Merge pull request #12058 from keszybz/oci-simplifications

Follow-ups for nspawn-oci review

src/basic/capability-util.c

@@ -367,8 +367,7 @@ bool ambient_capabilities_supported(void) {
 }
 
 int capability_quintet_enforce(const CapabilityQuintet *q) {
-        _cleanup_cap_free_ cap_t c = NULL;
-        bool need_set_proc_again = false;
+        _cleanup_cap_free_ cap_t c = NULL, modified = NULL;
         int r;
 
         if (q->ambient != (uint64_t) -1) {
@@ -493,8 +492,6 @@ int capability_quintet_enforce(const CapabilityQuintet *q) {
                 }
 
                 if (changed) {
-                        _cleanup_cap_free_ cap_t modified = NULL;
-
                         /* In order to change the bounding caps, we need to keep CAP_SETPCAP for a bit
                          * longer. Let's add it to our list hence for now. */
                         if (q->bounding != (uint64_t) -1) {
@@ -522,8 +519,6 @@ int capability_quintet_enforce(const CapabilityQuintet *q) {
                          * caps in inherited/permitted/effective anymore, but only lose them.*/
                         if (cap_set_proc(modified ?: c) < 0)
                                 return -errno;
-
-                        need_set_proc_again = !!modified;
                 }
         }
 
@@ -537,7 +532,7 @@ int capability_quintet_enforce(const CapabilityQuintet *q) {
          * we have already set only in the CAP_SETPCAP bit, which we needed for dropping the bounding
          * bits. This call only undoes bits and doesn't acquire any which means the bounding caps don't
          * matter. */
-        if (need_set_proc_again)
+        if (modified)
                 if (cap_set_proc(c) < 0)
                         return -errno;
 

src/basic/string-util.h

@@ -180,6 +180,11 @@ char *strrep(const char *s, unsigned n);
 int split_pair(const char *s, const char *sep, char **l, char **r);
 
 int free_and_strdup(char **p, const char *s);
+static inline int free_and_strdup_warn(char **p, const char *s) {
+        if (free_and_strdup(p, s) < 0)
+                return log_oom();
+        return 0;
+}
 int free_and_strndup(char **p, const char *s, size_t l);
 
 char *string_erase(char *x);