Skip to content

Commit

Permalink
Don't limit rights on g_dumpdir_fd.
Browse files Browse the repository at this point in the history
We already have to give it CAP_CREATE, CAP_UNLINKAT and CAP_RENAMEAT, so
it's not serving much good, and the list keeps growing.  For instance,
we need CAP_FSTAT for fgets(3) (revealed by kern.trap_enotcap=1).
  • Loading branch information
markjdb committed Nov 19, 2018
1 parent 36fa835 commit 9b9c2b2
Showing 1 changed file with 0 additions and 8 deletions.
8 changes: 0 additions & 8 deletions netdumpd.c
Original file line number Diff line number Diff line change
Expand Up @@ -1044,14 +1044,6 @@ init_cap_mode(void)
goto err;
}

/* CAP_FCNTL is needed by fdopen(3). */
cap_rights_init(&rights, CAP_CREATE, CAP_FCNTL, CAP_FTRUNCATE,
CAP_FSYNC, CAP_PWRITE, CAP_READ, CAP_RENAMEAT_SOURCE,
CAP_RENAMEAT_TARGET, CAP_SYMLINKAT, CAP_UNLINKAT);
if (cap_rights_limit(g_dumpdir_fd, &rights) != 0) {
LOGERR_PERROR("cap_rights_limit()");
goto err;
}
cap_rights_init(&rights, CAP_SEND, CAP_RECV);
if (cap_rights_limit(g_sock, &rights) != 0) {
LOGERR_PERROR("cap_rights_limit()");
Expand Down

0 comments on commit 9b9c2b2

Please sign in to comment.