[libvirt] [PATCH] util: Call capng_setpid() before using cap-ng
Daniel P. Berrange
berrange at redhat.com
Fri Jul 1 14:33:07 UTC 2016
On Fri, Jul 01, 2016 at 04:30:44PM +0200, Andrea Bolognani wrote:
> audit is using cap-ng itself since version 2.6.1, and it gets
> to initialize the internal state of the cap-ng library before
> we call fork(). Because of that, our own use of cap-ng in the
> child process ends up attempting to change the capabilities of
> the parent process instead of the child process, which fails.
>
> Calling capng_setpid() before using any other cap-ng API
> ensures we're altering the capabilities of the right process.
I really don't want to do any hack workaround in libvirt until we've
got feedback from the cap-ng maintainers, as I think it is really
their bug to fix.
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
More information about the libvir-list
mailing list