lib: Remove explicitly dropping capabilities before exec

These calls are not necessary: When setting capabilities, we always
remove them from the inheritable set, so they will inevitably be
removed at exec-time. Also, these groups of calls were never updated
for DAC_OVERRIDE, which would have posed a pretty severe problem.

Signed-off-by: Volker Lendecke <vl@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>

diff --git a/source3/lib/smbrun.c b/source3/lib/smbrun.c
index f9c6f8761c685926410ee1b8dd17284272367c37..603ceb0acb5e71a38ad7a042ec237bab119f8218 100644 (file)
--- a/source3/lib/smbrun.c
+++ b/source3/lib/smbrun.c
@@ -76,12 +76,6 @@ static int smbrun_internal(const char *cmd, int *outfd, bool sanitize,
        gid_t gid = current_user.ut.gid;
        void (*saved_handler)(int);
 
-       /*
-        * Lose any elevated privileges.
-        */
-       drop_effective_capability(KERNEL_OPLOCK_CAPABILITY);
-       drop_effective_capability(DMAPI_ACCESS_CAPABILITY);
-
        /* point our stdout at the file we want output to go into */
 
        if (outfd && ((*outfd = setup_out_fd()) == -1)) {
@@ -242,12 +236,6 @@ int smbrunsecret(const char *cmd, const char *secret)
        int ifd[2];
        void (*saved_handler)(int);
 
-       /*
-        * Lose any elevated privileges.
-        */
-       drop_effective_capability(KERNEL_OPLOCK_CAPABILITY);
-       drop_effective_capability(DMAPI_ACCESS_CAPABILITY);
-
        /* build up an input pipe */
        if(pipe(ifd)) {
                return -1;

diff --git a/source3/rpc_server/samr/srv_samr_chgpasswd.c b/source3/rpc_server/samr/srv_samr_chgpasswd.c
index 000f6c2b87dc07869da08a6bbd4cde7744350ef9..41fe5bcc71ede23e020fb42a1268fed4af835e4b 100644 (file)
--- a/source3/rpc_server/samr/srv_samr_chgpasswd.c
+++ b/source3/rpc_server/samr/srv_samr_chgpasswd.c
@@ -484,12 +484,6 @@ while we were waiting\n", WTERMSIG(wstat)));
        } else {
                /* CHILD */
 
-               /*
-                * Lose any elevated privileges.
-                */
-               drop_effective_capability(KERNEL_OPLOCK_CAPABILITY);
-               drop_effective_capability(DMAPI_ACCESS_CAPABILITY);
-
                /* make sure it doesn't freeze */
                alarm(20);