From 943800f4e7728feb2416dd57b8c296614497b94f Mon Sep 17 00:00:00 2001 From: Kevin Kuehler Date: Tue, 26 Nov 2019 11:20:14 -0800 Subject: [PATCH] execute: Call capability_ambient_set_apply even if ambient set is 0 The function capability_ambient_set_apply() now drops capabilities not in the capability_ambient_set(), so it is necessary to call it when the ambient set is empty. Fixes #13163 --- src/core/execute.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/core/execute.c b/src/core/execute.c index abc164ff5be..4f96d1f4102 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -3595,8 +3595,7 @@ static int exec_child( /* This is done before enforce_user, but ambient set * does not survive over setresuid() if keep_caps is not set. */ - if (!needs_ambient_hack && - context->capability_ambient_set != 0) { + if (!needs_ambient_hack) { r = capability_ambient_set_apply(context->capability_ambient_set, true); if (r < 0) { *exit_status = EXIT_CAPABILITIES; -- 2.47.3