Remove POSIX file capabilities from executables on erase/rename too

- Just like suid/sgid bits, hardlinks to executables with capabilities
  set can "leak" permissions to old, potentially vulnerable versions
  of binaries. Related to RhBug:598775.

1 files changed, 7 insertions, 2 deletions

diff --git a/lib/fsm.c b/lib/fsm.c
index a4458eeb3..068c65d39 100644
--- a/lib/fsm.c
+++ b/lib/fsm.c
@@ -1264,10 +1264,15 @@ static int fsmMkdirs(FSM_t fsm)
 static void removeSBITS(const char *path)
 {
     struct stat stb;
-    if (lstat(path, &stb) == 0) {
-	if (S_ISREG(stb.st_mode) && (stb.st_mode & 06000) != 0) {
+    if (lstat(path, &stb) == 0 && S_ISREG(stb.st_mode)) {
+	if ((stb.st_mode & 06000) != 0) {
 	    (void) chmod(path, stb.st_mode & 0777);
 	}
+#if WITH_CAP
+	if (stb.st_mode & (S_IXUSR|S_IXGRP|S_IXOTH)) {
+	    (void) cap_set_file(path, NULL);
+	}
+#endif
     }
 }