SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

parse-helpers: allow port 0 for socket bind items

Browse Source 
This patch adds a new parameter to parse_ip_port_range, giving callers
the option to allow ranges to have their min be 0 instead of 1.

This is then used by parse_ip_ports_token, intern used by
parse_socket_bind_item to allow port 0 when restricting bind system
calls with SocketBindDeny / SocketBindAllow.

With this, users running server software written using the golang
standard library will be able to effectively sandbox their software,
albeit with a small loss in security protections by allowing the
process to bind on a random port in the
/proc/sys/net/ipv4/ip_local_port_range.
This commit is contained in:
networkException
2024-01-06 08:27:14 +09:00
committed by Yu Watanabe
parent 9807ee19b0
commit dcfac3a3f9
6 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/parse-util.c
+5 -2
View File
@@ -691,7 +691,7 @@ int parse_ip_port(const char *s, uint16_t *ret) {
return 0;
}
int parse_ip_port_range(const char *s, uint16_t *low, uint16_t *high) {
int parse_ip_port_range(const char *s, uint16_t *low, uint16_t *high, bool allow_zero) {
unsigned l, h;
int r;
@@ -699,7 +699,10 @@ int parse_ip_port_range(const char *s, uint16_t *low, uint16_t *high) {
if (r < 0)
return r;
if (l <= 0 || l > 65535 || h <= 0 || h > 65535)
if (l > 65535 || h > 65535)
return -EINVAL;
if (!allow_zero && (l == 0 || h == 0))
return -EINVAL;
if (h < l)