Hi Andrew, this is the current debdiff against 3.1.1-5. Applies cleanly, and this patch hasn't caused any trouble in years.
Thanks for considering, Martin -- Martin Pitt | http://www.piware.de Ubuntu Developer (www.ubuntu.com) | Debian Developer (www.debian.org)
diff -u dhcp3-3.1.1/debian/control dhcp3-3.1.1/debian/control
--- dhcp3-3.1.1/debian/control
+++ dhcp3-3.1.1/debian/control
@@ -3,7 +3,7 @@
Priority: important
Maintainer: Andrew Pollock <[EMAIL PROTECTED]>
Uploaders: Eloy A. Paris <[EMAIL PROTECTED]>
-Build-Depends: debhelper (>= 4.1.16), dpkg-dev (>= 1.13.2), groff, dpatch, po-debconf, libldap2-dev, libssl-dev
+Build-Depends: debhelper (>= 4.1.16), dpkg-dev (>= 1.13.2), groff, dpatch, po-debconf, libldap2-dev, libssl-dev, libcap-dev
Standards-Version: 3.8.0
Package: dhcp3-server
diff -u dhcp3-3.1.1/debian/changelog dhcp3-3.1.1/debian/changelog
--- dhcp3-3.1.1/debian/changelog
+++ dhcp3-3.1.1/debian/changelog
@@ -1,3 +1,15 @@
+dhcp3 (3.1.1-5serverderoot1) unstable; urgency=low
+
+ * Do not run server as root: (Closes: #308832)
+ - Add debian/patches/droppriv.dpatch, deroot-server.dpatch: Drop root
+ privileges to dhcpd system user as soon as possible.
+ - debian/control: Build-depend on libcap-dev.
+ - debian/dhcp3-server.postinst: Create dhcpd system user.
+ - debian/dhcp3-server.init.d: Create paths with appropriate permissions
+ for dhcpd system user access.
+
+ -- Martin Pitt <[EMAIL PROTECTED]> Tue, 11 Nov 2008 13:50:40 +0100
+
dhcp3 (3.1.1-5) unstable; urgency=high
* Really incorporate previous (3.1.1-3.1) NMU (closes: #484424, #484261)
diff -u dhcp3-3.1.1/debian/dhcp3-server.init.d dhcp3-3.1.1/debian/dhcp3-server.init.d
--- dhcp3-3.1.1/debian/dhcp3-server.init.d
+++ dhcp3-3.1.1/debian/dhcp3-server.init.d
@@ -34,7 +34,7 @@
NAME=dhcpd3
DESC="DHCP server"
-DHCPDPID=/var/run/dhcpd.pid
+DHCPDPID=/var/run/dhcp3-server/dhcpd.pid
test_config()
{
@@ -66,8 +66,18 @@
start)
test_config
log_daemon_msg "Starting $DESC" "$NAME"
+
+ # allow dhcp server to write lease and pid file
+ mkdir -p /var/run/dhcp3-server
+ chown dhcpd:dhcpd /var/run/dhcp3-server
+ [ -e /var/lib/dhcp3/dhcpd.leases ] || touch /var/lib/dhcp3/dhcpd.leases
+ chown dhcpd:dhcpd /var/lib/dhcp3 /var/lib/dhcp3/dhcpd.leases
+ if [ -e /var/lib/dhcp3/dhcpd.leases~ ]; then
+ chown dhcpd:dhcpd /var/lib/dhcp3/dhcpd.leases~
+ fi
+
start-stop-daemon --start --quiet --pidfile $DHCPDPID \
- --exec /usr/sbin/dhcpd3 -- -q $INTERFACES
+ --exec /usr/sbin/dhcpd3 -- -q -pf $DHCPDPID $INTERFACES
sleep 2
if check_status -q; then
diff -u dhcp3-3.1.1/debian/dhcp3-server.postinst dhcp3-3.1.1/debian/dhcp3-server.postinst
--- dhcp3-3.1.1/debian/dhcp3-server.postinst
+++ dhcp3-3.1.1/debian/dhcp3-server.postinst
@@ -9,7 +9,8 @@
case "$1" in
configure)
- # continue below
+ # create system dhcpd user and group
+ adduser --system --quiet --no-create-home --home /var/run --group dhcpd
;;
abort-upgrade|abort-remove|abort-deconfigure)
diff -u dhcp3-3.1.1/debian/patches/00list dhcp3-3.1.1/debian/patches/00list
--- dhcp3-3.1.1/debian/patches/00list
+++ dhcp3-3.1.1/debian/patches/00list
@@ -20,6 +20,8 @@
kfreebsd
# emailed upstream (ISC-Bugs #18174)
dhclient-pretty_print-off-by-one
+droppriv
+deroot-server
#ldap backend for dhcp3 server (docs and code)
dhcp-3.1.0-ldap-docs
dhcp-3.1.0-ldap-code
only in patch2:
unchanged:
--- dhcp3-3.1.1.orig/debian/patches/deroot-server.dpatch
+++ dhcp3-3.1.1/debian/patches/deroot-server.dpatch
@@ -0,0 +1,50 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## deroot-server.dpatch by Martin Pitt <[EMAIL PROTECTED]>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
[EMAIL PROTECTED]@
+diff -urNad dhcp3-3.1.1~/server/Makefile.dist dhcp3-3.1.1/server/Makefile.dist
+--- dhcp3-3.1.1~/server/Makefile.dist 2006-07-25 15:26:00.000000000 +0200
++++ dhcp3-3.1.1/server/Makefile.dist 2008-06-16 17:23:52.000000000 +0200
+@@ -22,6 +22,7 @@
+ # http://www.isc.org/
+ #
+
++LIBS = -lcap
+ CATMANPAGES = dhcpd.cat8 dhcpd.conf.cat5 dhcpd.leases.cat5
+ SEDMANPAGES = dhcpd.man8 dhcpd.conf.man5 dhcpd.leases.man5
+ SRCS = dhcpd.c dhcp.c bootp.c confpars.c db.c class.c failover.c \
+diff -urNad dhcp3-3.1.1~/server/dhcpd.c dhcp3-3.1.1/server/dhcpd.c
+--- dhcp3-3.1.1~/server/dhcpd.c 2008-06-16 17:23:04.000000000 +0200
++++ dhcp3-3.1.1/server/dhcpd.c 2008-06-16 17:23:05.000000000 +0200
+@@ -45,6 +45,7 @@
+
+ #include "dhcpd.h"
+ #include "version.h"
++#include "droppriv.h"
+ #include <omapip/omapip_p.h>
+
+ static void usage PROTO ((void));
+@@ -226,6 +227,10 @@
+ char *traceoutfile = (char *)0;
+ #endif
+
++ /* drop privileges */
++ cap_value_t capsneeded[] = { CAP_NET_RAW, CAP_NET_BIND_SERVICE };
++ drop_privileges( "dhcpd", "dhcpd", 2, capsneeded, -1 );
++
+ /* Make sure that file descriptors 0 (stdin), 1, (stdout), and
+ 2 (stderr) are open. To do this, we assume that when we
+ open a file the lowest available file decriptor is used. */
+@@ -604,6 +609,9 @@
+ omapi_set_int_value ((omapi_object_t *)dhcp_control_object,
+ (omapi_object_t *)0, "state", server_running);
+
++ /* drop all remaining capabilities */
++ drop_privileges( "dhcpd", "dhcpd", 0, NULL, -1 );
++
+ /* Receive packets and dispatch them... */
+ dispatch ();
+
only in patch2:
unchanged:
--- dhcp3-3.1.1.orig/debian/patches/droppriv.dpatch
+++ dhcp3-3.1.1/debian/patches/droppriv.dpatch
@@ -0,0 +1,159 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## droppriv.dpatch by <[EMAIL PROTECTED]>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
[EMAIL PROTECTED]@
+diff -urNad dhcp3-3.0.5~/common/Makefile.dist dhcp3-3.0.5/common/Makefile.dist
+--- dhcp3-3.0.5~/common/Makefile.dist 2004-09-21 22:33:35.000000000 +0200
++++ dhcp3-3.0.5/common/Makefile.dist 2007-07-16 17:12:36.000000000 +0200
+@@ -25,11 +25,11 @@
+ SRC = raw.c parse.c nit.c icmp.c dispatch.c conflex.c upf.c bpf.c socket.c \
+ lpf.c dlpi.c packet.c tr.c ethernet.c memory.c print.c options.c \
+ inet.c tree.c tables.c alloc.c fddi.c ctrace.c dns.c resolv.c \
+- execute.c discover.c comapi.c
++ execute.c discover.c comapi.c droppriv.c
+ OBJ = raw.o parse.o nit.o icmp.o dispatch.o conflex.o upf.o bpf.o socket.o \
+ lpf.o dlpi.o packet.o tr.o ethernet.o memory.o print.o options.o \
+ inet.o tree.o tables.o alloc.o fddi.o ctrace.o dns.o resolv.o \
+- execute.o discover.o comapi.o
++ execute.o discover.o comapi.o droppriv.o
+ MAN = dhcp-options.5 dhcp-eval.5
+
+ INCLUDES = -I$(TOP) $(BINDINC) -I$(TOP)/includes
+diff -urNad dhcp3-3.0.5~/common/droppriv.c dhcp3-3.0.5/common/droppriv.c
+--- dhcp3-3.0.5~/common/droppriv.c 1970-01-01 01:00:00.000000000 +0100
++++ dhcp3-3.0.5/common/droppriv.c 2007-07-16 17:12:52.000000000 +0200
+@@ -0,0 +1,96 @@
++/**
++ * droppriv.c - drop privileges of a program running as root
++ *
++ * (C) 2004 Martin Pitt <[EMAIL PROTECTED]>
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ */
++
++#include "droppriv.h"
++#include <sys/prctl.h>
++#include <stdio.h>
++#include <unistd.h>
++#include <pwd.h>
++#include <grp.h>
++
++void
++drop_privileges( const char* user, const char* group, int numcaps,
++ cap_value_t* caps, int errorexit )
++{
++ cap_t cap;
++ struct passwd *pw = NULL;
++ struct group *gr = NULL;
++
++ /* determine user and group id */
++ if( user != NULL ) {
++ pw = getpwnam( user );
++ if( !pw ) {
++ fprintf( stderr, "drop_privileges: WARNING: user %s does not exist, keeping root privileges\n", user );
++ return;
++ }
++ }
++
++ if( group != NULL ) {
++ gr = getgrnam( group );
++ if( !gr ) {
++ fprintf( stderr, "drop_privileges: WARNING: group %s does not exist, keeping root privileges\n", group );
++ return;
++ }
++ }
++
++ /* keep capabilities */
++ if( numcaps > 0 ) {
++ int result;
++
++ if( prctl( PR_SET_KEEPCAPS, 1, 0, 0, 0 ) ) {
++ perror( "drop_privileges: could not keep capabilities" );
++ exit( errorexit );
++ }
++
++ /* test whether cap_set_proc works */
++ cap = cap_get_proc();
++ if( cap ) {
++ result = cap_set_proc( cap );
++ cap_free( cap );
++ if( result )
++ return;
++ } else
++ return;
++ }
++
++
++ /* change uid/gid */
++ if( gr != NULL && setgid( gr->gr_gid ) ) {
++ perror( "drop_privileges: could not set group id" );
++ exit( errorexit );
++ }
++
++ if( pw != NULL && setuid( pw->pw_uid ) ) {
++ perror( "drop_privileges: could not set user id" );
++ exit( errorexit );
++ }
++
++ /* set necessary capabilities */
++ if( numcaps > 0 ) {
++ cap = cap_init();
++ if( cap_set_flag( cap, CAP_PERMITTED, numcaps, caps, CAP_SET ) ||
++ cap_set_flag( cap, CAP_EFFECTIVE, numcaps, caps, CAP_SET ) ) {
++ perror( "drop_privileges: cap_set_flag" );
++ exit( errorexit );
++ }
++
++ if( cap_set_proc( cap ) ) {
++ perror( "drop_privileges: could not install capabilities" );
++ exit( errorexit );
++ }
++
++ if( cap_free( cap ) ) {
++ perror( "drop_privileges: cap_free" );
++ exit( errorexit );
++ }
++ }
++}
++
+diff -urNad dhcp3-3.0.5~/includes/droppriv.h dhcp3-3.0.5/includes/droppriv.h
+--- dhcp3-3.0.5~/includes/droppriv.h 1970-01-01 01:00:00.000000000 +0100
++++ dhcp3-3.0.5/includes/droppriv.h 2007-07-16 17:12:36.000000000 +0200
+@@ -0,0 +1,31 @@
++/**
++ * droppriv.h - drop privileges of a program running as root
++ *
++ * (C) 2004 Martin Pitt <[EMAIL PROTECTED]>
++ *
++ * Permission to use, copy, modify, and distribute this software for any
++ * purpose with or without fee is hereby granted, provided that the above
++ * copyright notice and this permission notice appear in all copies.
++ *
++ */
++
++#ifndef _DROPPRIV_H
++#define _DROPPRIV_H
++
++#include <sys/capability.h>
++
++/**
++ * Drop all but necessary privileges from a program that is started as
++ * root. Set the running user id and group id to the corresponding
++ * values of 'user' and 'group' (NULL values cause the current
++ * user/group not to change). Drops all capabilities but the
++ * ones specified in caps. numcaps is the number of entries in
++ * caps. On error, a message is printed to stderr and the program
++ * terminates with exit code 'errorexit'.
++ */
++void
++drop_privileges( const char* user, const char* group, int numcaps,
++ cap_value_t* caps, int errorexit );
++
++#endif
++
signature.asc
Description: Digital signature
