From b7856f9218e23fde0932072786b640fdef37582f Mon Sep 17 00:00:00 2001
From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Mon, 5 Mar 2018 00:00:35 +0900
Subject: [PATCH] test-execute: check capabilities before running tests

Fixes #8193.
---
 src/test/test-execute.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/test/test-execute.c b/src/test/test-execute.c
index ce88e2ea07..788249e885 100644
--- a/src/test/test-execute.c
+++ b/src/test/test-execute.c
@@ -24,6 +24,7 @@
 #include <sys/prctl.h>
 #include <sys/types.h>
 
+#include "capability-util.h"
 #include "cpu-set-util.h"
 #include "errno-list.h"
 #include "fileio.h"
@@ -532,6 +533,13 @@ static void test_exec_capabilityboundingset(Manager *m) {
                 return;
         }
 
+        if (have_effective_cap(CAP_CHOWN) <= 0 ||
+            have_effective_cap(CAP_FOWNER) <= 0 ||
+            have_effective_cap(CAP_KILL) <= 0) {
+                log_notice("Skipping %s, this process does not have enough capabilities", __func__);
+                return;
+        }
+
         test(m, "exec-capabilityboundingset-simple.service", 0, CLD_EXITED);
         test(m, "exec-capabilityboundingset-reset.service", 0, CLD_EXITED);
         test(m, "exec-capabilityboundingset-merge.service", 0, CLD_EXITED);
@@ -551,6 +559,12 @@ static void test_exec_ambientcapabilities(Manager *m) {
                 return;
         }
 
+        if (have_effective_cap(CAP_NET_ADMIN) <= 0 ||
+            have_effective_cap(CAP_NET_RAW) <= 0) {
+                log_notice("Skipping %s, this process does not have enough capabilities", __func__);
+                return;
+        }
+
         test(m, "exec-ambientcapabilities.service", 0, CLD_EXITED);
         test(m, "exec-ambientcapabilities-merge.service", 0, CLD_EXITED);