Drop CAP_NET_BIND_SERVICE after binding mctpd

Signed-off-by: James Lee <james@codeconstruct.com.au>

Author: SafetyInObscurity

meson.build

@@ -16,6 +16,8 @@ add_project_arguments('-Wno-unused-parameter', language : 'c')
 
 libsystemd = dependency('libsystemd', version: '>=247', required: false)
 
+libcap = dependency('libcap', version: '>=2.77', required: false)
+
 conf = configuration_data()
 conf.set10('HAVE_LINUX_MCTP_H',
     cc.has_header('linux/mctp.h'),
@@ -84,12 +86,12 @@ executable('mctp-client',
     install: true
 )
 
-if libsystemd.found()
+if libsystemd.found() and libcap.found()
     executable('mctpd',
         sources: [
             'src/mctpd.c',
         ] + netlink_sources + util_sources + ops_sources,
-        dependencies: [libsystemd, toml_dep],
+        dependencies: [libsystemd, toml_dep, libcap],
         install: true,
         install_dir: get_option('sbindir'),
         c_args: ['-DOPS_SD_EVENT=1'],
@@ -100,7 +102,7 @@ if libsystemd.found()
             'src/mctpd.c',
         ] + test_ops_sources + netlink_sources + util_sources,
         include_directories:  include_directories('src'),
-        dependencies: [libsystemd, toml_dep],
+        dependencies: [libsystemd, toml_dep, libcap],
         c_args: ['-DOPS_SD_EVENT=1'],
     )
 endif
@@ -154,7 +156,7 @@ if tests
     sh = find_program('sh')
     test_args = [ '-c', script, '--' ]
 
-    if libsystemd.found()
+    if libsystemd.found() and libcap.found()
         dbus_run_session = find_program('dbus-run-session')
 
         test('test-mctpd', dbus_run_session,

src/mctpd.c

@@ -6,6 +6,8 @@
  * Copyright (c) 2021 Google
  */
 
+#include "linux/capability.h"
+#include <stddef.h>
 #define _GNU_SOURCE
 #include "config.h"
 
@@ -14,6 +16,7 @@
 #include <time.h>
 
 #include <sys/socket.h>
+#include <sys/capability.h>
 #include <arpa/inet.h>
 #include <stdint.h>
 #include <stdio.h>
@@ -1441,14 +1444,19 @@ static int cb_listen_control_msg(sd_event_source *s, int sd, uint32_t revents,
 
 static int listen_control_msg(struct ctx *ctx, uint32_t net)
 {
+	cap_flag_t dropped_sets[] = { CAP_EFFECTIVE, CAP_INHERITABLE,
+				      CAP_PERMITTED };
+	cap_value_t dropped_capability[] = { CAP_NET_BIND_SERVICE };
 	struct sockaddr_mctp addr = { 0 };
 	int rc, sd = -1, val;
+	char *failed;
+	cap_t cap;
+	size_t i;
 
 	sd = mctp_ops.mctp.socket();
 	if (sd < 0) {
-		rc = -errno;
-		warn("%s: socket() failed", __func__);
-		goto out;
+		failed = "socket()";
+		goto warn_out;
 	}
 
 	addr.smctp_family = AF_MCTP;
@@ -1459,9 +1467,35 @@ static int listen_control_msg(struct ctx *ctx, uint32_t net)
 
 	rc = mctp_ops.mctp.bind(sd, (struct sockaddr *)&addr, sizeof(addr));
 	if (rc < 0) {
-		rc = -errno;
-		warn("%s: bind() failed", __func__);
-		goto out;
+		failed = "bind()";
+		goto warn_out;
+	}
+
+	cap = cap_get_proc();
+	if (!cap) {
+		failed = "cap_get_proc()";
+		goto warn_out;
+	}
+
+	for (i = 0; i < ARRAY_SIZE(dropped_sets); i++) {
+		rc = cap_set_flag(cap, dropped_sets[i], 1, dropped_capability,
+				  CAP_CLEAR);
+		if (rc < 0) {
+			failed = "cap_clear_flag()";
+			goto cap_out;
+		}
+	}
+
+	rc = cap_set_proc(cap);
+	if (rc < 0) {
+		failed = "cap_set_proc()";
+		goto cap_out;
+	}
+
+	cap_free(cap);
+	if (rc < 0) {
+		failed = "cap_free()";
+		goto warn_out;
 	}
 
 	val = 1;
@@ -1476,6 +1510,16 @@ static int listen_control_msg(struct ctx *ctx, uint32_t net)
 	rc = sd_event_add_io(ctx->event, NULL, sd, EPOLLIN,
 			     cb_listen_control_msg, ctx);
 	return rc;
+
+cap_out:
+	rc = -errno;
+	warn("%s: %s failed", __func__, failed);
+	cap_free(cap);
+	goto out;
+
+warn_out:
+	rc = -errno;
+	warn("%s: %s failed", __func__, failed);
 out:
 	if (rc < 0) {
 		close(sd);