Mercurial > hg > nginx

comparison auto/os/linux @ 7176:7f28b61c92f0

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Fixed capabilities version. Previously, capset(2) was called with the 64-bit capabilities version _LINUX_CAPABILITY_VERSION_3. With this version Linux kernel expected two copies of struct __user_cap_data_struct, while only one was submitted. As a result, random stack memory was accessed and random capabilities were requested by the worker. This sometimes caused capset() errors. Now the 32-bit version _LINUX_CAPABILITY_VERSION_1 is used instead. This is OK since CAP_NET_RAW is a 32-bit capability (CAP_NET_RAW = 13).
author Roman Arutyunyan <arut@nginx.com>
date Tue, 19 Dec 2017 19:00:27 +0300
parents 56923e8e01a5
children f7e79596baf2
comparison
equal deleted inserted replaced
7175:56923e8e01a5 7176:7f28b61c92f0
179 ngx_feature_path= 179 ngx_feature_path=
180 ngx_feature_libs= 180 ngx_feature_libs=
181 ngx_feature_test="struct __user_cap_data_struct data; 181 ngx_feature_test="struct __user_cap_data_struct data;
182 struct __user_cap_header_struct header; 182 struct __user_cap_header_struct header;
183 183
184 header.version = _LINUX_CAPABILITY_VERSION_3; 184 header.version = _LINUX_CAPABILITY_VERSION_1;
185 data.effective = CAP_TO_MASK(CAP_NET_RAW); 185 data.effective = CAP_TO_MASK(CAP_NET_RAW);
186 data.permitted = 0; 186 data.permitted = 0;
187 187
188 (void) SYS_capset" 188 (void) SYS_capset"
189 . auto/feature 189 . auto/feature