (modified) (1 diff)
• nepenthes/trunk/nepenthes-core/src/Nepenthes.cpp (modified) (8 diffs)

nepenthes/trunk/nepenthes-core/include/Nepenthes.hpp

@@ -196 +196 @@
-                bool changeGroup();
-
+                bool setCapabilties();
+
-                bool changeRoot(char *path);
-    };

nepenthes/trunk/nepenthes-core/src/Nepenthes.cpp

@@ -43 +43 @@
-#include <dirent.h>
-#include <sys/utsname.h>
+
+#undef _POSIX_SOURCE
+#include <sys/capability.h>
+
-
-#include "Nepenthes.hpp"
@@ -172 +176 @@
-        char *chRoot = NULL;
-        const char *consoleTags = 0, *diskTags = 0;
+        bool forcesetcaps=false;
-
-
@@ -188 +193 @@
-                static struct option long_options[] = {
-            { "config",                 1, 0, 'c' },
+                        { "capabilities",       0, 0, 'C' },
-                        { "disk-log",           1, 0, 'd' },    // FIXME
-                        { "file-check",         1, 0, 'f' },    // FIXME
@@ -207 +213 @@
-                };
-
-
+C
-                if (c == -1)
-                        break;
@@ -217 +223 @@
-                        basedir = optarg;
-                        break;
+
+                case 'C':
+                        forcesetcaps = true;
+                        break;
+
-
-                case 'c':
@@ -667 +678 @@
-        }
-
+        if ( run == true  )
+        {
+                if ( setCapabilties() == false)
+                {
+                        if ( forcesetcaps == true )
+                        {
+                                logCrit("%s","As you asked to force capabilities, this is a critical error and we will terminate right now\n");
+                                run = false;
+                        }
+                }
+        }
-
-        if ( run == true && chRoot != NULL )
@@ -1321 +1343 @@
-
-}
+
+
+bool Nepenthes::setCapabilties()
+{
+        logPF();
+
+#ifdef HAVE_LIBCAP
+        // set caps
+        cap_t caps = cap_init();
+        cap_value_t capList[4] =
+        { 
+                CAP_SYS_CHROOT,                 // chroot()
+                CAP_NET_BIND_SERVICE,   // bind() ports < 1024 
+                CAP_SETUID,                     // setuid()
+                CAP_SETGID                              // setgid()
+        };
+
+        unsigned num_caps = 4;
+
+        cap_set_flag(caps, CAP_EFFECTIVE,       num_caps, capList, CAP_SET);
+        cap_set_flag(caps, CAP_INHERITABLE, num_caps, capList, CAP_SET);
+        cap_set_flag(caps, CAP_PERMITTED,       num_caps, capList, CAP_SET);
+
+        if ( cap_set_proc(caps) )
+        {
+                cap_free(caps);
+                logCrit("Could not set capabilities '%s'\n",strerror(errno));
+                logCrit("%s","Maybe you did not load the kernel module 'capability' ?\n");
+                logCrit("%s","Try 'modprobe capability' \n");
+                return false;
+        }
+        cap_free(caps);
+
+        // print caps
+        caps = cap_get_proc();
+        ssize_t y = 0;
+        logInfo("The process %d was given capabilities %s\n",(int) getpid(), cap_to_text(caps, &y));
+        fflush(0);
+        cap_free(caps);
+
+        return true;
+#else
+        logCrit("%s","Compiled without support for capabilities, no way to run capabilities\n");
+        return false;
+#endif  // HAVE_LIBCAP
+
+}
+
+
-
-/**
@@ -1533 +1604 @@
-        {
-        {"c",   "config",                       "give path to Config File",                             SYSCONFDIR "/nepenthes.conf"    },
+                {"C",   "capabilities",         "force kernel 'security' capabilities", ""                                              },
-                {"d",   "disk-log",                     "disk logging tags, see -L",                    "(no filter)"                   },
-                {"f",   "file-check",           "check file for known shellcode rmknown,rmnonop",   ""                                          },