picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Check ambient set against bounding set prior to applying ambient set 

Fixes #15020
This commit is contained in:
sterlinghughes 2020-05-28 13:54:27 -07:00 committed by Lennart Poettering
parent 42ba8d25ad
commit 8acb11a6a3
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/basic/capability-util.c
View File

@ -107,6 +107,18 @@ int capability_ambient_set_apply(uint64_t set, bool also_inherit) {
unsigned long i;
int r;
/* Remove capabilities requested in ambient set, but not in the bounding set */
for (i = 0; i <= cap_last_cap(); i++) {
if (set == 0)
break;
if (FLAGS_SET(set, (UINT64_C(1) << i)) && prctl(PR_CAPBSET_READ, i) != 1) {
log_debug("Ambient capability %s requested but missing from bounding set,"
" suppressing automatically.", capability_to_name(i));
set &= ~(UINT64_C(1) << i);
}
}
/* Add the capabilities to the ambient set (an possibly also the inheritable set) */
/* Check that we can use PR_CAP_AMBIENT or quit early. */