thevar1able/ClickHouse
1
0
Fork 0
mirror of https://github.com/ClickHouse/ClickHouse.git synced 2024-11-24 00:22:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #60775 from azat/fix-32-bit-capabilities

Browse Source 
Use 64-bit capabilities if available
This commit is contained in:
Alexey Milovidov 2024-03-05 04:52:27 +03:00 committed by GitHub
commit fb9250a1ac
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 32 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

39
src/Common/hasLinuxCapability.cpp
View File

@ -5,6 +5,8 @@
#include <syscall.h>
#include <unistd.h>
#include <linux/capability.h>
#include <cstdint>
#include <base/types.h>
#include <Common/Exception.h>
@ -16,25 +18,48 @@ namespace ErrorCodes
extern const int NETLINK_ERROR;
}
static __user_cap_data_struct getCapabilities()
struct Capabilities
{
UInt64 effective;
UInt64 permitted;
UInt64 inheritable;
};
static Capabilities getCapabilities()
{
/// See man getcap.
__user_cap_header_struct request{};
request.version = _LINUX_CAPABILITY_VERSION_1; /// It's enough to check just single CAP_NET_ADMIN capability we are interested.
request.version = _LINUX_CAPABILITY_VERSION_3;
request.pid = getpid();
__user_cap_data_struct response{};
Capabilities ret{};
__user_cap_data_struct response[2] = {};
/// Avoid dependency on 'libcap'.
if (0 != syscall(SYS_capget, &request, &response))
throw ErrnoException(ErrorCodes::NETLINK_ERROR, "Cannot do 'capget' syscall");
if (0 == syscall(SYS_capget, &request, response))
{
ret.effective = static_cast<UInt64>(response[1].effective) << 32 | response[0].effective;
ret.permitted = static_cast<UInt64>(response[1].permitted) << 32 | response[0].permitted;
ret.inheritable = static_cast<UInt64>(response[1].inheritable) << 32 | response[0].inheritable;
return ret;
}
return response;
/// Does not supports V3, fallback to V1.
/// It's enough to check just single CAP_NET_ADMIN capability we are interested.
if (errno == EINVAL && 0 == syscall(SYS_capget, &request, response))
{
ret.effective = response[0].effective;
ret.permitted = response[0].permitted;
ret.inheritable = response[0].inheritable;
return ret;
}
throw ErrnoException(ErrorCodes::NETLINK_ERROR, "Cannot do 'capget' syscall");
}
bool hasLinuxCapability(int cap)
{
static __user_cap_data_struct capabilities = getCapabilities();
static Capabilities capabilities = getCapabilities();
return (1 << cap) & capabilities.effective;
}