SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

capability-util: add macro for largest cap we're willing to accept

Browse Source 
Let's hide the hard to grasp 62 behind a name.
This commit is contained in:
Lennart Poettering
2023-02-20 16:49:45 +01:00
parent 3fd5190b5e
commit 3b3ebabfa6
3 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/basic/capability-util.c
+9 -7
View File
@@ -47,11 +47,13 @@ unsigned cap_last_cap(void) {
r = safe_atolu(content, &p);
if (r >= 0) {
if (p > 62) /* Safety for the future: if one day the kernel learns more than 64 caps,
* then we are in trouble (since we, as much userspace and kernel space
* store capability masks in uint64_t types). Let's hence protect
* ourselves against that and always cap at 63 for now. */
p = 62;
if (p > CAP_LIMIT) /* Safety for the future: if one day the kernel learns more than
* 64 caps, then we are in trouble (since we, as much userspace
* and kernel space store capability masks in uint64_t types). We
* also want to use UINT64_MAX as marker for "unset". Hence let's
* hence protect ourselves against that and always cap at 62 for
* now. */
p = CAP_LIMIT;
saved = p;
valid = true;
@@ -60,7 +62,7 @@ unsigned cap_last_cap(void) {
}
/* fall back to syscall-probing for pre linux-3.2 */
p = MIN((unsigned long) CAP_LAST_CAP, 62U);
p = (unsigned long) MIN(CAP_LAST_CAP, CAP_LIMIT);
if (prctl(PR_CAPBSET_READ, p) < 0) {
@@ -72,7 +74,7 @@ unsigned cap_last_cap(void) {
} else {
/* Hmm, look upwards, until we find one that doesn't work */
for (; p < 62; p++)
for (; p < CAP_LIMIT; p++)
if (prctl(PR_CAPBSET_READ, p+1) < 0)
break;
}