From e1b83fb58eadfd02227673db9a7e2833d29b0c98 Mon Sep 17 00:00:00 2001 From: Lennart Poettering Date: Mon, 23 Apr 2012 00:32:43 +0200 Subject: [PATCH] selinux: when dropping capabilities only include AUDIT caps if we have them When we drop capabilities we shouldn't assume we can keep CAP_AUDIT_WRITE unconditionally, since it will not be available when running in containers. This patch only adds CAP_AUDIT_WRITE to the list of caps we keep if we actually have it in the first place. This makes audit/selinux enabled D-Bus work in a Linux container. --- bus/selinux.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/bus/selinux.c b/bus/selinux.c index 36287e9..1bfc791 100644 --- a/bus/selinux.c +++ b/bus/selinux.c @@ -1053,8 +1053,9 @@ _dbus_change_to_daemon_user (const char *user, int rc; capng_clear (CAPNG_SELECT_BOTH); - capng_update (CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, - CAP_AUDIT_WRITE); + if (capng_have_capability (CAPNG_PERMITTED, CAP_AUDIT_WRITE)) + capng_update (CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED, + CAP_AUDIT_WRITE); rc = capng_change_id (uid, gid, CAPNG_DROP_SUPP_GRP); if (rc) { -- 1.7.10