From: Harald Hoyer Date: Tue, 19 Jun 2012 14:53:29 +0000 (-0400) Subject: nfsdcld: Before clearing the capability bounding set, check if we have the cap X-Git-Tag: debian/1%1.2.8-1~11^2^2~108 X-Git-Url: https://git.decadent.org.uk/gitweb/?p=nfs-utils.git;a=commitdiff_plain;h=d18b89cd7352783580f3d3dde26f8617e36459b9;hp=55b1769e63cdffa07b597fa6132c9902cec25265 nfsdcld: Before clearing the capability bounding set, check if we have the cap From: Harald Hoyer PR_CAPBSET_DROP can return EINVAL, if an older kernel does support some capabilities, which are defined by CAP_LAST_CAP, which results in a failure of the service. For example kernel 3.4 errors on CAP_EPOLLWAKEUP, which was newly introduced in 3.5. So, for future capabilities, we clear until we get an EINVAL for PR_CAPBSET_READ. Reviewed-by: Jeff Layton Signed-off-by: Steve Dickson --- diff --git a/support/nsm/file.c b/support/nsm/file.c index 5476446..4711c2c 100644 --- a/support/nsm/file.c +++ b/support/nsm/file.c @@ -386,7 +386,7 @@ prune_bounding_set(void) } /* prune the bounding set to nothing */ - for (i = 0; i <= CAP_LAST_CAP; ++i) { + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >=0 ; ++i) { ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0); if (ret) { xlog(L_ERROR, "Unable to prune capability %lu from " diff --git a/utils/nfsdcld/nfsdcld.c b/utils/nfsdcld/nfsdcld.c index e7af4e3..473d069 100644 --- a/utils/nfsdcld/nfsdcld.c +++ b/utils/nfsdcld/nfsdcld.c @@ -102,8 +102,8 @@ cld_set_caps(void) } /* prune the bounding set to nothing */ - for (i = 0; i <= CAP_LAST_CAP; ++i) { - ret = prctl(PR_CAPBSET_DROP, i); + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0 ; ++i) { + ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0); if (ret) { xlog(L_ERROR, "Unable to prune capability %lu from " "bounding set: %m", i);