diff options
| author | Tobias Kaufmann <Tobias.KA.Kaufmann@bmw.de> | 2020-07-31 10:57:15 +0200 |
|---|---|---|
| committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2020-09-11 20:06:20 +0200 |
| commit | 08338a234e381223416d536867199b2f9a2ed30a (patch) | |
| tree | 34278eaff36a6d473c25244057a732a0df833cb3 | |
| parent | f0e6d9876d7931936eaa832a0fd0b11ee516d750 (diff) | |
| download | systemd-08338a234e381223416d536867199b2f9a2ed30a.tar.gz | |
core: fix comments on ambient capabilities
The comments on the code for ambient capabilities was wrong/outdated.
(cherry picked from commit 16fcb1918a0e4514b1d0d78259d4ffd646b5da59)
| -rw-r--r-- | src/core/execute.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/src/core/execute.c b/src/core/execute.c index 9ef6b5905b..14554b861c 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -3779,8 +3779,16 @@ static int exec_child( } } - /* This is done before enforce_user, but ambient set - * does not survive over setresuid() if keep_caps is not set. */ + /* Ambient capabilities are cleared during setresuid() (in enforce_user()) even with + * keep-caps set. + * To be able to raise the ambient capabilities after setresuid() they have to be + * added to the inherited set and keep caps has to be set (done in enforce_user()). + * After setresuid() the ambient capabilities can be raised as they are present in + * the permitted and inhertiable set. However it is possible that someone wants to + * set ambient capabilities without changing the user, so we also set the ambient + * capabilities here. + * The requested ambient capabilities are raised in the inheritable set if the + * second argument is true. */ if (!needs_ambient_hack) { r = capability_ambient_set_apply(context->capability_ambient_set, true); if (r < 0) { @@ -3806,7 +3814,7 @@ static int exec_child( if (!needs_ambient_hack && context->capability_ambient_set != 0) { - /* Fix the ambient capabilities after user change. */ + /* Raise the ambient capabilities after user change. */ r = capability_ambient_set_apply(context->capability_ambient_set, false); if (r < 0) { *exit_status = EXIT_CAPABILITIES; |