From 2b657f10cad90a2486003f05be62914ee1f23550 Mon Sep 17 00:00:00 2001 From: Serge Hallyn Date: Tue, 31 Jul 2012 16:07:18 +0200 Subject: [PATCH] Fix lxc's handling of CAP_LAST_CAP CAP_LAST_CAP in linux/capability.h doesn't always match what the kernel actually supports. If the kernel supports fewer capabilities, then a cap_get_flag for an unsupported capability returns -EINVAL. Recognize that, and don't fail when initializing capabilities when this happens, rather accept that we've reached the last capability. Signed-off-by: Serge Hallyn Signed-off-by: Daniel Lezcano --- src/lxc/caps.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/src/lxc/caps.c b/src/lxc/caps.c index 10a0b4aac..c32e7e452 100644 --- a/src/lxc/caps.c +++ b/src/lxc/caps.c @@ -28,6 +28,7 @@ #include #include #include +#include #include "log.h" @@ -90,6 +91,7 @@ int lxc_caps_up(void) cap_t caps; cap_value_t cap; int ret; + int lastcap = 0; /* when we are run as root, we don't want to play * with the capabilities */ @@ -108,9 +110,15 @@ int lxc_caps_up(void) ret = cap_get_flag(caps, cap, CAP_PERMITTED, &flag); if (ret) { - ERROR("failed to cap_get_flag: %m"); - goto out; + if (errno == EINVAL) { + INFO("Last supported cap was %d\n", cap-1); + break; + } else { + ERROR("failed to cap_get_flag: %m"); + goto out; + } } + lastcap = cap; ret = cap_set_flag(caps, CAP_EFFECTIVE, 1, &cap, flag); if (ret) {