Add check for required Linux capabilities.

Signed-off-by: DL6ER <dl6er@dl6er.de>

Makefile

@@ -14,7 +14,7 @@ DNSMASQOPTS = -DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC
 # Flags for compiling with libidn2: -DHAVE_LIBIDN2 -DIDN2_VERSION_NUMBER=0x02000003
 
 FTLDEPS = FTL.h routines.h version.h api.h dnsmasq_interface.h shmem.h
-FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o grep.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o
+FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o grep.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o capabilities.o
 
 DNSMASQDEPS = config.h dhcp-protocol.h dns-protocol.h radv-protocol.h dhcp6-protocol.h dnsmasq.h ip6addr.h metrics.h
 DNSMASQOBJ = arp.o dbus.o domain.o lease.o outpacket.o rrfilter.o auth.o dhcp6.o edns0.o log.o poll.o slaac.o blockdata.o dhcp.o forward.o loop.o radv.o tables.o bpf.o dhcp-common.o helper.o netlink.o rfc1035.o tftp.o cache.o dnsmasq.o inotify.o network.o rfc2131.o util.o conntrack.o dnssec.o ipset.o option.o rfc3315.o crypto.o dump.o ubus.o metrics.o
@@ -51,7 +51,7 @@ CCFLAGS=-std=gnu11 -I$(IDIR) -Wall -Wextra -Wno-unused-parameter -D_FILE_OFFSET_
 # for dnsmasq we need the nettle crypto library and the gmp maths library
 # We link the two libraries statically. Althougth this increases the binary file size by about 1 MB, it saves about 5 MB of shared libraries and makes deployment easier
 #LIBS=-pthread -lnettle -lgmp -lhogweed
-LIBS=-pthread -Wl,-Bstatic -L/usr/local/lib -lhogweed -lgmp -lnettle  -Wl,-Bdynamic -lrt
+LIBS=-pthread -Wl,-Bstatic -L/usr/local/lib -lhogweed -lgmp -lnettle -Wl,-Bdynamic -lrt -lcap
 # Flags for compiling with libidn : -lidn
 # Flags for compiling with libidn2: -lidn2
 

capabilities.c

@@ -0,0 +1,37 @@
+/* Pi-hole: A black hole for Internet advertisements
+*  (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+*  Network-wide ad blocking via your own hardware.
+*
+*  FTL Engine
+*  Linux capability check routines
+*
+*  This file is copyright under the latest version of the EUPL.
+*  Please see LICENSE file for your rights under this license. */
+
+#include "FTL.h"
+#include <sys/capability.h>
+
+bool check_capabilities()
+{
+	if(!cap_get_bound(CAP_NET_ADMIN))
+	{
+		// Needed for ARP-injection (used when we're the DHCP server)
+		logg("FATAL: Required linux capability CAP_NET_ADMIN not available");
+		return false;
+	}
+	if(!cap_get_bound(CAP_NET_RAW))
+	{
+		// Needed for raw socket access (necessary for ICMP)
+		logg("FATAL: Required linux capability CAP_NET_RAW not available");
+		return false;
+	}
+	if(!cap_get_bound(CAP_NET_BIND_SERVICE))
+	{
+		// Necessary for dynamic port binding
+		logg("FATAL: Required linux capability CAP_NET_BIND_SERVICE not available");
+		return false;
+	}
+
+	// All okay!
+	return true;
+}

main.c

@@ -69,8 +69,11 @@ int main (int argc, char* argv[])
 	log_counter_info();
 	check_setupVarsconf();
 
-	// Preparations done - start the resolver
-	main_dnsmasq(argc_dnsmasq, argv_dnsmasq);
+	// Check for availability of advanced capabilities
+	// immediately before starting the resolver. If all
+	// capabilities are available, we start the resolver
+	if(check_capabiltities())
+		main_dnsmasq(argc_dnsmasq, argv_dnsmasq);
 
 	logg("Shutting down...");
 

routines.h

@@ -126,3 +126,6 @@ void newOverTimeClient();
  * This also updates `overTimeClientData`.
  */
 void addOverTimeClientSlot();
+
+// capabilities.c
+bool check_capabilities(void);