nfsdcld: Before clearing the capability bounding set, check if we have the cap
authorHarald Hoyer <harald@redhat.com>
Tue, 19 Jun 2012 14:53:29 +0000 (10:53 -0400)
committerSteve Dickson <steved@redhat.com>
Tue, 19 Jun 2012 14:53:29 +0000 (10:53 -0400)
From: Harald Hoyer <harald@redhat.com>

PR_CAPBSET_DROP can return EINVAL, if an older kernel does support
some capabilities, which are defined by CAP_LAST_CAP, which results in
a failure of the service.

For example kernel 3.4 errors on CAP_EPOLLWAKEUP, which was newly
introduced in 3.5.

So, for future capabilities, we clear until we get an EINVAL for
PR_CAPBSET_READ.

Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Steve Dickson <steved@redhat.com>
support/nsm/file.c
utils/nfsdcld/nfsdcld.c

index 5476446..4711c2c 100644 (file)
@@ -386,7 +386,7 @@ prune_bounding_set(void)
        }
 
        /* prune the bounding set to nothing */
-       for (i = 0; i <= CAP_LAST_CAP; ++i) {
+       for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >=0 ; ++i) {
                ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
                if (ret) {
                        xlog(L_ERROR, "Unable to prune capability %lu from "
index e7af4e3..473d069 100644 (file)
@@ -102,8 +102,8 @@ cld_set_caps(void)
        }
 
        /* prune the bounding set to nothing */
-       for (i = 0; i <= CAP_LAST_CAP; ++i) {
-               ret = prctl(PR_CAPBSET_DROP, i);
+       for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0 ; ++i) {
+               ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
                if (ret) {
                        xlog(L_ERROR, "Unable to prune capability %lu from "
                                      "bounding set: %m", i);