[PATCH 1/2] alfred: drop CAP_NET_RAW when binding to the device fails

[Sven Eckelmann]

netsock_open() and netsock_open4() raise the CAP_NET_RAW effective
capability around the two SO_BINDTODEVICE setsockopt() calls and drop it
again with enable_raw_bind_capability(0). When either setsockopt() fails
the "goto err" jumps straight to the socket cleanup and skipped the drop.
The daemon was then still using the CAP_NET_RAW.

Route the bind failures through a new err_bind label that drops the
capability before the existing error cleanup.

Fixes: b0877b387ba1 ("alfred: Drop capabilities when not needed")
Signed-off-by: Sven Eckelmann <s...@narfation.org>
---
 netsock.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/netsock.c b/netsock.c
index 60b2285..54148e2 100644
--- a/netsock.c
+++ b/netsock.c
@@ -317,14 +317,14 @@ static int netsock_open(struct globals *globals, struct 
interface *interface)
        if (setsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, interface->interface,
                       strlen(interface->interface) + 1)) {
                perror("can't bind to device");
-               goto err;
+               goto err_bind;
        }
 
        if (setsockopt(sock_mc, SOL_SOCKET, SO_BINDTODEVICE,
                       interface->interface,
                       strlen(interface->interface) + 1)) {
                perror("can't bind to device");
-               goto err;
+               goto err_bind;
        }
        enable_raw_bind_capability(0);
 
@@ -408,6 +408,9 @@ static int netsock_open(struct globals *globals, struct 
interface *interface)
        interface->netsock_mcast = sock_mc;
 
        return 0;
+
+err_bind:
+       enable_raw_bind_capability(0);
 err:
        close(sock);
        close(sock_mc);
@@ -464,13 +467,13 @@ static int netsock_open4(struct globals *globals, struct 
interface *interface)
        if (setsockopt(sock, SOL_SOCKET, SO_BINDTODEVICE, interface->interface,
                       strlen(interface->interface) + 1)) {
                perror("ipv4: can't bind to device");
-               goto err;
+               goto err_bind;
        }
 
        if (setsockopt(sock_mc, SOL_SOCKET, SO_BINDTODEVICE,
                       interface->interface, strlen(interface->interface) + 1)) 
{
                perror("ipv4: can't bind to device");
-               goto err;
+               goto err_bind;
        }
        enable_raw_bind_capability(0);
 
@@ -558,6 +561,9 @@ static int netsock_open4(struct globals *globals, struct 
interface *interface)
        interface->netsock_mcast = sock_mc;
 
        return 0;
+
+err_bind:
+       enable_raw_bind_capability(0);
 err:
        close(sock);
        close(sock_mc);

-- 
2.47.3