diff --git a/binaries/aarch64/nfqws b/binaries/aarch64/nfqws index 5fc34f9..daa9e29 100755 Binary files a/binaries/aarch64/nfqws and b/binaries/aarch64/nfqws differ diff --git a/binaries/aarch64/tpws b/binaries/aarch64/tpws index 940f18f..7251608 100755 Binary files a/binaries/aarch64/tpws and b/binaries/aarch64/tpws differ diff --git a/binaries/armhf/nfqws b/binaries/armhf/nfqws index 48f6fd2..a18205b 100755 Binary files a/binaries/armhf/nfqws and b/binaries/armhf/nfqws differ diff --git a/binaries/armhf/tpws b/binaries/armhf/tpws index 2eec4c2..c1d419b 100755 Binary files a/binaries/armhf/tpws and b/binaries/armhf/tpws differ diff --git a/binaries/mips32r1-lsb/nfqws b/binaries/mips32r1-lsb/nfqws index cc517de..ac2ba62 100755 Binary files a/binaries/mips32r1-lsb/nfqws and b/binaries/mips32r1-lsb/nfqws differ diff --git a/binaries/mips32r1-lsb/tpws b/binaries/mips32r1-lsb/tpws index 1abafe5..d8cf1a9 100755 Binary files a/binaries/mips32r1-lsb/tpws and b/binaries/mips32r1-lsb/tpws differ diff --git a/binaries/mips32r1-msb/nfqws b/binaries/mips32r1-msb/nfqws index d723c3a..b33f8b2 100755 Binary files a/binaries/mips32r1-msb/nfqws and b/binaries/mips32r1-msb/nfqws differ diff --git a/binaries/mips32r1-msb/tpws b/binaries/mips32r1-msb/tpws index 5c2dc94..6099d93 100755 Binary files a/binaries/mips32r1-msb/tpws and b/binaries/mips32r1-msb/tpws differ diff --git a/binaries/mips64r2-msb/nfqws b/binaries/mips64r2-msb/nfqws index 8f0d6aa..72f3f64 100755 Binary files a/binaries/mips64r2-msb/nfqws and b/binaries/mips64r2-msb/nfqws differ diff --git a/binaries/mips64r2-msb/tpws b/binaries/mips64r2-msb/tpws index 0a141b0..6a23a23 100755 Binary files a/binaries/mips64r2-msb/tpws and b/binaries/mips64r2-msb/tpws differ diff --git a/binaries/ppc/nfqws b/binaries/ppc/nfqws index 32c2a7e..837bd36 100755 Binary files a/binaries/ppc/nfqws and b/binaries/ppc/nfqws differ diff --git a/binaries/ppc/tpws b/binaries/ppc/tpws index 178c311..3dca18b 100755 Binary files a/binaries/ppc/tpws and b/binaries/ppc/tpws differ diff --git a/binaries/x86/nfqws b/binaries/x86/nfqws index 037e763..a3e2ea8 100755 Binary files a/binaries/x86/nfqws and b/binaries/x86/nfqws differ diff --git a/binaries/x86/tpws b/binaries/x86/tpws index ff0ad79..d6e6d5d 100755 Binary files a/binaries/x86/tpws and b/binaries/x86/tpws differ diff --git a/binaries/x86_64/nfqws b/binaries/x86_64/nfqws index 5212c80..a3ea1da 100755 Binary files a/binaries/x86_64/nfqws and b/binaries/x86_64/nfqws differ diff --git a/binaries/x86_64/tpws b/binaries/x86_64/tpws index 5ada2b0..a845204 100755 Binary files a/binaries/x86_64/tpws and b/binaries/x86_64/tpws differ diff --git a/nfq/nfqws.c b/nfq/nfqws.c index 4b6436b..19737db 100644 --- a/nfq/nfqws.c +++ b/nfq/nfqws.c @@ -387,23 +387,33 @@ bool setpcap(cap_value_t *caps,int ncaps) cap_free(capabilities); return true; } +int getmaxcap() +{ + int maxcap = CAP_LAST_CAP; + FILE *F = fopen("/proc/sys/kernel/cap_last_cap","r"); + if (F) + { + fscanf(F,"%d",&maxcap); + fclose(F); + } + return maxcap; + +} bool dropcaps() { // must have CAP_SETPCAP at the end. its required to clear bounding set cap_value_t cap_values[] = {CAP_NET_ADMIN,CAP_SETPCAP}; int capct=sizeof(cap_values)/sizeof(*cap_values); + int maxcap = getmaxcap(); if (setpcap(cap_values, capct)) { - for(int cap=0;cap<=63;cap++) + for(int cap=0;cap<=maxcap;cap++) { if (cap_drop_bound(cap)) { - if (errno!=EINVAL) - { - fprintf(stderr,"could not drop cap %d\n",cap); - perror("cap_drop_bound"); - } + fprintf(stderr,"could not drop cap %d\n",cap); + perror("cap_drop_bound"); } } } diff --git a/tpws/tpws.c b/tpws/tpws.c index 8d02596..ec462a5 100644 --- a/tpws/tpws.c +++ b/tpws/tpws.c @@ -816,23 +816,33 @@ bool setpcap(cap_value_t *caps,int ncaps) cap_free(capabilities); return true; } +int getmaxcap() +{ + int maxcap = CAP_LAST_CAP; + FILE *F = fopen("/proc/sys/kernel/cap_last_cap","r"); + if (F) + { + fscanf(F,"%d",&maxcap); + fclose(F); + } + return maxcap; + +} bool dropcaps() { // must have CAP_SETPCAP at the end. its required to clear bounding set cap_value_t cap_values[] = {CAP_SETPCAP}; int capct=sizeof(cap_values)/sizeof(*cap_values); + int maxcap = getmaxcap(); if (setpcap(cap_values, capct)) { - for(int cap=0;cap<=63;cap++) + for(int cap=0;cap<=maxcap;cap++) { if (cap_drop_bound(cap)) { - if (errno!=EINVAL) - { - fprintf(stderr,"could not drop cap %d\n",cap); - perror("cap_drop_bound"); - } + fprintf(stderr,"could not drop cap %d\n",cap); + perror("cap_drop_bound"); } } }