Skip to content

Commit c4e2695

Browse files
committed
squash! src: allow CAP_NET_BIND_SERVICE in SafeGetenv
This commit updates the capabilities check to use the permitted set instead of the effective. And it also checks the second element of cap_data which can contain 64 bit capability masks.
1 parent 95bbd04 commit c4e2695

File tree

1 file changed

+6
-2
lines changed

1 file changed

+6
-2
lines changed

src/node_credentials.cc

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,10 +48,14 @@ bool HasOnly(int capability) {
4848
getpid()};
4949

5050

51-
if (syscall(SYS_capget, &cap_header_data, &cap_data[0]) != 0) {
51+
if (syscall(SYS_capget, &cap_header_data, &cap_data) != 0) {
5252
return false;
5353
}
54-
return cap_data[0].effective ==
54+
if (capability < 32) {
55+
return cap_data[0].permitted ==
56+
static_cast<unsigned int>(CAP_TO_MASK(capability));
57+
}
58+
return cap_data[1].permitted ==
5559
static_cast<unsigned int>(CAP_TO_MASK(capability));
5660
}
5761
#endif

0 commit comments

Comments
 (0)