From 070feb630a9e16e95c01aacbbee6d71c851ca3fd Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Wed, 2 Jan 2019 17:56:12 +0100
Subject: [PATCH] Add check for required Linux capabilities.

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 Makefile       |  4 ++--
 capabilities.c | 37 +++++++++++++++++++++++++++++++++++++
 main.c         |  7 +++++--
 routines.h     |  3 +++
 4 files changed, 47 insertions(+), 4 deletions(-)
 create mode 100644 capabilities.c

diff --git a/Makefile b/Makefile
index 6e27a0e7..d74d593f 100644
--- a/Makefile
+++ b/Makefile
@@ -14,7 +14,7 @@ DNSMASQOPTS = -DHAVE_DNSSEC -DHAVE_DNSSEC_STATIC
 # Flags for compiling with libidn2: -DHAVE_LIBIDN2 -DIDN2_VERSION_NUMBER=0x02000003
 
 FTLDEPS = FTL.h routines.h version.h api.h dnsmasq_interface.h shmem.h
-FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o grep.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o
+FTLOBJ = main.o memory.o log.o daemon.o datastructure.o signals.o socket.o request.o grep.o setupVars.o args.o gc.o config.o database.o msgpack.o api.o dnsmasq_interface.o resolve.o regex.o shmem.o capabilities.o
 
 DNSMASQDEPS = config.h dhcp-protocol.h dns-protocol.h radv-protocol.h dhcp6-protocol.h dnsmasq.h ip6addr.h metrics.h
 DNSMASQOBJ = arp.o dbus.o domain.o lease.o outpacket.o rrfilter.o auth.o dhcp6.o edns0.o log.o poll.o slaac.o blockdata.o dhcp.o forward.o loop.o radv.o tables.o bpf.o dhcp-common.o helper.o netlink.o rfc1035.o tftp.o cache.o dnsmasq.o inotify.o network.o rfc2131.o util.o conntrack.o dnssec.o ipset.o option.o rfc3315.o crypto.o dump.o ubus.o metrics.o
@@ -51,7 +51,7 @@ CCFLAGS=-std=gnu11 -I$(IDIR) -Wall -Wextra -Wno-unused-parameter -D_FILE_OFFSET_
 # for dnsmasq we need the nettle crypto library and the gmp maths library
 # We link the two libraries statically. Althougth this increases the binary file size by about 1 MB, it saves about 5 MB of shared libraries and makes deployment easier
 #LIBS=-pthread -lnettle -lgmp -lhogweed
-LIBS=-pthread -Wl,-Bstatic -L/usr/local/lib -lhogweed -lgmp -lnettle  -Wl,-Bdynamic -lrt
+LIBS=-pthread -Wl,-Bstatic -L/usr/local/lib -lhogweed -lgmp -lnettle -Wl,-Bdynamic -lrt -lcap
 # Flags for compiling with libidn : -lidn
 # Flags for compiling with libidn2: -lidn2
 
diff --git a/capabilities.c b/capabilities.c
new file mode 100644
index 00000000..633cd0f0
--- /dev/null
+++ b/capabilities.c
@@ -0,0 +1,37 @@
+/* Pi-hole: A black hole for Internet advertisements
+*  (c) 2017 Pi-hole, LLC (https://pi-hole.net)
+*  Network-wide ad blocking via your own hardware.
+*
+*  FTL Engine
+*  Linux capability check routines
+*
+*  This file is copyright under the latest version of the EUPL.
+*  Please see LICENSE file for your rights under this license. */
+
+#include "FTL.h"
+#include <sys/capability.h>
+
+bool check_capabilities()
+{
+	if(!cap_get_bound(CAP_NET_ADMIN))
+	{
+		// Needed for ARP-injection (used when we're the DHCP server)
+		logg("FATAL: Required linux capability CAP_NET_ADMIN not available");
+		return false;
+	}
+	if(!cap_get_bound(CAP_NET_RAW))
+	{
+		// Needed for raw socket access (necessary for ICMP)
+		logg("FATAL: Required linux capability CAP_NET_RAW not available");
+		return false;
+	}
+	if(!cap_get_bound(CAP_NET_BIND_SERVICE))
+	{
+		// Necessary for dynamic port binding
+		logg("FATAL: Required linux capability CAP_NET_BIND_SERVICE not available");
+		return false;
+	}
+
+	// All okay!
+	return true;
+}
diff --git a/main.c b/main.c
index a785a650..41664a45 100644
--- a/main.c
+++ b/main.c
@@ -69,8 +69,11 @@ int main (int argc, char* argv[])
 	log_counter_info();
 	check_setupVarsconf();
 
-	// Preparations done - start the resolver
-	main_dnsmasq(argc_dnsmasq, argv_dnsmasq);
+	// Check for availability of advanced capabilities
+	// immediately before starting the resolver. If all
+	// capabilities are available, we start the resolver
+	if(check_capabiltities())
+		main_dnsmasq(argc_dnsmasq, argv_dnsmasq);
 
 	logg("Shutting down...");
 
diff --git a/routines.h b/routines.h
index b4ad082b..a5c9b100 100644
--- a/routines.h
+++ b/routines.h
@@ -126,3 +126,6 @@ void newOverTimeClient();
  * This also updates `overTimeClientData`.
  */
 void addOverTimeClientSlot();
+
+// capabilities.c
+bool check_capabilities(void);