From c0f1dc951f29c6d492580b6da3d18d8c63020c2e Mon Sep 17 00:00:00 2001 From: Christian Brauner Date: Mon, 12 Apr 2021 09:47:59 +0200 Subject: [PATCH] conf: don't report success when idmaptools lack all privilege Fixes: #3777 Signed-off-by: Christian Brauner --- src/lxc/conf.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/lxc/conf.c b/src/lxc/conf.c index 37918dac78..6a0d54b838 100644 --- a/src/lxc/conf.c +++ b/src/lxc/conf.c @@ -2816,6 +2816,8 @@ static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap) lxc_file_cap_is_set(path, CAP_SETGID, CAP_EFFECTIVE) && lxc_file_cap_is_set(path, CAP_SETGID, CAP_PERMITTED)) return log_debug(1, "The binary \"%s\" has CAP_SETGID in its CAP_EFFECTIVE and CAP_PERMITTED sets", path); + + return 0; #else /* * If we cannot check for file capabilities we need to give the benefit @@ -2823,9 +2825,8 @@ static int idmaptool_on_path_and_privileged(const char *binary, cap_value_t cap) * file capabilities are set. */ DEBUG("Cannot check for file capabilities as full capability support is missing. Manual intervention needed"); -#endif - return 1; +#endif } static int lxc_map_ids_exec_wrapper(void *args)