From: sterlinghughes <sterling.hughes@gmail.com>
Date: Thu, 28 May 2020 20:54:27 +0000 (-0700)
Subject: Check ambient set against bounding set prior to applying ambient set
X-Git-Tag: v246-rc1~246
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=8acb11a6a337601a6f307fb50d77b13ffa0b3c5e;p=thirdparty%2Fsystemd.git

Check ambient set against bounding set prior to applying ambient set

Fixes #15020
---

diff --git a/src/basic/capability-util.c b/src/basic/capability-util.c
index 9dbebfa1678..ac96eabc032 100644
--- a/src/basic/capability-util.c
+++ b/src/basic/capability-util.c
@@ -107,6 +107,18 @@ int capability_ambient_set_apply(uint64_t set, bool also_inherit) {
         unsigned long i;
         int r;
 
+        /* Remove capabilities requested in ambient set, but not in the bounding set */
+        for (i = 0; i <= cap_last_cap(); i++) {
+                if (set == 0)
+                        break;
+
+                if (FLAGS_SET(set, (UINT64_C(1) << i)) && prctl(PR_CAPBSET_READ, i) != 1) {
+                        log_debug("Ambient capability %s requested but missing from bounding set,"
+                                        " suppressing automatically.", capability_to_name(i));
+                        set &= ~(UINT64_C(1) << i);
+                }
+        }
+
         /* Add the capabilities to the ambient set (an possibly also the inheritable set) */
 
         /* Check that we can use PR_CAP_AMBIENT or quit early. */