Handle new capabilities gracefully #16420
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
We would refuse to print capabilities which were didn't have a name for. The kernel adds new capabilities from time to time, most recently cap_bpf. 'systmectl show -p CapabilityBoundingSet ...' would fail with "Failed to parse bus message: Invalid argument" because capability_set_to_string_alloc() would fail with -EINVAL. So let's print such capabilities in hexadecimal: CapabilityBoundingSet=cap_chown cap_dac_override cap_dac_read_search cap_fowner cap_fsetid cap_kill cap_setgid cap_setuid cap_setpcap cap_linux_immutable cap_net_bind_service cap_net_broadcast cap_net_admin cap_net_raw cap_ipc_lock cap_ipc_owner 0x10 0x11 0x12 0x13 0x14 0x15 0x16 0x17 0x18 0x19 0x1a ... For symmetry, also allow capabilities that we don't know to be specified. Fixes https://bugzilla.redhat.com/show_bug.cgi?id=1853736.
panaman67
reviewed
Jul 10, 2020
poettering
requested changes
Jul 10, 2020
| if (!p) | ||
| return -EINVAL; | ||
| if (!p) { | ||
| xsprintf(buf, "0x%lx", i); |
There was a problem hiding this comment.
i is an int, hence just use %x rather than %lxhere?
| @@ -36,7 +37,7 @@ int capability_from_name(const char *name) { | |||
| /* Try to parse numeric capability */ | |||
| r = safe_atoi(name, &i); | |||
| if (r >= 0) { | |||
| if (i >= 0 && (size_t) i < ELEMENTSOF(capability_names)) | |||
| if (i >= 0 &&) | |||
| return i; | |||
There was a problem hiding this comment.
hmm, given that we store caps masks in a 64 bit unsigned integer we should refuse caps > 63 here
poettering
added
ci-fails/needs-rework 🔥
|
Oh, I pushed the branch to the main repo by mistake. I'll open a new pull request with the latest version. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.