From: Jonas Witschel <diabonas@archlinux.org>
To: linux-cifs@vger.kernel.org
Cc: Jonas Witschel <diabonas@archlinux.org>
Subject: [PATCH 1/2] mount.cifs: update the cap bounding set only when CAP_SETPCAP is given
Date: Sat, 21 Nov 2020 12:11:44 +0100 [thread overview]
Message-ID: <20201121111145.24975-2-diabonas@archlinux.org> (raw)
In-Reply-To: <20201121111145.24975-1-diabonas@archlinux.org>
libcap-ng 0.8.1 tightened the error checking on capng_apply, returning an error
of -4 when trying to update the capability bounding set without having the
CAP_SETPCAP capability to be able to do so. Previous versions of libcap-ng
silently skipped updating the bounding set and only updated the normal
CAPNG_SELECT_CAPS capabilities instead.
Check beforehand whether we have CAP_SETPCAP, in which case we can use
CAPNG_SELECT_BOTH to update both the normal capabilities and the bounding set.
Otherwise, we can at least update the normal capabilities, but refrain from
trying to update the bounding set to avoid getting an error.
Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
---
mount.cifs.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/mount.cifs.c b/mount.cifs.c
index 4feb397..88b8b69 100644
--- a/mount.cifs.c
+++ b/mount.cifs.c
@@ -338,6 +338,8 @@ static int set_password(struct parsed_mount_info *parsed_info, const char *src)
static int
drop_capabilities(int parent)
{
+ capng_select_t set = CAPNG_SELECT_CAPS;
+
capng_setpid(getpid());
capng_clear(CAPNG_SELECT_BOTH);
if (parent) {
@@ -355,7 +357,10 @@ drop_capabilities(int parent)
return EX_SYSERR;
}
}
- if (capng_apply(CAPNG_SELECT_BOTH)) {
+ if (capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) {
+ set = CAPNG_SELECT_BOTH;
+ }
+ if (capng_apply(set)) {
fprintf(stderr, "Unable to apply new capability set.\n");
return EX_SYSERR;
}
--
2.29.2
next prev parent reply other threads:[~2020-11-21 11:18 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-11-21 11:11 [PATCH 0/2] cifs-utils: update the cap bounding set only when CAP_SETPCAP is given Jonas Witschel
2020-11-21 11:11 ` Jonas Witschel [this message]
2020-11-21 11:11 ` [PATCH 2/2] cifs.upall: " Jonas Witschel
2020-11-24 12:11 ` [PATCH 0/2] cifs-utils: " Aurélien Aptel
2020-11-24 13:37 ` Jonas Witschel
2020-11-27 10:01 ` Aurélien Aptel
2020-12-09 19:15 ` Pavel Shilovsky
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201121111145.24975-2-diabonas@archlinux.org \
--to=diabonas@archlinux.org \
--cc=linux-cifs@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.