bus/selinux: Fix previous commit for CAP_AUDIT_WRITE retention

As soon as capng_clear() is called, we won't appear to have
CAP_AUDIT_WRITE.  Fix this by checking for it before resetting the
libcap state.

Bug: https://bugs.freedesktop.org/show_bug.cgi?id=49062
Tested-by: Laurent Bigonville <bigon@debian.org>
Reviewed-by: Laurent Bigonville <bigon@debian.org>
Reviewed-by: Simon McVittie <simon.mcvittie@collabora.co.uk>
Reviewed-by: Lennart Poettering <lennart@poettering.net>

diff --git a/bus/selinux.c b/bus/selinux.c
index 7ae84d6dcf8c5f0f9d7229d853674ca21ada03a2..768e55ef2885a4da6ebd1d4c3c6029c8a26fab81 100644 (file)
--- a/bus/selinux.c
+++ b/bus/selinux.c
@@ -1043,9 +1043,15 @@ _dbus_change_to_daemon_user  (const char    *user,
   if (_dbus_geteuid () == 0)
     {
       int rc;
+      int have_audit_write;
 
+      have_audit_write = capng_have_capability (CAPNG_PERMITTED, CAP_AUDIT_WRITE);
       capng_clear (CAPNG_SELECT_BOTH);
-      if (capng_have_capability (CAPNG_PERMITTED, CAP_AUDIT_WRITE))
+      /* Only attempt to retain CAP_AUDIT_WRITE if we had it when
+       * starting.  See:
+       * https://bugs.freedesktop.org/show_bug.cgi?id=49062#c9
+       */
+      if (have_audit_write)
         capng_update (CAPNG_ADD, CAPNG_EFFECTIVE | CAPNG_PERMITTED,
                       CAP_AUDIT_WRITE);
       rc = capng_change_id (uid, gid, CAPNG_DROP_SUPP_GRP);