diff options
Diffstat (limited to 'bin/named/unix')
| -rw-r--r-- | bin/named/unix/include/named/os.h | 8 | ||||
| -rw-r--r-- | bin/named/unix/os.c | 44 |
2 files changed, 47 insertions, 5 deletions
diff --git a/bin/named/unix/include/named/os.h b/bin/named/unix/include/named/os.h index 1c4bec0707272..96604e54acd4b 100644 --- a/bin/named/unix/include/named/os.h +++ b/bin/named/unix/include/named/os.h @@ -1,5 +1,5 @@ /* - * Copyright (C) 2004, 2007 Internet Systems Consortium, Inc. ("ISC") + * Copyright (C) 2004, 2007, 2008 Internet Systems Consortium, Inc. ("ISC") * Copyright (C) 1999-2003 Internet Software Consortium. * * Permission to use, copy, modify, and/or distribute this software for any @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.h,v 1.14.2.2.8.12 2007/08/28 07:19:08 tbox Exp $ */ +/* $Id: os.h,v 1.14.2.2.8.14 2008/10/24 01:42:46 tbox Exp $ */ #ifndef NS_OS_H #define NS_OS_H 1 @@ -44,11 +44,13 @@ void ns_os_changeuser(void); void +ns_os_adjustnofile(void); + +void ns_os_minprivs(void); void ns_os_writepidfile(const char *filename, isc_boolean_t first_time); - void ns_os_shutdown(void); diff --git a/bin/named/unix/os.c b/bin/named/unix/os.c index f8026660391ea..3fe15cb1a0070 100644 --- a/bin/named/unix/os.c +++ b/bin/named/unix/os.c @@ -15,7 +15,7 @@ * PERFORMANCE OF THIS SOFTWARE. */ -/* $Id: os.c,v 1.46.2.4.8.30 2008/01/17 23:45:27 tbox Exp $ */ +/* $Id: os.c,v 1.46.2.4.8.33 2008/10/24 01:42:46 tbox Exp $ */ #include <config.h> #include <stdarg.h> @@ -40,6 +40,7 @@ #include <isc/buffer.h> #include <isc/file.h> #include <isc/print.h> +#include <isc/resource.h> #include <isc/result.h> #include <isc/strerror.h> #include <isc/string.h> @@ -114,6 +115,16 @@ static int dfd[2] = { -1, -1 }; static isc_boolean_t non_root = ISC_FALSE; static isc_boolean_t non_root_caps = ISC_FALSE; +#if defined(HAVE_CAPSET) +#undef _POSIX_SOURCE +#ifdef HAVE_SYS_CAPABILITY_H +#include <sys/capability.h> +#else +#include <linux/capability.h> +int capset(cap_user_header_t hdrp, const cap_user_data_t datap); +#endif +#include <sys/prctl.h> +#else /* * We define _LINUX_FS_H to prevent it from being included. We don't need * anything from it, and the files it includes cause warnings with 2.2 @@ -146,6 +157,7 @@ static isc_boolean_t non_root_caps = ISC_FALSE; #endif #define SYS_capset __NR_capset #endif +#endif static void linux_setcaps(unsigned int caps) { @@ -163,13 +175,23 @@ linux_setcaps(unsigned int caps) { cap.effective = caps; cap.permitted = caps; cap.inheritable = 0; - if (syscall(SYS_capset, &caphead, &cap) < 0) { +#ifdef HAVE_CAPSET + if (capset(&caphead, &cap) < 0 ) { isc__strerror(errno, strbuf, sizeof(strbuf)); ns_main_earlyfatal("capset failed: %s:" " please ensure that the capset kernel" " module is loaded. see insmod(8)", strbuf); } +#else + if (syscall(SYS_capset, &caphead, &cap) < 0) { + isc__strerror(errno, strbuf, sizeof(strbuf)); + ns_main_earlyfatal("syscall(capset) failed: %s:" + " please ensure that the capset kernel" + " module is loaded. see insmod(8)", + strbuf); + } +#endif } static void @@ -511,6 +533,24 @@ ns_os_changeuser(void) { } void +ns_os_adjustnofile() { +#ifdef HAVE_LINUXTHREADS + isc_result_t result; + isc_resourcevalue_t newvalue; + + /* + * Linux: max number of open files specified by one thread doesn't seem + * to apply to other threads on Linux. + */ + newvalue = ISC_RESOURCE_UNLIMITED; + + result = isc_resource_setlimit(isc_resource_openfiles, newvalue); + if (result != ISC_R_SUCCESS) + ns_main_earlywarning("couldn't adjust limit on open files"); +#endif +} + +void ns_os_minprivs(void) { #ifdef HAVE_SYS_PRCTL_H linux_keepcaps(); |