|
 |
9e4319 |
From 07db6dfac060d474b73f9b963435f4b6472e3f48 Mon Sep 17 00:00:00 2001
|
|
|
9e4319 |
From: Eric Garver <eric@garver.life>
|
|
|
9e4319 |
Date: Wed, 11 Aug 2021 14:47:59 -0400
|
|
|
9e4319 |
Subject: [PATCH] fix(firewalld): keep linux capability CAP_SYS_MODULE
|
|
|
9e4319 |
|
|
|
9e4319 |
When firewalld calls ip6tables it may implicitly load the ip6_tables, et
|
|
|
9e4319 |
al kernel modules. As such we need to retain CAP_SYS_MODULE so that
|
|
|
9e4319 |
implicit module is allowed. Otherwise we get EPERM from the kernel.
|
|
|
9e4319 |
|
|
|
9e4319 |
This only affects the -legacy variants and the top level table/chain
|
|
|
9e4319 |
modules. The userspace binaries will modprobe the kernel modules.
|
|
|
9e4319 |
Extensions, e.g. xt_conntrack, are implicitly loaded by the kernel based
|
|
|
9e4319 |
on the rules being added and thus not subject to linux capabilities
|
|
|
9e4319 |
checks.
|
|
|
9e4319 |
|
|
|
9e4319 |
The -nft variants are unaffected because they use the nftables
|
|
|
9e4319 |
infrastructure which has implicit module loading in the kernel similar
|
|
|
9e4319 |
to the iptables extensions (xt_* modules).
|
|
|
9e4319 |
|
|
|
9e4319 |
Fixes: rhbz 1990271
|
|
|
9e4319 |
Fixes: fb0532e8a200 ("feat(firewalld): drop linux capabilities")
|
|
|
9e4319 |
(cherry picked from commit 13801962073f478c68d818b314091badcf8b5614)
|
|
|
9e4319 |
(cherry picked from commit d3cd7e088f946c75593b0569bd658266b2e9329d)
|
|
|
9e4319 |
---
|
|
|
9e4319 |
src/firewalld.in | 5 ++++-
|
|
|
9e4319 |
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
9e4319 |
|
|
|
9e4319 |
diff --git a/src/firewalld.in b/src/firewalld.in
|
|
|
9e4319 |
index abcbe3508f86..b1c886c6f02f 100755
|
|
|
9e4319 |
--- a/src/firewalld.in
|
|
|
9e4319 |
+++ b/src/firewalld.in
|
|
|
9e4319 |
@@ -136,6 +136,7 @@ def startup(args):
|
|
|
9e4319 |
# attempt to drop Linux capabilities to a minimal set:
|
|
|
9e4319 |
# - CAP_NET_ADMIN
|
|
|
9e4319 |
# - CAP_NET_RAW
|
|
|
9e4319 |
+ # - CAP_SYS_MODULE
|
|
|
9e4319 |
try:
|
|
|
9e4319 |
import capng
|
|
|
9e4319 |
capng.capng_clear(capng.CAPNG_SELECT_BOTH)
|
|
|
9e4319 |
@@ -143,8 +144,10 @@ def startup(args):
|
|
|
9e4319 |
capng.CAP_NET_ADMIN)
|
|
|
9e4319 |
capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
9e4319 |
capng.CAP_NET_RAW)
|
|
|
9e4319 |
+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
9e4319 |
+ capng.CAP_SYS_MODULE)
|
|
|
9e4319 |
capng.capng_apply(capng.CAPNG_SELECT_BOTH)
|
|
|
9e4319 |
- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW.")
|
|
|
9e4319 |
+ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
|
|
|
9e4319 |
except ImportError:
|
|
|
9e4319 |
pass
|
|
|
9e4319 |
|
|
|
9e4319 |
--
|
|
|
9e4319 |
2.31.1
|
|
|
9e4319 |
|