xz: Fix the Capsicum rights on user_abort_pipe.

diff --git a/src/xz/file_io.c b/src/xz/file_io.c
index 308fa1d206a7b96d630ff356415af659fa595fbf..8a5e0453bf87f878a29d8145555810bf7a0694c4 100644 (file)
--- a/src/xz/file_io.c
+++ b/src/xz/file_io.c
@@ -195,8 +195,12 @@ io_sandbox_enter(int src_fd)
                        CAP_WRITE, CAP_SEEK)))
                goto error;
 
+       if (cap_rights_limit(user_abort_pipe[0], cap_rights_init(&rights,
+                       CAP_EVENT)))
+               goto error;
+
        if (cap_rights_limit(user_abort_pipe[1], cap_rights_init(&rights,
-                       CAP_EVENT, CAP_WRITE)))
+                       CAP_WRITE)))
                goto error;
 
        if (cap_enter())