Skip to content

Commit 80c8b6c

Browse files
committed
Drop check for setcaps
Before bwrap was installed setuid (when user namespaces are not supported), it used setcap/file capabilities to acquire the privileges to create the bwrap environment. This was dropped 9 years ago in aedd613 ("Completely drop setcaps codepaths in favour of setuid"). and the check was added instead. Given that it has been 9 years, it is exceedingly unlikely that someone still has misconfigured bwrap in that particular way, so remove the check.
1 parent d6180f2 commit 80c8b6c

1 file changed

Lines changed: 0 additions & 19 deletions

File tree

bubblewrap.c

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -739,18 +739,6 @@ drop_all_caps (bool keep_requested_caps)
739739
}
740740
}
741741

742-
static bool
743-
has_caps (void)
744-
{
745-
struct __user_cap_header_struct hdr = { _LINUX_CAPABILITY_VERSION_3, 0 };
746-
struct __user_cap_data_struct data[2] = { { 0 } };
747-
748-
if (capget (&hdr, data) < 0)
749-
die_with_error ("capget failed");
750-
751-
return data[0].permitted != 0 || data[1].permitted != 0;
752-
}
753-
754742
/* Most of the code here is used both to add caps to the ambient capabilities
755743
* and drop caps from the bounding set. Handle both cases here and add
756744
* drop_cap_bounding_set/set_ambient_capabilities wrappers to facilitate its usage.
@@ -876,13 +864,6 @@ acquire_privs (void)
876864
/* Keep only the required capabilities for setup */
877865
set_required_caps ();
878866
}
879-
else if (real_uid != 0 && has_caps ())
880-
{
881-
/* We have some capabilities in the non-setuid case, which should not happen.
882-
Probably caused by the binary being setcap instead of setuid which we
883-
don't support anymore */
884-
die ("Unexpected capabilities but not setuid, old file caps config?");
885-
}
886867
else if (real_uid == 0)
887868
{
888869
/* If our uid is 0, default to inheriting all caps; the caller

0 commit comments

Comments
 (0)