Project

General

Profile

Actions

Feature #276

open

Libcap support for dropping privileges

Added by Victor Julien over 10 years ago. Updated over 2 years ago.

Status:
New
Priority:
Normal
Target version:
Effort:
medium
Difficulty:
low
Label:

Description

On Linux we use libcap-ng to drop privileges after startup. Currently libcap-ng supports Linux only, so we need a different solution for FreeBSD and Mac OS X.

Using libcap would likely work.

Requirements:
- A solution would have to be coded up into src/util-privs.c.
- As much as possible the API should remain the same.
- configure.in/autotools need to auto detect presence and usability of libcap
- libcap-ng (if present) needs to have preference over libcap

Alternatively, libcap-ng could be improved. The upstream dev has indicated to be willing to accept patches for other operating systems.


Related issues

Related to Feature #2375: Design and implement sensible per-thread capabilitiesNewOISF DevActions
Related to Feature #2931: Perform privdrop without libcap-ng supportNewEmmanuel RoullitActions
Actions #1

Updated by Victor Julien over 9 years ago

  • Target version set to TBD
Actions #2

Updated by Victor Julien almost 4 years ago

  • Related to Feature #2375: Design and implement sensible per-thread capabilities added
Actions #3

Updated by Victor Julien over 3 years ago

  • Effort set to medium
  • Difficulty set to low
Actions #4

Updated by Victor Julien over 2 years ago

  • Assignee set to Community Ticket
Actions #5

Updated by Victor Julien over 2 years ago

  • Related to Feature #2931: Perform privdrop without libcap-ng support added
Actions

Also available in: Atom PDF