Project

General

Profile

Feature #276

Libcap support for dropping privileges

Added by Victor Julien over 8 years ago. Updated 8 months ago.

Status:
New
Priority:
Normal
Target version:
Effort:
medium
Difficulty:
low
Label:

Description

On Linux we use libcap-ng to drop privileges after startup. Currently libcap-ng supports Linux only, so we need a different solution for FreeBSD and Mac OS X.

Using libcap would likely work.

Requirements:
- A solution would have to be coded up into src/util-privs.c.
- As much as possible the API should remain the same.
- configure.in/autotools need to auto detect presence and usability of libcap
- libcap-ng (if present) needs to have preference over libcap

Alternatively, libcap-ng could be improved. The upstream dev has indicated to be willing to accept patches for other operating systems.


Related issues

Related to Feature #2375: Design and implement sensible per-thread capabilitiesNewActions
Related to Feature #2931: Perform privdrop without libcap-ng supportNewActions

History

#1

Updated by Victor Julien over 7 years ago

  • Target version set to TBD
#2

Updated by Victor Julien almost 2 years ago

  • Related to Feature #2375: Design and implement sensible per-thread capabilities added
#3

Updated by Victor Julien over 1 year ago

  • Effort set to medium
  • Difficulty set to low
#4

Updated by Victor Julien 8 months ago

  • Assignee set to Community Ticket
#5

Updated by Victor Julien 7 months ago

  • Related to Feature #2931: Perform privdrop without libcap-ng support added

Also available in: Atom PDF