Thread: simple cap_get_flag() example showing the error as invalid arugment.

  1. #1
    Registered User
    Join Date
    Mar 2008
    Location
    India
    Posts
    147

    simple cap_get_flag() example showing the error as invalid arugment.

    Hi ,

    I am trying out simple example for cap_get_flag.

    setting some capability and in next line try to get the same .

    some how it is giving a error.

    Not able to know, what exactly missing here.

    Any pointers would be highly helpfull.

    Code:
    #include <stdio.h>
    #include <sys/capability.h>
    #include <sys/types.h>
    #include <syslog.h>
    
    int main() {
    
        cap_t caps;
        cap_value_t cap_list[3];
    
        cap_list[0] = CAP_SETUID;
        cap_list[1] = CAP_SETGID;
        cap_list[2] = CAP_NET_ADMIN;
        caps = cap_get_proc();
    
        if(caps != NULL) {
            cap_set_flag(caps, CAP_EFFECTIVE, 2, cap_list, CAP_SET);
            cap_set_flag(caps, CAP_INHERITABLE, 2, cap_list, CAP_SET);
            cap_set_flag(caps, CAP_PERMITTED, 2, cap_list, CAP_SET);
            cap_set_proc(caps);
        } else {
            syslog(LOG_DEBUG, "Cap_get_proc() failed");
        }
    
        if (caps == NULL) {
            perror("cap_get_proc");
            return 1;
        }
    
        cap_flag_value_t flag_value;
        if (cap_get_flag(caps, CAP_EFFECTIVE, CAP_NET_ADMIN, &flag_value) == -1) {
            perror("cap_get_flag");
            return 1;
        }
    
        if (flag_value == CAP_SET) {
            printf("CAP_NET_BIND_SERVICE capability is set.\n");
        } else {
            printf("CAP_NET_BIND_SERVICE capability is not set.\n");
        }
    
        cap_free(caps);
        return 0;
    }
    output:
    [root@141179 cprog]# ./a.out
    cap_get_flag: Invalid argument

  2. #2
    and the hat of int overfl Salem's Avatar
    Join Date
    Aug 2001
    Location
    The edge of the known universe
    Posts
    39,675
    > cap_set_flag(caps, CAP_EFFECTIVE, 2, cap_list, CAP_SET);
    Why are you passing 2, when there are 3 elements in your list?
    If you dance barefoot on the broken glass of undefined behaviour, you've got to expect the occasional cut.
    If at first you don't succeed, try writing your phone number on the exam paper.

  3. #3
    Registered User
    Join Date
    Mar 2008
    Location
    India
    Posts
    147
    I changed to 3 , still it's same result.

    But on the first hand it should have been 3 only , as the number of capabilities want to give set should be mentioned here.

  4. #4
    Registered User
    Join Date
    Dec 2017
    Posts
    1,664
    Check the return values of the cap_set_flag calls and the cap_set_proc call.
    All truths are half-truths. - A.N. Whitehead

  5. #5
    Registered User
    Join Date
    Mar 2008
    Location
    India
    Posts
    147
    Code:
        
    if (cap_get_flag(caps, CAP_NET_ADMIN, CAP_EFFECTIVE, &flag_value) == -1) {
            perror("cap_get_flag");
            return 1;
        }
    above one works fine.

  6. #6
    Registered User
    Join Date
    Mar 2008
    Location
    India
    Posts
    147
    continuing on the same.

    My goal is to set some capabilities to process dynamically and then using setuid and setgid go to non root.
    So that some of the capabilities can be still there to the process even after turns in to non root.

    But it does not reflect in the cap_get_flag or /proc/<pid>/status in the CapEff.

    below is the complete code

    Code:
    #include <stdio.h>
    #include <sys/capability.h>
    #include <sys/types.h>
    #include <syslog.h>
    #include <unistd.h>
    
    int main() {
    
        cap_t caps,capsg;
        cap_value_t cap_list[3];
    
        cap_list[0] = CAP_SETUID;
        cap_list[1] = CAP_SETGID;
        cap_list[2] = CAP_NET_ADMIN;
        caps = cap_get_proc();
    
        if(caps != NULL) {
            cap_set_flag(caps, CAP_EFFECTIVE, 3, cap_list, CAP_SET);
            cap_set_flag(caps, CAP_INHERITABLE, 3, cap_list, CAP_SET);
            cap_set_flag(caps, CAP_PERMITTED, 3, cap_list, CAP_SET);
            cap_set_proc(caps);
        } else {
            syslog(LOG_DEBUG, "Cap_get_proc() failed");
        }
    
        if (caps == NULL) {
                perror("cap_get_proc");
                return 1;
        }
    
        if (!setgid(500)) {
                printf("Success in setting Srvr to non root group: euid %d egid %d \n",geteuid(), getegid());
                if (!setuid(2006)) {
                        printf("Success in setting Srvr to non root user :euid %d egid %d \n",geteuid(), getegid());
                } else {
                        printf("Failure in setting Srvr back to root group after setuid failure :euid %d egid %d \n",geteuid(), getegid());
                }
        } else {
                printf("Failure in setting Srvr to non root group,continuing with root user \n");
        }
    
    
        capsg = cap_get_proc();
    
        cap_flag_value_t flag_value;
        if (cap_get_flag(capsg, CAP_NET_ADMIN, CAP_EFFECTIVE, &flag_value) == -1) {
            perror("cap_get_flag");
            return 1;
        }
    
        if (flag_value == CAP_SET) {
            printf("CAP_NET_BIND_SERVICE capability is set.\n");
        } else {
            printf("CAP_NET_BIND_SERVICE capability is not set.\n");
        }
        sleep(10000);
        cap_free(caps);
        cap_free(capsg);
        return 0;
    }
    output:
    Success in setting Srvr to non root group: euid 0 egid 500
    Success in setting Srvr to non root user :euid 2006 egid 500
    CAP_NET_BIND_SERVICE capability is not set.


    Any pointers / leads will help me here.

Popular pages Recent additions subscribe to a feed

Similar Threads

  1. Simple valid/invalid function problem.
    By ariella in forum C Programming
    Replies: 4
    Last Post: 07-13-2013, 09:34 AM
  2. Code showing error
    By chaklader in forum C++ Programming
    Replies: 11
    Last Post: 01-25-2012, 06:58 AM
  3. Code showing error
    By chaklader in forum C++ Programming
    Replies: 5
    Last Post: 01-05-2012, 01:15 AM
  4. GDB showing memory error
    By SasDutta in forum C Programming
    Replies: 3
    Last Post: 12-17-2010, 01:51 PM

Tags for this Thread