From 8acb11a6a337601a6f307fb50d77b13ffa0b3c5e Mon Sep 17 00:00:00 2001 From: sterlinghughes Date: Thu, 28 May 2020 13:54:27 -0700 Subject: Check ambient set against bounding set prior to applying ambient set Fixes #15020 --- src/basic/capability-util.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) (limited to 'src/basic/capability-util.c') diff --git a/src/basic/capability-util.c b/src/basic/capability-util.c index 9dbebfa167..ac96eabc03 100644 --- a/src/basic/capability-util.c +++ b/src/basic/capability-util.c @@ -107,6 +107,18 @@ int capability_ambient_set_apply(uint64_t set, bool also_inherit) { unsigned long i; int r; + /* Remove capabilities requested in ambient set, but not in the bounding set */ + for (i = 0; i <= cap_last_cap(); i++) { + if (set == 0) + break; + + if (FLAGS_SET(set, (UINT64_C(1) << i)) && prctl(PR_CAPBSET_READ, i) != 1) { + log_debug("Ambient capability %s requested but missing from bounding set," + " suppressing automatically.", capability_to_name(i)); + set &= ~(UINT64_C(1) << i); + } + } + /* Add the capabilities to the ambient set (an possibly also the inheritable set) */ /* Check that we can use PR_CAP_AMBIENT or quit early. */ -- cgit v1.2.1