cifs-utils/trunk/cifs-utils-6.11_fix_capng_apply_for_libcap-ng-0.8.1.patch

   1 From f4e7c84467152624a288351321c8664dbf3364af Mon Sep 17 00:00:00 2001
   2 From: Jonas Witschel <diabonas@archlinux.org>
   3 Date: Sat, 21 Nov 2020 11:41:26 +0100
   4 Subject: [PATCH 1/2] mount.cifs: update the cap bounding set only when
   5  CAP_SETPCAP is given
   6
   7 libcap-ng 0.8.1 tightened the error checking on capng_apply, returning an error
   8 of -4 when trying to update the capability bounding set without having the
   9 CAP_SETPCAP capability to be able to do so. Previous versions of libcap-ng
  10 silently skipped updating the bounding set and only updated the normal
  11 CAPNG_SELECT_CAPS capabilities instead.
  12
  13 Check beforehand whether we have CAP_SETPCAP, in which case we can use
  14 CAPNG_SELECT_BOTH to update both the normal capabilities and the bounding set.
  15 Otherwise, we can at least update the normal capabilities, but refrain from
  16 trying to update the bounding set to avoid getting an error.
  17
  18 Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
  19 ---
  20  mount.cifs.c | 7 ++++++-
  21  1 file changed, 6 insertions(+), 1 deletion(-)
  22
  23 diff --git a/mount.cifs.c b/mount.cifs.c
  24 index 4feb397..88b8b69 100644
  25 --- a/mount.cifs.c
  26 +++ b/mount.cifs.c
  27 @@ -338,6 +338,8 @@ static int set_password(struct parsed_mount_info *parsed_info, const char *src)
  28  static int
  29  drop_capabilities(int parent)
  30  {
  31 +       capng_select_t set = CAPNG_SELECT_CAPS;
  32 +
  33         capng_setpid(getpid());
  34         capng_clear(CAPNG_SELECT_BOTH);
  35         if (parent) {
  36 @@ -355,7 +357,10 @@ drop_capabilities(int parent)
  37                         return EX_SYSERR;
  38                 }
  39         }
  40 -       if (capng_apply(CAPNG_SELECT_BOTH)) {
  41 +       if (capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) {
  42 +               set = CAPNG_SELECT_BOTH;
  43 +       }
  44 +       if (capng_apply(set)) {
  45                 fprintf(stderr, "Unable to apply new capability set.\n");
  46                 return EX_SYSERR;
  47         }
  48 --
  49 2.29.2
  50
  51
  52 From 64dfbafe7a0639a96d67f0b840b6e6498e1f68a9 Mon Sep 17 00:00:00 2001
  53 From: Jonas Witschel <diabonas@archlinux.org>
  54 Date: Sat, 21 Nov 2020 11:48:33 +0100
  55 Subject: [PATCH 2/2] cifs.upall: update the cap bounding set only when
  56  CAP_SETPCAP is given
  57
  58 libcap-ng 0.8.1 tightened the error checking on capng_apply, returning an error
  59 of -4 when trying to update the capability bounding set without having the
  60 CAP_SETPCAP capability to be able to do so. Previous versions of libcap-ng
  61 silently skipped updating the bounding set and only updated the normal
  62 CAPNG_SELECT_CAPS capabilities instead.
  63
  64 Check beforehand whether we have CAP_SETPCAP, in which case we can use
  65 CAPNG_SELECT_BOTH to update both the normal capabilities and the bounding set.
  66 Otherwise, we can at least update the normal capabilities, but refrain from
  67 trying to update the bounding set to avoid getting an error.
  68
  69 Signed-off-by: Jonas Witschel <diabonas@archlinux.org>
  70 ---
  71  cifs.upcall.c | 7 ++++++-
  72  1 file changed, 6 insertions(+), 1 deletion(-)
  73
  74 diff --git a/cifs.upcall.c b/cifs.upcall.c
  75 index 1559434..af1a0b0 100644
  76 --- a/cifs.upcall.c
  77 +++ b/cifs.upcall.c
  78 @@ -88,6 +88,8 @@ typedef enum _sectype {
  79  static int
  80  trim_capabilities(bool need_environ)
  81  {
  82 +       capng_select_t set = CAPNG_SELECT_CAPS;
  83 +
  84         capng_clear(CAPNG_SELECT_BOTH);
  85
  86         /* SETUID and SETGID to change uid, gid, and grouplist */
  87 @@ -105,7 +107,10 @@ trim_capabilities(bool need_environ)
  88                 return 1;
  89         }
  90
  91 -       if (capng_apply(CAPNG_SELECT_BOTH)) {
  92 +       if (capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) {
  93 +               set = CAPNG_SELECT_BOTH;
  94 +       }
  95 +       if (capng_apply(set)) {
  96                 syslog(LOG_ERR, "%s: Unable to apply capability set: %m\n", __func__);
  97                 return 1;
  98         }
  99 --
 100 2.29.2
 101