Skip to content

Drop check for setcaps #709

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
swick wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Drop check for setcaps #709

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 0 additions & 19 deletions bubblewrap.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -739,18 +739,6 @@ drop_all_caps (bool keep_requested_caps)
}
}

static bool
has_caps (void)
{
struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };
struct __user_cap_data_struct data[2] = { { 0 } };

if (capget (&hdr, data) < 0)
die_with_error ("capget failed");

return data[0].permitted != 0 || data[1].permitted != 0;
}

/* Most of the code here is used both to add caps to the ambient capabilities
* and drop caps from the bounding set. Handle both cases here and add
* drop_cap_bounding_set/set_ambient_capabilities wrappers to facilitate its usage.
Expand Down Expand Up @@ -876,13 +864,6 @@ acquire_privs (void)
/* Keep only the required capabilities for setup */
set_required_caps ();
}
else if (real_uid != 0 && has_caps ())
{
/* We have some capabilities in the non-setuid case, which should not happen.
Probably caused by the binary being setcap instead of setuid which we
don't support anymore */
die ("Unexpected capabilities but not setuid, old file caps config?");
}
else if (real_uid == 0)
{
/* If our uid is 0, default to inheriting all caps; the caller
Expand Down
Loading