summaryrefslogtreecommitdiff
path: root/progs/setcap.c
diff options
context:
space:
mode:
Diffstat (limited to 'progs/setcap.c')
-rw-r--r--progs/setcap.c27
1 files changed, 25 insertions, 2 deletions
diff --git a/progs/setcap.c b/progs/setcap.c
index 0215fc4..83090ae 100644
--- a/progs/setcap.c
+++ b/progs/setcap.c
@@ -26,7 +26,7 @@ static void usage(void)
static int read_caps(int quiet, const char *filename, char *buffer)
{
- int i=MAXCAP;
+ int i = MAXCAP;
if (!quiet) {
fprintf(stderr, "Please enter caps for file [empty line to end]:\n");
@@ -170,10 +170,33 @@ int main(int argc, char **argv)
}
retval = cap_set_file(*++argv, cap_d);
if (retval != 0) {
+ int explained = 0;
+#ifdef linux
+ cap_value_t cap;
+ cap_flag_value_t per_state;
+
+ for (cap = 0;
+ cap_get_flag(cap_d, cap, CAP_PERMITTED, &per_state) != -1;
+ cap++) {
+ cap_flag_value_t inh_state, eff_state;
+
+ cap_get_flag(cap_d, cap, CAP_INHERITABLE, &inh_state);
+ cap_get_flag(cap_d, cap, CAP_EFFECTIVE, &eff_state);
+ if ((inh_state | per_state) != eff_state) {
+ fprintf(stderr, "NOTE: Under Linux, effective file capabilities must either be empty, or\n"
+ " exactly match the union of selected permitted and inheritable bits.\n");
+ explained = 1;
+ break;
+ }
+ }
+#endif /* def linux */
+
fprintf(stderr,
"Failed to set capabilities on file `%s' (%s)\n",
argv[0], strerror(errno));
- usage();
+ if (!explained) {
+ usage();
+ }
}
}
if (cap_d) {