コード例 #1
0
    def test_get_caps(self, mock_capget):
        def impl(hdr, data):
            # Somewhat arbitrary bit patterns to exercise _mask_to_caps
            data[0].effective = 0x01020000
            data[1].effective = 0x00020000
            data[0].permitted = 0x00000500
            data[1].permitted = 0x01000008
            data[0].inheritable = 0x81000000
            data[1].inheritable = 0x00000100
            return 0

        mock_capget.side_effect = impl

        self.assertItemsEqual(([17, 24, 49], [8, 10, 35, 56], [24, 31, 40]), capabilities.get_caps())
コード例 #2
0
    def test_get_caps(self, mock_capget):
        def impl(hdr, data):
            # Somewhat arbitrary bit patterns to exercise _mask_to_caps
            data[0].effective = 0x01020000
            data[1].effective = 0x00020000
            data[0].permitted = 0x00000500
            data[1].permitted = 0x01000008
            data[0].inheritable = 0x81000000
            data[1].inheritable = 0x00000100
            return 0

        mock_capget.side_effect = impl

        self.assertItemsEqual(([17, 24, 49], [8, 10, 35, 56], [24, 31, 40]),
                              capabilities.get_caps())
コード例 #3
0
ファイル: daemon.py プロジェクト: bopopescu/OpenStack-Ocata
    def _drop_privs(self):
        try:
            # Keep current capabilities across setuid away from root.
            capabilities.set_keepcaps(True)

            if self.group is not None:
                try:
                    os.setgroups([])
                except OSError:
                    msg = _('Failed to remove supplemental groups')
                    LOG.critical(msg)
                    raise FailedToDropPrivileges(msg)

            if self.user is not None:
                setuid(self.user)

            if self.group is not None:
                setgid(self.group)

        finally:
            capabilities.set_keepcaps(False)

        LOG.info(_LI('privsep process running with uid/gid: %(uid)s/%(gid)s'),
                 {
                     'uid': os.getuid(),
                     'gid': os.getgid()
                 })

        capabilities.drop_all_caps_except(self.caps, self.caps, [])

        def fmt_caps(capset):
            if not capset:
                return 'none'
            fc = [capabilities.CAPS_BYVALUE.get(c, str(c)) for c in capset]
            fc.sort()
            return '|'.join(fc)

        eff, prm, inh = capabilities.get_caps()
        LOG.info(
            _LI('privsep process running with capabilities '
                '(eff/prm/inh): %(eff)s/%(prm)s/%(inh)s'), {
                    'eff': fmt_caps(eff),
                    'prm': fmt_caps(prm),
                    'inh': fmt_caps(inh),
                })
コード例 #4
0
ファイル: daemon.py プロジェクト: openstack/oslo.privsep
    def _drop_privs(self):
        try:
            # Keep current capabilities across setuid away from root.
            capabilities.set_keepcaps(True)

            if self.group is not None:
                try:
                    os.setgroups([])
                except OSError:
                    msg = _('Failed to remove supplemental groups')
                    LOG.critical(msg)
                    raise FailedToDropPrivileges(msg)

            if self.user is not None:
                setuid(self.user)

            if self.group is not None:
                setgid(self.group)

        finally:
            capabilities.set_keepcaps(False)

        LOG.info(_LI('privsep process running with uid/gid: %(uid)s/%(gid)s'),
                 {'uid': os.getuid(), 'gid': os.getgid()})

        capabilities.drop_all_caps_except(self.caps, self.caps, [])

        def fmt_caps(capset):
            if not capset:
                return 'none'
            fc = [capabilities.CAPS_BYVALUE.get(c, str(c))
                  for c in capset]
            fc.sort()
            return '|'.join(fc)

        eff, prm, inh = capabilities.get_caps()
        LOG.info(
            _LI('privsep process running with capabilities '
                '(eff/prm/inh): %(eff)s/%(prm)s/%(inh)s'),
            {
                'eff': fmt_caps(eff),
                'prm': fmt_caps(prm),
                'inh': fmt_caps(inh),
            })