Fixed dropping capabilities in case cap_sys_time is not available

1 files changed, 20 insertions, 2 deletions

diff --git a/vdr.c b/vdr.c
index 140f7501..0ffa1fca 100644
--- a/vdr.c
+++ b/vdr.c
@@ -22,7 +22,7 @@
  *
  * The project's page is at http://www.tvdr.de
  *
- * $Id: vdr.c 4.28 2019/03/12 10:01:16 kls Exp $
+ * $Id: vdr.c 4.29 2019/03/18 11:17:07 kls Exp $
  */
 
 #include <getopt.h>
@@ -126,7 +126,25 @@ static bool SetUser(const char *User, bool UserDump)
 static bool DropCaps(void)
 {
   // drop all capabilities except selected ones
-  cap_t caps = cap_from_text("= cap_sys_nice,cap_sys_time,cap_net_raw=ep");
+  cap_t caps_all = cap_get_proc();
+  if (!caps_all) {
+     fprintf(stderr, "vdr: cap_get_proc failed: %s\n", strerror(errno));
+     return false;
+     }
+  char *caps_text = cap_to_text(caps_all, NULL);
+  if (!caps_text) {
+     fprintf(stderr, "vdr: cap_to_text failed: %s\n", strerror(errno));
+     return false;
+     }
+  if (cap_free(caps_all)) {
+     fprintf(stderr, "vdr: cap_free failed: %s\n", strerror(errno));
+     return false;
+     }
+  cap_t caps;
+  if (strstr(caps_text,"cap_sys_time"))
+     caps = cap_from_text("= cap_sys_nice,cap_sys_time,cap_net_raw=ep");
+  else
+     caps = cap_from_text("= cap_sys_nice,cap_net_raw=ep");
   if (!caps) {
      fprintf(stderr, "vdr: cap_from_text failed: %s\n", strerror(errno));
      return false;