RFC: Capabilities

.travis.yml

@@ -13,7 +13,7 @@ env:
   - secure: fiVVKcMM8Cz8WAj6PB6eD/b+Y77klXOe9jbpehf6QwjFwf6paEHoMsrZ0aFXogm2Uej47GlTdRb3UkBqonbK4ANbu0ewsWCW0RGClZz5ghaSnfwdxEhuXsrFIax7DvJCStk2V84Keb+tSVemx4opxqZAlZ/Nen28S91KSDoJeRA=
   matrix:
   - BUILD_TYPE=normal
-  - CYASSL="3.3.2" BUILD_TYPE=cyassl
+  - LIBATTR="2.4.47" LIBCAP="2.24" CYASSL="3.3.2" BUILD_TYPE="full"
 cache:
   directories:
   - dependencies-src

.travis_configure_wrapper.sh

@@ -1,23 +1,52 @@
 #!/usr/bin/env bash
 
-if [[ -z "$BUILD_TYPE" ]]; then
-    echo "BUILD_TYPE not set. Bye."
-    exit 1
-fi
 
-if [[ "$BUILD_TYPE" == "normal" ]]; then
+function main {
+    if [[ -z "$BUILD_TYPE" ]]; then
+        echo "BUILD_TYPE not set. Bye."
+        exit 1
+    fi
 
-    echo "Running Wifidog configure"
-    ./configure $@
+    if [[ "$BUILD_TYPE" == "normal" ]]; then
 
-elif [[ "$BUILD_TYPE" == "cyassl" ]]; then
-    if [[ -z "$CYASSL" ]]; then
-        echo "CYASSL not set."
+        echo "Running Wifidog configure"
+        ./configure $@
+
+    elif [[ "$BUILD_TYPE" == "full" ]]; then
+        if [[ -z "$CYASSL" || -z "$LIBCAP" || -z "$LIBATTR" ]]; then
+            echo "Make sure that CYASSL, LIBCAP and LIBATTR are set."
+            exit 1
+        fi
+        mkdir -p dependencies-src || true
+        mkdir -p dependencies-installed || true
+        # reset CFLAGS because some dependencies generate warnings
+        OLD_CFLAGS="${CFLAGS}"
+        OLD_CXXFLAGS="${CXXFLAGS}"
+        OLD_LDFLAGS="${LDFLAGS}"
+        CUR=`pwd`
+        export CFLAGS="-I${CUR}/dependencies-installed/include/"
+        export CXXFLAGS="-I${CUR}/dependencies-installed/include/"
+        export LDFLAGS="-L${CUR}/dependencies-installed/lib/"
+        build_cyassl
+        build_libattr
+        build_libcap
+        echo "Running Wifidog configure"
+        export CFLAGS="${OLD_CFLAGS} ${CFLAGS}"
+        export CXXFLAGS="${OLD_CXXFLAGS} ${LDFLAGS}"
+        export LDFLAGS="${OLD_LDFLAGS} ${LDFLAGS}"
+        ./configure --enable-cyassl --enable-libcap $@
+    else
+        echo "Unknow BUILD_TYPE $BUILD_TYPE"
         exit 1
     fi
+
+}
+
+function build_cyassl {
+    # TODO: changing $CYASSL version number will not invalidate this check
+    # Need to remove full cache in travis interface if we want to upgrade
+    # CyaSSL
     CUR=`pwd`
-    mkdir -p dependencies-src || true
-    mkdir -p dependencies-installed || true
     if [[ ! -f dependencies-installed/include/cyassl/ssl.h ]]; then
         echo "Cached CyaSSL install not found. Installing."
         cd dependencies-src
@@ -47,11 +76,57 @@ elif [[ "$BUILD_TYPE" == "cyassl" ]]; then
     else
         echo "Cached CyaSSL install found."
     fi
-    echo "Running Wifidog configure"
-    export CFLAGS="-I${CUR}/dependencies-installed/include/"
-    export LDFLAGS="-L${CUR}/dependencies-installed/lib/"
-    ./configure --enable-cyassl $@
-else
-    echo "Unknow BUILD_TYPE $BUILD_TYPE"
-    exit 1
-fi
+}
+
+function build_libcap {
+    CUR=`pwd`
+    if [[ ! -f dependencies-installed/usr/include/sys/capability.h ]]; then
+        echo "Cached libcap not found. Installing."
+        cd dependencies-src
+        if [[ -f libcap-${LIBCAP}/Makefile ]]; then
+            echo "Found cached libcap package"
+        else
+            echo "No cache, downloading libcap"
+            wget https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-${LIBCAP}.tar.gz \
+                -O libcap-${LIBCAP}.tar.gz
+            tar -xvzf libcap-${LIBCAP}.tar.gz
+        fi
+        cd libcap-${LIBCAP}
+        echo "Content of libcap-${LIBCAP}"
+        ls
+        echo "Running libcap make install"
+        make install DESTDIR="$CUR"/dependencies-installed/ IPATH="${CFLAGS} -fPIC -I\$(topdir)/libcap/include/uapi -I\$(topdir)/libcap/include" LDFLAGS=${LDFLAGS} RAISE_SETFCAP=no lib=lib prefix=/
+        cd "$CUR"
+    else
+        echo "Cached libcap install found."
+    fi
+
+}
+
+function build_libattr {
+    CUR=`pwd`
+    if [[ ! -f dependencies-installed/include/attr/libattr.h ]]; then
+        echo "Cached libattr not found. Installing."
+        cd dependencies-src
+        if [[ -f libattr-${LIBATTR}/configure ]]; then
+            echo "Found cached libattr package"
+        else
+            echo "No cache, downloading libattr"
+            wget http://download.savannah.gnu.org/releases/attr/attr-${LIBATTR}.src.tar.gz \
+                -O attr-${LIBATTR}.tar.gz
+            tar -xvzf attr-${LIBATTR}.tar.gz
+        fi
+        cd attr-${LIBATTR}
+        echo "Content of attr-${LIBATTR}"
+        ls
+        echo "Running attr configure"
+        ./configure --prefix="$CUR"/dependencies-installed/
+        echo "Running attr make install"
+        make install install-dev install-lib
+        cd $CUR
+    else
+        echo "Cached attr install found."
+    fi
+}
+
+main

configure.in

@@ -85,10 +85,25 @@ AC_SUBST(enable_latex_docs)
 # Acutally perform the doxygen check
 BB_ENABLE_DOXYGEN
 
+# Enable capabilities?
+AC_DEFUN([BB_LIBCAP],
+[
+AC_ARG_ENABLE(libcap, [  --enable-libcap         enable privilege dropping with capabilities (no)], [], [enable_libcap=no])
+if test "x$enable_libcap" = xyes; then
+    AC_CHECK_HEADERS(sys/capability.h)
+    AC_SEARCH_LIBS([cap_get_proc], [cap], [], [
+    AC_MSG_ERROR([unable to find the cap_get_proc function.])
+    ])
+    AC_DEFINE(USE_LIBCAP,, "Compile with libcap support")
+fi
+])
+# Actually perform the libcap check
+BB_LIBCAP
+
 # Enable cyassl?
 AC_DEFUN([BB_CYASSL],
 [
-AC_ARG_ENABLE(cyassl, [  --enable-cyassl        enable TLS support for auth server communication (no)], [], [enable_cyassl=no])
+AC_ARG_ENABLE(cyassl, [  --enable-cyassl         enable TLS support for auth server communication (no)], [], [enable_cyassl=no])
 if test "x$enable_cyassl" = xyes; then
         AC_CHECK_HEADERS(cyassl/ssl.h)
         AC_SEARCH_LIBS([CyaSSLv23_client_method], [cyassl wolfssl], [], [

contrib/load-tester/wifidog-mock.conf

@@ -1,3 +1,6 @@
+User nobody
+Group nobody
+
 ExternalInterface eth0
 GatewayInterface internal0
 

src/Makefile.am

@@ -34,6 +34,7 @@ libgateway_a_SOURCES = commandline.c \
 	httpd_thread.c \
 	simple_http.c \
 	pstring.c \
+	capabilities.c \
 	wd_util.c
 
 noinst_HEADERS = commandline.h \
@@ -55,6 +56,7 @@ noinst_HEADERS = commandline.h \
 	httpd_thread.h \
 	simple_http.h \
 	pstring.h \
+	capabilities.h \
 	wd_util.h
 
 wdctl_LDADD = libgateway.a