diff options
Diffstat (limited to '')
| -rw-r--r-- | debian/patches/drop-privs-after-opening-savefile.diff | 91 | ||||
| -rw-r--r-- | debian/patches/drop-privs-silently.diff | 29 | ||||
| -rw-r--r-- | debian/patches/install.diff | 25 | ||||
| -rw-r--r-- | debian/patches/man-section.diff | 13 | ||||
| -rw-r--r-- | debian/patches/series | 4 |
5 files changed, 162 insertions, 0 deletions
diff --git a/debian/patches/drop-privs-after-opening-savefile.diff b/debian/patches/drop-privs-after-opening-savefile.diff new file mode 100644 index 0000000..4eecc6c --- /dev/null +++ b/debian/patches/drop-privs-after-opening-savefile.diff @@ -0,0 +1,91 @@ +Description: Drop root privileges after opening savefile +Forwarded: no +Bug-Debian: https://bugs.debian.org/935112 +Origin: https://src.fedoraproject.org/rpms/tcpdump/raw/master/f/0003-Drop-root-priviledges-before-opening-first-savefile-.patch +--- + tcpdump.1.in | 7 ++++++- + tcpdump.c | 30 ++++++++++++++++++++++++++++++ + 2 files changed, 36 insertions(+), 1 deletion(-) + +--- a/tcpdump.1.in ++++ b/tcpdump.1.in +@@ -269,6 +269,9 @@ + flag, with a number after it, starting at 1 and continuing upward. + The units of \fIfile_size\fP are millions of bytes (1,000,000 bytes, + not 1,048,576 bytes). ++ ++Note that when used with \fB\-Z\fR option (enabled by default), privileges ++are dropped before opening first savefile. + .TP + .B \-d + Dump the compiled packet-matching code in a human readable form to +@@ -966,12 +969,14 @@ + If + .I tcpdump + is running as root, after opening the capture device or input savefile, +-but before opening any savefiles for output, change the user ID to ++change the user ID to + .I user + and the group ID to the primary group of + .IR user . + .IP +-This behavior can also be enabled by default at compile time. ++This behavior is enabled by default (\fB\-Z tcpdump\fR), and can ++be disabled by \fB\-Z root\fR. ++ + .IP "\fI expression\fP" + .RS + selects which packets will be dumped. +--- a/tcpdump.c ++++ b/tcpdump.c +@@ -1492,6 +1492,7 @@ + cap_rights_t rights; + int cansandbox; + #endif /* HAVE_CAPSICUM */ ++ int chown_flag = 0; + int Oflag = 1; /* run filter code optimizer */ + int yflag_dlt = -1; + const char *yflag_dlt_name = NULL; +@@ -2320,6 +2321,19 @@ + } + capng_apply(CAPNG_SELECT_BOTH); + #endif /* HAVE_LIBCAP_NG */ ++ /* If user is running tcpdump as root and wants to write to the savefile, ++ * we will check if -C is set and if it is, we will drop root ++ * privileges right away and consequent call to>pcap_dump_open() ++ * will most likely fail for the first file. If -C flag is not set we ++ * will create file as root then change ownership of file to proper ++ * user(default tcpdump) and drop root privileges. ++ */ ++ if (WFileName) ++ if (Cflag && (username || chroot_dir)) ++ droproot(username, chroot_dir); ++ else ++ chown_flag = 1; ++ else + if (username || chroot_dir) + droproot(username, chroot_dir); + +@@ -2377,6 +2391,22 @@ + #endif /* HAVE_LIBCAP_NG */ + if (pdd == NULL) + error("%s", pcap_geterr(pd)); ++ ++ /* Change ownership of file and drop root privileges */ ++ if (chown_flag) { ++ struct passwd *pwd; ++ ++ pwd = getpwnam(username); ++ if (!pwd) ++ error("Couldn't find user '%s'", username); ++ ++ if (strcmp(WFileName, "-") && chown(dumpinfo.CurrentFileName, pwd->pw_uid, pwd->pw_gid) < 0) ++ error("Couldn't change ownership of savefile"); ++ ++ if (username || chroot_dir) ++ droproot(username, chroot_dir); ++ } ++ + #ifdef HAVE_CAPSICUM + set_dumper_capsicum_rights(pdd); + #endif diff --git a/debian/patches/drop-privs-silently.diff b/debian/patches/drop-privs-silently.diff new file mode 100644 index 0000000..37c5e20 --- /dev/null +++ b/debian/patches/drop-privs-silently.diff @@ -0,0 +1,29 @@ +Description: Drop root privileges silently as it's the default +Forwarded: no +Bug-Debian: https://bugs.debian.org/935112 +Origin: vendor, https://src.fedoraproject.org/rpms/tcpdump/raw/master/f/0008-Don-t-print-out-we-dropped-root-we-are-always-droppi.patch +--- + tcpdump.c | 5 ----- + 1 file changed, 5 deletions(-) + +--- a/tcpdump.c ++++ b/tcpdump.c +@@ -788,8 +788,6 @@ + int ret = capng_change_id(pw->pw_uid, pw->pw_gid, CAPNG_NO_FLAG); + if (ret < 0) + error("capng_change_id(): return %d\n", ret); +- else +- fprintf(stderr, "dropped privs to %s\n", username); + } + #else + if (initgroups(pw->pw_name, pw->pw_gid) != 0 || +@@ -799,9 +797,6 @@ + (unsigned long)pw->pw_uid, + (unsigned long)pw->pw_gid, + pcap_strerror(errno)); +- else { +- fprintf(stderr, "dropped privs to %s\n", username); +- } + #endif /* HAVE_LIBCAP_NG */ + } else + error("Couldn't find user '%.32s'", username); diff --git a/debian/patches/install.diff b/debian/patches/install.diff new file mode 100644 index 0000000..b4642ef --- /dev/null +++ b/debian/patches/install.diff @@ -0,0 +1,25 @@ +Change man page install paths for Debian and don't install +a versioned binary. + +--- a/Makefile.in ++++ b/Makefile.in +@@ -424,15 +424,14 @@ + [ -d $(DESTDIR)$(bindir) ] || \ + (mkdir -p $(DESTDIR)$(bindir); chmod 755 $(DESTDIR)$(bindir)) + $(INSTALL_PROGRAM) $(PROG) $(DESTDIR)$(bindir)/$(PROG) +- $(INSTALL_PROGRAM) $(PROG) $(DESTDIR)$(bindir)/$(PROG).`cat ${srcdir}/VERSION` +- [ -d $(DESTDIR)$(mandir)/man1 ] || \ +- (mkdir -p $(DESTDIR)$(mandir)/man1; chmod 755 $(DESTDIR)$(mandir)/man1) +- $(INSTALL_DATA) $(PROG).1 $(DESTDIR)$(mandir)/man1/$(PROG).1 ++ [ -d $(DESTDIR)$(mandir)/man8 ] || \ ++ (mkdir -p $(DESTDIR)$(mandir)/man8; chmod 755 $(DESTDIR)$(mandir)/man8) ++ $(INSTALL_DATA) $(PROG).1 $(DESTDIR)$(mandir)/man8/$(PROG).8 + + uninstall: + rm -f $(DESTDIR)$(bindir)/$(PROG) + rm -f $(DESTDIR)$(bindir)/$(PROG).`cat ${srcdir}/VERSION` +- rm -f $(DESTDIR)$(mandir)/man1/$(PROG).1 ++ rm -f $(DESTDIR)$(mandir)/man8/$(PROG).8 + + lint: + lint -hbxn $(SRC) $(LIBNETDISSECT_SRC) | \ diff --git a/debian/patches/man-section.diff b/debian/patches/man-section.diff new file mode 100644 index 0000000..7a399f1 --- /dev/null +++ b/debian/patches/man-section.diff @@ -0,0 +1,13 @@ +Change man page section. + +--- a/tcpdump.1.in ++++ b/tcpdump.1.in +@@ -20,7 +20,7 @@ + .\" WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF + .\" MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. + .\" +-.TH TCPDUMP 1 "30 July 2022" ++.TH TCPDUMP 8 "30 July 2022" + .SH NAME + tcpdump \- dump traffic on a network + .SH SYNOPSIS diff --git a/debian/patches/series b/debian/patches/series new file mode 100644 index 0000000..1e2e8a9 --- /dev/null +++ b/debian/patches/series @@ -0,0 +1,4 @@ +drop-privs-after-opening-savefile.diff +drop-privs-silently.diff +install.diff +man-section.diff |