On Tue, 12 Jun 2012 13:51:06 +0200
harald@xxxxxxxxxx wrote:
> From: Harald Hoyer <harald@xxxxxxxxxx>
>
> PR_CAPBSET_DROP can return EINVAL, if an older kernel does support
> some capabilities, which are defined by CAP_LAST_CAP, which results in
> a failure of the service.
>
> For example kernel 3.4 errors on CAP_EPOLLWAKEUP, which was newly
> introduced in 3.5.
>
> So, for future capabilities, we clear until we get an EINVAL for
> PR_CAPBSET_READ.
> ---
> support/nsm/file.c | 2 +-
> utils/nfsdcld/nfsdcld.c | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/support/nsm/file.c b/support/nsm/file.c
> index 5476446..4711c2c 100644
> --- a/support/nsm/file.c
> +++ b/support/nsm/file.c
> @@ -386,7 +386,7 @@ prune_bounding_set(void)
> }
>
> /* prune the bounding set to nothing */
> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >=0 ; ++i) {
> ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
> if (ret) {
> xlog(L_ERROR, "Unable to prune capability %lu from "
> diff --git a/utils/nfsdcld/nfsdcld.c b/utils/nfsdcld/nfsdcld.c
> index e7af4e3..473d069 100644
> --- a/utils/nfsdcld/nfsdcld.c
> +++ b/utils/nfsdcld/nfsdcld.c
> @@ -102,8 +102,8 @@ cld_set_caps(void)
> }
>
> /* prune the bounding set to nothing */
> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
> - ret = prctl(PR_CAPBSET_DROP, i);
> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0 ; ++i) {
> + ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
> if (ret) {
> xlog(L_ERROR, "Unable to prune capability %lu from "
> "bounding set: %m", i);
Thanks, looks like a reasonable method. Did you find this by
inspection, or did you or someone else hit the problem?
Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>
--
To unsubscribe from this list: send the line "unsubscribe linux-nfs" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
