openkylin
/
libvirt
mirror of https://gitee.com/openkylin/libvirt.git
9
0
Fork 0
Code Issues Projects Releases Wiki Activity

virutil: Check retval of capng_apply() 

Inside of virSetUIDGIDWithCaps() there's a naked call to
capng_apply(), i.e. without any retval check. This is potentially
dangerous as capng_apply() may fail. Do the check and report an
error.

This also fixes the build on bleeding edge distros - like Fedora
rawhide - where the function is declared with 'warn unused
result' [1].

1: a0743c335c

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Martin Kletzander <mkletzan@redhat.com>
This commit is contained in:
Michal Privoznik 2023-09-11 10:34:43 +02:00
parent 3222c9ca67
commit c96b3f5b5d
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/util/virutil.c
View File

@ -1200,8 +1200,12 @@ virSetUIDGIDWithCaps(uid_t uid, gid_t gid, gid_t *groups, int ngroups,
* do this if we failed to get the capability above, so ignore the
* return value.
*/
if (!need_setpcap)
capng_apply(CAPNG_SELECT_BOUNDS);
if (!need_setpcap &&
(capng_ret = capng_apply(CAPNG_SELECT_BOUNDS)) < 0) {
virReportError(VIR_ERR_INTERNAL_ERROR,
_("cannot apply process capabilities: %1$d"), capng_ret);
return -1;
}
/* Drop the caps that allow setuid/gid (unless they were requested) */
if (need_setgid)