shaba/ostree
1
0
Fork 0
mirror of https://github.com/ostreedev/ostree.git synced 2024-12-21 13:34:34 +03:00
Code Issues Projects Releases Wiki Activity

chore: Check CAP_SYS_ADMIN in ot_util_process_privileged

Browse Source
This commit is contained in:
Misaki Kasumi 2024-12-20 20:35:08 +08:00
parent 1bd9aa6461
commit f9bf9ac560
1 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/libotutil/ot-unix-utils.c
View File

@ -32,6 +32,9 @@
#include <stdlib.h>
#include <string.h>
#include <sys/types.h>
#include <sys/prctl.h>
#include <linux/prctl.h>
#include <linux/capability.h>
#include <unistd.h>
/* Ensure that a pathname component @name does not contain the special Unix
@ -107,5 +110,12 @@ ot_util_path_split_validate (const char *path, GPtrArray **out_components, GErro
gboolean
ot_util_process_privileged (void)
{
return geteuid() == 0;
if (geteuid() != 0)
return FALSE;
// https://github.com/containers/bootc/blob/c88fcfd6e145863408bde7d4706937dd323f64e2/lib/src/cli.rs#L621
if (prctl (PR_CAPBSET_READ, CAP_SYS_ADMIN) != 1)
return FALSE;
return TRUE;
}