[libvirt] [PATCH] util: Call capng_setpid() before using cap-ng

[Daniel P. Berrange]

On Fri, Jul 01, 2016 at 03:33:07PM +0100, Daniel P. Berrange wrote:
> On Fri, Jul 01, 2016 at 04:30:44PM +0200, Andrea Bolognani wrote:
> > audit is using cap-ng itself since version 2.6.1, and it gets
> > to initialize the internal state of the cap-ng library before
> > we call fork(). Because of that, our own use of cap-ng in the
> > child process ends up attempting to change the capabilities of
> > the parent process instead of the child process, which fails.
> > 
> > Calling capng_setpid() before using any other cap-ng API
> > ensures we're altering the capabilities of the right process.
> 
> I really don't want to do any hack workaround in libvirt until we've
> got feedback from the cap-ng maintainers, as I think it is really
> their bug to fix.

FYI, I attached a patch for libcap-ng whic uses pthread_atfork to
reset their global state

  https://bugzilla.redhat.com/show_bug.cgi?id=1352064

It works with my demo program, but haven't tested with libvirt yet

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|