capabilities: don't rely on hardcode set of supported capabilities

SSSD · Feb 28, 2025 · 1230594 · 1230594
1 parent 9152646
commit 1230594
Showing 1 changed file with 24 additions and 3 deletions.
diff --git a/src/util/capabilities.c b/src/util/capabilities.c
@@ -272,10 +272,31 @@ errno_t sss_set_cap_effective(cap_value_t cap, bool effective)
 
 void sss_drop_all_caps(void)
 {
-    size_t i;
+    int ret;
 
-    for (i = 0; i < sizeof(_all_caps)/sizeof(cap_description); ++i) {
-        sss_drop_cap(_all_caps[i].val);
+    cap_t caps = cap_get_proc();
+    if (caps == NULL) {
+        ret = errno;
+        DEBUG(SSSDBG_TRACE_FUNC, "cap_get_proc() failed: %d ('%s')\n",
+              ret, strerror(ret));
+        return;
+    }
+    if (cap_clear(caps) == -1) {
+        ret = errno;
+        DEBUG(SSSDBG_TRACE_FUNC,
+              "cap_clear() failed: %d ('%s')\n", ret, strerror(ret));
+        goto done;
+    }
+    if (cap_set_proc(caps) == -1) {
+        ret = errno;
+        DEBUG(SSSDBG_TRACE_FUNC, "cap_set_proc() failed: %d ('%s')\n",
+              ret, strerror(ret));
+        goto done;
+    }
+
+done:
+    if (cap_free(caps) == -1) {
+        DEBUG(SSSDBG_TRACE_FUNC, "cap_free() failed\n");
     }
 }