summaryrefslogtreecommitdiff
path: root/src/import
diff options
context:
space:
mode:
authorIsmo Puustinen <ismo.puustinen@intel.com>2016-01-08 00:00:04 +0200
committerIsmo Puustinen <ismo.puustinen@intel.com>2016-01-12 12:14:50 +0200
commita103496ca585e22bb5e386e3238b468d133f5659 (patch)
tree7d9b33722f54c969fc145f7d5fe31afe13aff09c /src/import
parentf466acdc633fc496961eff0c7f66501f4588e5b6 (diff)
capabilities: keep bounding set in non-inverted format.
Change the capability bounding set parser and logic so that the bounding set is kept as a positive set internally. This means that the set reflects those capabilities that we want to keep instead of drop.
Diffstat (limited to 'src/import')
-rw-r--r--src/import/import-common.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/src/import/import-common.c b/src/import/import-common.c
index a8551ca9e8..8a48bd7bf9 100644
--- a/src/import/import-common.c
+++ b/src/import/import-common.c
@@ -134,7 +134,7 @@ int import_fork_tar_x(const char *path, pid_t *ret) {
if (unshare(CLONE_NEWNET) < 0)
log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m");
- r = capability_bounding_set_drop(~retain, true);
+ r = capability_bounding_set_drop(retain, true);
if (r < 0)
log_error_errno(r, "Failed to drop capabilities, ignoring: %m");
@@ -208,7 +208,7 @@ int import_fork_tar_c(const char *path, pid_t *ret) {
if (unshare(CLONE_NEWNET) < 0)
log_error_errno(errno, "Failed to lock tar into network namespace, ignoring: %m");
- r = capability_bounding_set_drop(~retain, true);
+ r = capability_bounding_set_drop(retain, true);
if (r < 0)
log_error_errno(r, "Failed to drop capabilities, ignoring: %m");