connmark: Add CAP_NET_RAW to capabilities keep list

Fix for "Permission denied (you must be root)" error when calling
iptc_init(), which opens a RAW socket to communicate with the kernel,
when built with "--with-capabilities=libcap".

Closes strongswan/strongswan#53.
Fixes #2157.

diff --git a/src/libcharon/plugins/connmark/connmark_plugin.c b/src/libcharon/plugins/connmark/connmark_plugin.c
index 3f276f93e93b1b82ee2706173c7802742f261912..ad44eba5f40090af85392cc4753c5cbbf39513f3 100644 (file)
--- a/src/libcharon/plugins/connmark/connmark_plugin.c
+++ b/src/libcharon/plugins/connmark/connmark_plugin.c
@@ -90,6 +90,12 @@ plugin_t *connmark_plugin_create()
                return NULL;
        }
 
+       if (!lib->caps->keep(lib->caps, CAP_NET_RAW))
+       {
+               DBG1(DBG_NET, "connmark plugin requires CAP_NET_RAW capability");
+               return NULL;
+       }
+
        INIT(this,
                .public = {
                        .plugin = {