[
https://issues.apache.org/jira/browse/TS-1687?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13580057#comment-13580057
]
Igor Galić commented on TS-1687:
--------------------------------
Sorry, just ignore anything I ever said about FreeBSD.
{code}
# include <sys/capability.h>
# include <stdio.h>
# include <stdlib.h>
# include <sys/procdesc.h>
# include <string.h>
# include <errno.h>
int main (int argc, char *argv[])
{
int pfd, pid, cap_fd, status;
pid = pdfork(&pfd, 0);
if (pid < 0) {
fprintf(stderr, "failed to pdfork: (%d): %s\n", errno, strerror(errno));
exit(EXIT_FAILURE);
}
if (pid > 0) {
cap_fd = cap_new(pfd, CAP_ACCEPT|CAP_CONNECT|CAP_BIND|CAP_LISTEN);
if (cap_fd < 0) {
fprintf(stderr, "failed to drop privileges: (%d): %s\n", errno,
strerror(errno));
exit(EXIT_FAILURE);
}
}
status = cap_enter();
if (status < 0) {
fprintf(stderr, "failed to enter sandbox: (%d): %s\n", errno,
strerror(errno));
exit(EXIT_FAILURE);
}
return 0;
}
{code}
Result:
{noformat}
igalic@daemonix ~/src/cap % ./daemon
failed to pdfork: (78): Function not implemented
{noformat}
> Solaris has POSIX capabilities, but TPROXY doesn't know of these.
> ------------------------------------------------------------------
>
> Key: TS-1687
> URL: https://issues.apache.org/jira/browse/TS-1687
> Project: Traffic Server
> Issue Type: Bug
> Reporter: Igor Galić
>
> When compiling ATS for Solaris, enabling the full feature set is impossible
> because currently the handling of POSIX capabilities (privileges under
> Solaris) is restricted to Linux:
> {noformat}
> checking whether to enable transparent proxy... configure: error: in
> `/home/i.galic/src/trafficserver':
> configure: error: TPROXY feature requires POSIX capabilities.
> {noformat}
> Here's the man page documenting
> [privileges(5)|http://illumos.org/man/5/privileges] - and here's a sample
> use, in the form of Apache httpd's
> [mod_pvivileges|https://svn.apache.org/repos/asf/httpd/httpd/trunk/modules/arch/unix/mod_privileges.c]
> Further man relevant man pages: [getpriv(2),
> setppriv(2)|http://illumos.org/man/2/setppriv] [getpflags(2),
> setpflags(2)|http://illumos.org/man/2/setpflags]
> As well as the "highlevel API" (convinience wrappers) such as
> [priv_set(3C)|http://illumos.org/man/3C/priv_set]
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira
