nspawn: allow Capability=all in systemd.nspawn [EXEC] section

Just like --capability=all is allowed in the systemd-nspawn
command line.

diff --git a/man/systemd.nspawn.xml b/man/systemd.nspawn.xml
index 8f5590c73ad0384df4f606288cc08c4efba0a125..11df4623b441a48e2e8151d46b8f7b6756a3c260 100644 (file)
--- a/man/systemd.nspawn.xml
+++ b/man/systemd.nspawn.xml
@@ -189,7 +189,8 @@
         <filename>/etc/systemd/nspawn/</filename> and
         <filename>/run/system/nspawn/</filename> (see above). On the
         other hand, <varname>DropCapability=</varname> takes effect in
-        all cases.</para></listitem>
+        all cases. If the special value <literal>all</literal> is passed, all
+        capabilities are retained (or dropped).</para></listitem>
       </varlistentry>
 
       <varlistentry>

diff --git a/src/nspawn/nspawn-settings.c b/src/nspawn/nspawn-settings.c
index 3a99736813798c57c09c94e8ae14119480c8b719..5fb5b49bbcc31b3c5e2c9fa40002b79b24eda39b 100644 (file)
--- a/src/nspawn/nspawn-settings.c
+++ b/src/nspawn/nspawn-settings.c
@@ -275,13 +275,17 @@ int config_parse_capability(
                 if (r == 0)
                         break;
 
-                r = capability_from_name(word);
-                if (r < 0) {
-                        log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse capability, ignoring: %s", word);
-                        continue;
-                }
+                if (streq(word, "all"))
+                        u = (uint64_t) -1;
+                else {
+                        r = capability_from_name(word);
+                        if (r < 0) {
+                                log_syntax(unit, LOG_ERR, filename, line, r, "Failed to parse capability, ignoring: %s", word);
+                                continue;
+                        }
 
-                u |= UINT64_C(1) << r;
+                        u |= UINT64_C(1) << r;
+                }
         }
 
         if (u == 0)