X-Git-Url: https://git.tcpdump.org/tcpdump/blobdiff_plain/f22c9ec50c5ab77d06e726cc358877b56dab13d3..16a592dcadb25d2262d64f3811cb2da5e42e1846:/tcpdump.c

diff --git a/tcpdump.c b/tcpdump.c
index 25ff1802..11dc8bc8 100644
--- a/tcpdump.c
+++ b/tcpdump.c
@@ -72,6 +72,13 @@ extern int SIZE_BUF;
 #include <stdlib.h>
 #include <string.h>
 #include <limits.h>
+#ifdef HAVE_CAPSICUM
+#include <sys/capability.h>
+#include <sys/ioccom.h>
+#include <net/bpf.h>
+#include <fcntl.h>
+#include <libgen.h>
+#endif	/* HAVE_CAPSICUM */
 #ifndef WIN32
 #include <sys/wait.h>
 #include <sys/resource.h>
@@ -441,6 +448,9 @@ struct dump_info {
 	char	*CurrentFileName;
 	pcap_t	*pd;
 	pcap_dumper_t *p;
+#ifdef HAVE_CAPSICUM
+	int	dirfd;
+#endif
 };
 
 #ifdef HAVE_PCAP_SET_TSTAMP_TYPE
@@ -909,6 +919,11 @@ main(int argc, char **argv)
 #endif
 	int status;
 	FILE *VFile;
+#ifdef HAVE_CAPSICUM
+	cap_rights_t rights;
+	int cansandbox;
+#endif	/* HAVE_CAPSICUM */
+
 #ifdef WIN32
 	if(wsockinit() != 0) return 1;
 #endif /* WIN32 */
@@ -1422,6 +1437,13 @@ main(int argc, char **argv)
 
 		if (pd == NULL)
 			error("%s", ebuf);
+#ifdef HAVE_CAPSICUM
+		cap_rights_init(&rights, CAP_READ);
+		if (cap_rights_limit(fileno(pcap_file(pd)), &rights) < 0 &&
+		    errno != ENOSYS) {
+			error("unable to limit pcap descriptor");
+		}
+#endif
 		dlt = pcap_datalink(pd);
 		dlt_name = pcap_datalink_val_to_name(dlt);
 		if (dlt_name == NULL) {
@@ -1686,6 +1708,21 @@ main(int argc, char **argv)
 
 	if (pcap_setfilter(pd, &fcode) < 0)
 		error("%s", pcap_geterr(pd));
+#ifdef HAVE_CAPSICUM
+	if (RFileName == NULL && VFileName == NULL) {
+		static const unsigned long cmds[] = { BIOCGSTATS };
+
+		cap_rights_init(&rights, CAP_IOCTL, CAP_READ);
+		if (cap_rights_limit(pcap_fileno(pd), &rights) < 0 &&
+		    errno != ENOSYS) {
+			error("unable to limit pcap descriptor");
+		}
+		if (cap_ioctls_limit(pcap_fileno(pd), cmds,
+		    sizeof(cmds) / sizeof(cmds[0])) < 0 && errno != ENOSYS) {
+			error("unable to limit ioctls on pcap descriptor");
+		}
+	}
+#endif
 	if (WFileName) {
 		pcap_dumper_t *p;
 		/* Do not exceed the default PATH_MAX for files. */
@@ -1707,9 +1744,32 @@ main(int argc, char **argv)
 #endif
 		if (p == NULL)
 			error("%s", pcap_geterr(pd));
+#ifdef HAVE_CAPSICUM
+		cap_rights_init(&rights, CAP_SEEK, CAP_WRITE);
+		if (cap_rights_limit(fileno(pcap_dump_file(p)), &rights) < 0 &&
+		    errno != ENOSYS) {
+			error("unable to limit dump descriptor");
+		}
+#endif
 		if (Cflag != 0 || Gflag != 0) {
-			callback = dump_packet_and_trunc;
+#ifdef HAVE_CAPSICUM
+			dumpinfo.WFileName = strdup(basename(WFileName));
+			dumpinfo.dirfd = open(dirname(WFileName),
+			    O_DIRECTORY | O_RDONLY);
+			if (dumpinfo.dirfd < 0) {
+				error("unable to open directory %s",
+				    dirname(WFileName));
+			}
+			cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL,
+			    CAP_FTRUNCATE, CAP_LOOKUP, CAP_SEEK, CAP_WRITE);
+			if (cap_rights_limit(dumpinfo.dirfd, &rights) < 0 &&
+			    errno != ENOSYS) {
+				error("unable to limit directory rights");
+			}
+#else	/* !HAVE_CAPSICUM */
 			dumpinfo.WFileName = WFileName;
+#endif
+			callback = dump_packet_and_trunc;
 			dumpinfo.pd = pd;
 			dumpinfo.p = p;
 			pcap_userdata = (u_char *)&dumpinfo;
@@ -1779,6 +1839,15 @@ main(int argc, char **argv)
 		(void)fflush(stderr);
 	}
 #endif /* WIN32 */
+
+#ifdef HAVE_CAPSICUM
+	cansandbox = (nflag && VFileName == NULL && zflag == NULL);
+	if (cansandbox && cap_enter() < 0 && errno != ENOSYS)
+		error("unable to enter the capability mode");
+	if (cap_sandboxed())
+		fprintf(stderr, "capability mode sandbox enabled\n");
+#endif	/* HAVE_CAPSICUM */
+
 	do {
 		status = pcap_loop(pd, cnt, callback, pcap_userdata);
 		if (WFileName == NULL) {
@@ -1826,6 +1895,13 @@ main(int argc, char **argv)
 				pd = pcap_open_offline(RFileName, ebuf);
 				if (pd == NULL)
 					error("%s", ebuf);
+#ifdef HAVE_CAPSICUM
+				cap_rights_init(&rights, CAP_READ);
+				if (cap_rights_limit(fileno(pcap_file(pd)),
+				    &rights) < 0 && errno != ENOSYS) {
+					error("unable to limit pcap descriptor");
+				}
+#endif
 				new_dlt = pcap_datalink(pd);
 				if (WFileName && new_dlt != dlt)
 					error("%s: new dlt does not match original", RFileName);
@@ -1994,6 +2070,9 @@ static void
 dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *sp)
 {
 	struct dump_info *dump_info;
+#ifdef HAVE_CAPSICUM
+	cap_rights_t rights;
+#endif
 
 	++packets_captured;
 
@@ -2022,6 +2101,11 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
 
 		/* If the time is greater than the specified window, rotate */
 		if (t - Gflag_time >= Gflag) {
+#ifdef HAVE_CAPSICUM
+			FILE *fp;
+			int fd;
+#endif
+
 			/* Update the Gflag_time */
 			Gflag_time = t;
 			/* Update Gflag_count */
@@ -2075,13 +2159,36 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
 			capng_update(CAPNG_ADD, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
 			capng_apply(CAPNG_EFFECTIVE);
 #endif /* HAVE_CAP_NG_H */
+#ifdef HAVE_CAPSICUM
+			fd = openat(dump_info->dirfd,
+			    dump_info->CurrentFileName,
+			    O_CREAT | O_WRONLY | O_TRUNC, 0644);
+			if (fd < 0) {
+				error("unable to open file %s",
+				    dump_info->CurrentFileName);
+			}
+			fp = fdopen(fd, "w");
+			if (fp == NULL) {
+				error("unable to fdopen file %s",
+				    dump_info->CurrentFileName);
+			}
+			dump_info->p = pcap_dump_fopen(dump_info->pd, fp);
+#else	/* !HAVE_CAPSICUM */
 			dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
+#endif
 #ifdef HAVE_CAP_NG_H
 			capng_update(CAPNG_DROP, CAPNG_EFFECTIVE, CAP_DAC_OVERRIDE);
 			capng_apply(CAPNG_EFFECTIVE);
 #endif /* HAVE_CAP_NG_H */
 			if (dump_info->p == NULL)
 				error("%s", pcap_geterr(pd));
+#ifdef HAVE_CAPSICUM
+			cap_rights_init(&rights, CAP_SEEK, CAP_WRITE);
+			if (cap_rights_limit(fileno(pcap_dump_file(dump_info->p)),
+			    &rights) < 0 && errno != ENOSYS) {
+				error("unable to limit dump descriptor");
+			}
+#endif
 		}
 	}
 
@@ -2091,6 +2198,11 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
 	 * file could put it over Cflag.
 	 */
 	if (Cflag != 0 && pcap_dump_ftell(dump_info->p) > Cflag) {
+#ifdef HAVE_CAPSICUM
+		FILE *fp;
+		int fd;
+#endif
+
 		/*
 		 * Close the current file and open a new one.
 		 */
@@ -2113,9 +2225,31 @@ dump_packet_and_trunc(u_char *user, const struct pcap_pkthdr *h, const u_char *s
 		if (dump_info->CurrentFileName == NULL)
 			error("dump_packet_and_trunc: malloc");
 		MakeFilename(dump_info->CurrentFileName, dump_info->WFileName, Cflag_count, WflagChars);
+#ifdef HAVE_CAPSICUM
+		fd = openat(dump_info->dirfd, dump_info->CurrentFileName,
+		    O_CREAT | O_WRONLY | O_TRUNC, 0644);
+		if (fd < 0) {
+			error("unable to open file %s",
+			    dump_info->CurrentFileName);
+		}
+		fp = fdopen(fd, "w");
+		if (fp == NULL) {
+			error("unable to fdopen file %s",
+			    dump_info->CurrentFileName);
+		}
+		dump_info->p = pcap_dump_fopen(dump_info->pd, fp);
+#else	/* !HAVE_CAPSICUM */
 		dump_info->p = pcap_dump_open(dump_info->pd, dump_info->CurrentFileName);
+#endif
 		if (dump_info->p == NULL)
 			error("%s", pcap_geterr(pd));
+#ifdef HAVE_CAPSICUM
+		cap_rights_init(&rights, CAP_SEEK, CAP_WRITE);
+		if (cap_rights_limit(fileno(pcap_dump_file(dump_info->p)),
+		    &rights) < 0 && errno != ENOSYS) {
+			error("unable to limit dump descriptor");
+		}
+#endif
 	}
 
 	pcap_dump((u_char *)dump_info->p, h, sp);