|
 |
bdce9f |
From 09cdc166ddfe53b6e8ce3a2920f798320c170b7f Mon Sep 17 00:00:00 2001
|
|
|
bdce9f |
From: Eric Garver <eric@garver.life>
|
|
|
bdce9f |
Date: Wed, 11 Aug 2021 14:47:59 -0400
|
|
|
bdce9f |
Subject: [PATCH 2/3] fix(firewalld): keep linux capability CAP_SYS_MODULE
|
|
|
bdce9f |
|
|
|
bdce9f |
When firewalld calls ip6tables it may implicitly load the ip6_tables, et
|
|
|
bdce9f |
al kernel modules. As such we need to retain CAP_SYS_MODULE so that
|
|
|
bdce9f |
implicit module is allowed. Otherwise we get EPERM from the kernel.
|
|
|
bdce9f |
|
|
|
bdce9f |
This only affects the -legacy variants and the top level table/chain
|
|
|
bdce9f |
modules. The userspace binaries will modprobe the kernel modules.
|
|
|
bdce9f |
Extensions, e.g. xt_conntrack, are implicitly loaded by the kernel based
|
|
|
bdce9f |
on the rules being added and thus not subject to linux capabilities
|
|
|
bdce9f |
checks.
|
|
|
bdce9f |
|
|
|
bdce9f |
The -nft variants are unaffected because they use the nftables
|
|
|
bdce9f |
infrastructure which has implicit module loading in the kernel similar
|
|
|
bdce9f |
to the iptables extensions (xt_* modules).
|
|
|
bdce9f |
|
|
|
bdce9f |
Fixes: rhbz 1990271
|
|
|
bdce9f |
Fixes: fb0532e8a200 ("feat(firewalld): drop linux capabilities")
|
|
|
bdce9f |
(cherry picked from commit 13801962073f478c68d818b314091badcf8b5614)
|
|
|
bdce9f |
(cherry picked from commit d3cd7e088f946c75593b0569bd658266b2e9329d)
|
|
|
bdce9f |
---
|
|
|
bdce9f |
src/firewalld.in | 5 ++++-
|
|
|
bdce9f |
1 file changed, 4 insertions(+), 1 deletion(-)
|
|
|
bdce9f |
|
|
|
bdce9f |
diff --git a/src/firewalld.in b/src/firewalld.in
|
|
|
bdce9f |
index abcbe3508f86..b1c886c6f02f 100755
|
|
|
bdce9f |
--- a/src/firewalld.in
|
|
|
bdce9f |
+++ b/src/firewalld.in
|
|
|
bdce9f |
@@ -136,6 +136,7 @@ def startup(args):
|
|
|
bdce9f |
# attempt to drop Linux capabilities to a minimal set:
|
|
|
bdce9f |
# - CAP_NET_ADMIN
|
|
|
bdce9f |
# - CAP_NET_RAW
|
|
|
bdce9f |
+ # - CAP_SYS_MODULE
|
|
|
bdce9f |
try:
|
|
|
bdce9f |
import capng
|
|
|
bdce9f |
capng.capng_clear(capng.CAPNG_SELECT_BOTH)
|
|
|
bdce9f |
@@ -143,8 +144,10 @@ def startup(args):
|
|
|
bdce9f |
capng.CAP_NET_ADMIN)
|
|
|
bdce9f |
capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
bdce9f |
capng.CAP_NET_RAW)
|
|
|
bdce9f |
+ capng.capng_update(capng.CAPNG_ADD, capng.CAPNG_EFFECTIVE | capng.CAPNG_PERMITTED | capng.CAPNG_BOUNDING_SET,
|
|
|
bdce9f |
+ capng.CAP_SYS_MODULE)
|
|
|
bdce9f |
capng.capng_apply(capng.CAPNG_SELECT_BOTH)
|
|
|
bdce9f |
- log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW.")
|
|
|
bdce9f |
+ log.info(log.INFO1, "Dropped Linux capabilities to NET_ADMIN, NET_RAW, SYS_MODULE.")
|
|
|
bdce9f |
except ImportError:
|
|
|
bdce9f |
pass
|
|
|
bdce9f |
|
|
|
bdce9f |
--
|
|
|
bdce9f |
2.31.1
|
|
|
bdce9f |
|