From: Lennart Poettering <lennart@poettering.net>
Date: Thu, 2 Apr 2020 15:20:47 +0000 (+0200)
Subject: capability: don't skip ambient caps setup if we actually have something to set
X-Git-Tag: v246-rc1~654
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c4b23712634d020184393ba83451bd200a1e785f;p=thirdparty%2Fsystemd.git

capability: don't skip ambient caps setup if we actually have something to set

Follow-up for 7ea4392f1e444388caa706d6bd64fb7b30dc2903

Let's not hide errors needlessly aggressively.
---

diff --git a/src/basic/capability-util.c b/src/basic/capability-util.c
index caffda62af8..9dbebfa1678 100644
--- a/src/basic/capability-util.c
+++ b/src/basic/capability-util.c
@@ -107,11 +107,13 @@ int capability_ambient_set_apply(uint64_t set, bool also_inherit) {
         unsigned long i;
         int r;
 
+        /* Add the capabilities to the ambient set (an possibly also the inheritable set) */
+
         /* Check that we can use PR_CAP_AMBIENT or quit early. */
         if (!ambient_capabilities_supported())
-                return 0;
-
-        /* Add the capabilities to the ambient set. */
+                return (set & all_capabilities()) == 0 ?
+                        0 : -EOPNOTSUPP; /* if actually no ambient caps are to be set, be silent,
+                                          * otherwise fail recognizably */
 
         if (also_inherit) {
                 caps = cap_get_proc();