Undo Linux libcap change. libcap not capable enough on some Linux versions (cap_clear...

diff --git a/configure.in b/configure.in
index e4b40451388eeba4074b3dee3433e1f01d1c5f01..5c8171efa959e5604eb31a0002fccf8699d1861d 100644 (file)
--- a/configure.in
+++ b/configure.in
@@ -2763,7 +2763,7 @@ AC_ARG_ENABLE(caps, AS_HELP_STRING([--disable-caps],[disable usage of Linux capa
   fi
 ],[AC_MSG_RESULT(yes)])
 if test "x$use_caps" = "xyes"; then
-  dnl Check for libcap1 header breakage or libcap2 fixed (assume broken unless found working)
+  dnl Check for libcap1 breakage or libcap2 fixed (assume broken unless found working)
   libcap_broken=1
   AC_CHECK_HEADERS(sys/capability.h)
   AC_CACHE_CHECK([for operational libcap2], $libcap_broken,
@@ -2773,7 +2773,6 @@ if test "x$use_caps" = "xyes"; then
                    ]])],[libcap_broken=0],[])
   )
   AC_DEFINE_UNQUOTED([LIBCAP_BROKEN],$libcap_broken,[if libcap2 is available and not clashing with libc])
-  AC_CHECK_LIB(cap, cap_get_proc)
 fi
 
 AC_CHECK_TYPE(mtyp_t,AC_DEFINE(HAVE_MTYP_T,1,[mtyp_t is defined by the system headers]),,[#include <sys/types.h>

diff --git a/src/tools.cc b/src/tools.cc
index 77141dbde24833f86f2f06d64d7b526d83a30187..e3e2323ee140c4b4bef46f7e9827c4f126de9c6f 100644 (file)
--- a/src/tools.cc
+++ b/src/tools.cc
@@ -1241,40 +1241,50 @@ restoreCapabilities(int keep)
 {
     /* NP: keep these two if-endif separate. Non-Linux work perfectly well without Linux syscap support. */
 #if defined(_SQUID_LINUX_)
+
 #if HAVE_SYS_CAPABILITY_H
-    cap_t caps;
-    if (keep)
-        caps = cap_get_proc();
-    else
-        caps = cap_init();
-    if (!caps) {
-        IpInterceptor.StopTransparency("Can't get current capabilities");
+#ifndef _LINUX_CAPABILITY_VERSION_1
+#define _LINUX_CAPABILITY_VERSION_1 _LINUX_CAPABILITY_VERSION
+#endif
+    cap_user_header_t head = (cap_user_header_t) xcalloc(1, sizeof(*head));
+    cap_user_data_t cap = (cap_user_data_t) xcalloc(1, sizeof(*cap));
+
+    head->version = _LINUX_CAPABILITY_VERSION_1;
+
+    if (capget(head, cap) != 0) {
+        debugs(50, DBG_IMPORTANT, "Can't get current capabilities");
+    } else if (head->version != _LINUX_CAPABILITY_VERSION_1) {
+        debugs(50, DBG_IMPORTANT, "Invalid capability version " << head->version << " (expected " << _LINUX_CAPABILITY_VERSION_1 << ")");
     } else {
-        int ncaps = 0;
-        int rc = 0;
-        cap_value_t cap_list[10];
-        cap_list[ncaps++] = CAP_NET_BIND_SERVICE;
+
+        head->pid = 0;
+
+        cap->inheritable = 0;
+        cap->effective = (1 << CAP_NET_BIND_SERVICE);
 
         if (IpInterceptor.TransparentActive()) {
-            cap_list[ncaps++] = CAP_NET_ADMIN;
+            cap->effective |= (1 << CAP_NET_ADMIN);
 #if LINUX_TPROXY2
-            cap_list[ncaps++] = CAP_NET_BROADCAST;
+            cap->effective |= (1 << CAP_NET_BROADCAST);
 #endif
         }
 
-        cap_clear_flag(caps, CAP_EFFECTIVE);
-        rc |= cap_set_flag(caps, CAP_EFFECTIVE, ncaps, cap_list, CAP_SET);
-        rc |= cap_set_flag(caps, CAP_PERMITTED, ncaps, cap_list, CAP_SET);
+        if (!keep)
+            cap->permitted &= cap->effective;
 
-        if (rc || cap_set_proc(caps) != 0) {
+        if (capset(head, cap) != 0) {
             IpInterceptor.StopTransparency("Error enabling needed capabilities.");
         }
-        cap_free(caps);
     }
+
+    xfree(head);
+    xfree(cap);
+
 #else
     IpInterceptor.StopTransparency("Missing needed capability support.");
 #endif /* HAVE_SYS_CAPABILITY_H */
-#endif /* _SQUID_LINUX_ */
+
+#endif /* !defined(_SQUID_LINUX_) */
 }
 
 void *