third_party/virtualbox/src/VBox/HostDrivers/Support/SUPR3HardenedMain.cpp
/*
 * Look at the environment for some special options.
 */
Look at the environment for some special options.
Look at the environment for some special options .
static void supR3GrabOptions(void)
{
# ifdef RT_OS_LINUX
    g_uCaps = 0;
    if (getuid() != 0)
    {
        const char *pszOpt = getenv("VBOX_HARD_CAP_NET_RAW");
        if (   !pszOpt
            || memcmp(pszOpt, "0", sizeof("0")) != 0)
            g_uCaps = CAP_TO_MASK(CAP_NET_RAW);
        pszOpt = getenv("VBOX_HARD_CAP_NET_BIND_SERVICE");
        if (   pszOpt
            && memcmp(pszOpt, "0", sizeof("0")) != 0)
            g_uCaps |= CAP_TO_MASK(CAP_NET_BIND_SERVICE);
    }
# endif
}
static void supR3GrabOptions ( void ) { # ifdef RT_OS_LINUX g_uCaps = 0 ; if ( getuid ( ) != 0 ) { const char * pszOpt = getenv ( " " ) ; if ( ! pszOpt || memcmp ( pszOpt , " " , sizeof ( " " ) ) != 0 ) g_uCaps = CAP_TO_MASK ( CAP_NET_RAW ) ; pszOpt = getenv ( " " ) ; if ( pszOpt && memcmp ( pszOpt , " " , sizeof ( " " ) ) != 0 ) g_uCaps |= CAP_TO_MASK ( CAP_NET_BIND_SERVICE ) ; } # endif }
Look at the environment for some special options.
Look at the environment for some special options .
/*
     * Do _not_ perform any capability-related system calls for root processes
     * (leaving g_uCaps at 0).
     * (Hint: getuid gets the real user id, not the effective.)
     */ /*
         * CAP_NET_RAW.
         * Default: enabled.
         * Can be disabled with 'export VBOX_HARD_CAP_NET_RAW=0'.
         */ /*
         * CAP_NET_BIND_SERVICE.
         * Default: disabled.
         * Can be enabled with 'export VBOX_HARD_CAP_NET_BIND_SERVICE=1'.
         */