autotools: check for cap_get_file

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

diff --git a/configure.ac b/configure.ac
index 4db75cfb517ce779b86d14f0b128db94ba29aae2..30d66eea9fc94d8379a07ec24580027d458434b8 100644 (file)
--- a/configure.ac
+++ b/configure.ac
@@ -372,7 +372,9 @@ AM_CONDITIONAL([ENABLE_CAP], [test "x$enable_capabilities" = "xyes"])
 AM_COND_IF([ENABLE_CAP],
        [AC_CHECK_HEADER([sys/capability.h],[],[AC_MSG_ERROR([You must install the libcap development package in order to compile lxc])])
        AC_CHECK_LIB(cap,cap_set_proc,[],[AC_MSG_ERROR([You must install the libcap development package in order to compile lxc])])
-       AC_SUBST([CAP_LIBS], [-lcap])])
+        # Test whether we support getting file capabilities via cap_get_file().
+        AC_CHECK_LIB(cap,cap_get_file, AC_DEFINE(LIBCAP_SUPPORTS_FILE_CAPABILITIES,1,[Have cap_get_file]),[],[])
+        AC_SUBST([CAP_LIBS], [-lcap])])
 
 # HAVE_SCMP_FILTER_CTX=1 will tell us we have libseccomp api >= 1.0.0
 OLD_CFLAGS="$CFLAGS"

diff --git a/src/lxc/caps.c b/src/lxc/caps.c
index 2d6a3b82c43b67aec6f6c043aa31fb511b4102de..195707fa4a71442f6584f4002d0c8e2fcbd9bf13 100644 (file)
--- a/src/lxc/caps.c
+++ b/src/lxc/caps.c
@@ -225,10 +225,7 @@ static bool lxc_cap_is_set(cap_t caps, cap_value_t cap, cap_flag_t flag)
 
 bool lxc_file_cap_is_set(const char *path, cap_value_t cap, cap_flag_t flag)
 {
-       /* Android's bionic currently seems to lack support for cap_get_file(). */
-       #if IS_BIONIC
-       return true;
-       #else
+       #if LIBCAP_SUPPORTS_FILE_CAPABILITIES
        bool cap_is_set;
        cap_t caps;
 
@@ -247,6 +244,9 @@ bool lxc_file_cap_is_set(const char *path, cap_value_t cap, cap_flag_t flag)
        cap_is_set = lxc_cap_is_set(caps, cap, flag);
        cap_free(caps);
        return cap_is_set;
+       #else
+       errno = ENODATA;
+       return false;
        #endif
 }
 

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 999f2ebe19311fe81791a451802f086ce85409a5..9c6019a46169c83266901318ec05142b6f176b38 100644 (file)
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3353,7 +3353,7 @@ static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
                goto cleanup;
        }
 
-       #if HAVE_LIBCAP && !IS_BIONIC
+       #if HAVE_LIBCAP && LIBCAP_SUPPORTS_FILE_CAPABILITIES
        /* Check if it has the CAP_SETUID capability. */
        if ((cap & CAP_SETUID) &&
            lxc_file_cap_is_set(path, CAP_SETUID, CAP_EFFECTIVE) &&
@@ -3374,6 +3374,10 @@ static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
                goto cleanup;
        }
        #else
+       /* If we cannot check for file capabilities we need to give the benefit
+        * of the doubt. Otherwise we might fail even though all the necessary
+        * file capabilities are set.
+        */
        DEBUG("Cannot check for file capabilites as full capability support is "
              "missing. Manual intervention needed.");
        fret = 1;