caps: skip file capability checks on android

Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>

diff --git a/src/lxc/caps.c b/src/lxc/caps.c
index 705ac9446d05d14cb3924c2b24c20bd9e7ec3783..2d6a3b82c43b67aec6f6c043aa31fb511b4102de 100644 (file)
--- a/src/lxc/caps.c
+++ b/src/lxc/caps.c
@@ -225,6 +225,10 @@ static bool lxc_cap_is_set(cap_t caps, cap_value_t cap, cap_flag_t flag)
 
 bool lxc_file_cap_is_set(const char *path, cap_value_t cap, cap_flag_t flag)
 {
+       /* Android's bionic currently seems to lack support for cap_get_file(). */
+       #if IS_BIONIC
+       return true;
+       #else
        bool cap_is_set;
        cap_t caps;
 
@@ -243,6 +247,7 @@ bool lxc_file_cap_is_set(const char *path, cap_value_t cap, cap_flag_t flag)
        cap_is_set = lxc_cap_is_set(caps, cap, flag);
        cap_free(caps);
        return cap_is_set;
+       #endif
 }
 
 bool lxc_proc_cap_is_set(cap_value_t cap, cap_flag_t flag)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 8cd5174852009c0978e5909559cc712683b323a7..999f2ebe19311fe81791a451802f086ce85409a5 100644 (file)
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -3353,7 +3353,7 @@ static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
                goto cleanup;
        }
 
-       #if HAVE_LIBCAP
+       #if HAVE_LIBCAP && !IS_BIONIC
        /* Check if it has the CAP_SETUID capability. */
        if ((cap & CAP_SETUID) &&
            lxc_file_cap_is_set(path, CAP_SETUID, CAP_EFFECTIVE) &&
@@ -3373,6 +3373,10 @@ static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap)
                fret = 1;
                goto cleanup;
        }
+       #else
+       DEBUG("Cannot check for file capabilites as full capability support is "
+             "missing. Manual intervention needed.");
+       fret = 1;
        #endif
 
 cleanup: