kernel-netlink: Make CAP_NET_ADMIN capability optional

It is not required to use the kernel-net part of the plugin.

diff --git a/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c b/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c
index 2db03d85431266c6c6e76395aec4fdecadc28d0f..8d5a0d5e81b04a3d9b9bdd0255806aa4f4b5473e 100644 (file)
--- a/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c
+++ b/src/libhydra/plugins/kernel_netlink/kernel_netlink_plugin.c
@@ -66,10 +66,11 @@ plugin_t *kernel_netlink_plugin_create()
        private_kernel_netlink_plugin_t *this;
 
        if (!lib->caps->keep(lib->caps, CAP_NET_ADMIN))
-       {       /* required to bind/use XFRM sockets / create routing tables */
-               DBG1(DBG_KNL, "kernel-netlink plugin requires CAP_NET_ADMIN "
+       {       /* required to bind/use XFRM sockets / create/modify routing tables, but
+                * not if only the read-only parts of kernel-netlink-net are used, so
+                * we don't fail here */
+               DBG1(DBG_KNL, "kernel-netlink plugin might require CAP_NET_ADMIN "
                         "capability");
-               return NULL;
        }
 
        INIT(this,