kmod: conditionalize kmod setup on CAP_SYS_MODULE, not whether we run in a container

It's generally preferrable to conditionalize on the actual ability to do
something then the context we run in.

1 files changed, 5 insertions, 1 deletions

diff --git a/src/core/kmod-setup.c b/src/core/kmod-setup.c
index 0791ae8ead..2f3f608830 100644
--- a/src/core/kmod-setup.c
+++ b/src/core/kmod-setup.c
@@ -27,7 +27,7 @@
 
 #include "macro.h"
 #include "execute.h"
-
+#include "capability.h"
 #include "kmod-setup.h"
 
 static void systemd_kmod_log(
@@ -54,6 +54,7 @@ static bool cmdline_check_kdbus(void) {
 }
 
 int kmod_setup(void) {
+
         static const struct {
                 const char *module;
                 const char *path;
@@ -76,6 +77,9 @@ int kmod_setup(void) {
         unsigned int i;
         int r;
 
+        if (have_effective_cap(CAP_SYS_MODULE) == 0)
+                return 0;
+
         for (i = 0; i < ELEMENTSOF(kmod_table); i++) {
                 struct kmod_module *mod;