* [PATCH] Before clearing the capability bounding set, check if we have the cap
@ 2012-06-12 11:51 harald
2012-06-12 12:17 ` Jeff Layton
2012-06-19 14:53 ` Steve Dickson
0 siblings, 2 replies; 4+ messages in thread
From: harald @ 2012-06-12 11:51 UTC (permalink / raw)
To: steved; +Cc: linux-nfs, jlayton, Harald Hoyer
From: Harald Hoyer <harald@redhat.com>
PR_CAPBSET_DROP can return EINVAL, if an older kernel does support
some capabilities, which are defined by CAP_LAST_CAP, which results in
a failure of the service.
For example kernel 3.4 errors on CAP_EPOLLWAKEUP, which was newly
introduced in 3.5.
So, for future capabilities, we clear until we get an EINVAL for
PR_CAPBSET_READ.
---
support/nsm/file.c | 2 +-
utils/nfsdcld/nfsdcld.c | 4 ++--
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/support/nsm/file.c b/support/nsm/file.c
index 5476446..4711c2c 100644
--- a/support/nsm/file.c
+++ b/support/nsm/file.c
@@ -386,7 +386,7 @@ prune_bounding_set(void)
}
/* prune the bounding set to nothing */
- for (i = 0; i <= CAP_LAST_CAP; ++i) {
+ for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >=0 ; ++i) {
ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
if (ret) {
xlog(L_ERROR, "Unable to prune capability %lu from "
diff --git a/utils/nfsdcld/nfsdcld.c b/utils/nfsdcld/nfsdcld.c
index e7af4e3..473d069 100644
--- a/utils/nfsdcld/nfsdcld.c
+++ b/utils/nfsdcld/nfsdcld.c
@@ -102,8 +102,8 @@ cld_set_caps(void)
}
/* prune the bounding set to nothing */
- for (i = 0; i <= CAP_LAST_CAP; ++i) {
- ret = prctl(PR_CAPBSET_DROP, i);
+ for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0 ; ++i) {
+ ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
if (ret) {
xlog(L_ERROR, "Unable to prune capability %lu from "
"bounding set: %m", i);
--
1.7.10.2
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] Before clearing the capability bounding set, check if we have the cap
2012-06-12 11:51 [PATCH] Before clearing the capability bounding set, check if we have the cap harald
@ 2012-06-12 12:17 ` Jeff Layton
2012-06-12 12:22 ` Harald Hoyer
2012-06-19 14:53 ` Steve Dickson
1 sibling, 1 reply; 4+ messages in thread
From: Jeff Layton @ 2012-06-12 12:17 UTC (permalink / raw)
To: harald; +Cc: steved, linux-nfs
On Tue, 12 Jun 2012 13:51:06 +0200
harald@redhat.com wrote:
> From: Harald Hoyer <harald@redhat.com>
>
> PR_CAPBSET_DROP can return EINVAL, if an older kernel does support
> some capabilities, which are defined by CAP_LAST_CAP, which results in
> a failure of the service.
>
> For example kernel 3.4 errors on CAP_EPOLLWAKEUP, which was newly
> introduced in 3.5.
>
> So, for future capabilities, we clear until we get an EINVAL for
> PR_CAPBSET_READ.
> ---
> support/nsm/file.c | 2 +-
> utils/nfsdcld/nfsdcld.c | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/support/nsm/file.c b/support/nsm/file.c
> index 5476446..4711c2c 100644
> --- a/support/nsm/file.c
> +++ b/support/nsm/file.c
> @@ -386,7 +386,7 @@ prune_bounding_set(void)
> }
>
> /* prune the bounding set to nothing */
> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >=0 ; ++i) {
> ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
> if (ret) {
> xlog(L_ERROR, "Unable to prune capability %lu from "
> diff --git a/utils/nfsdcld/nfsdcld.c b/utils/nfsdcld/nfsdcld.c
> index e7af4e3..473d069 100644
> --- a/utils/nfsdcld/nfsdcld.c
> +++ b/utils/nfsdcld/nfsdcld.c
> @@ -102,8 +102,8 @@ cld_set_caps(void)
> }
>
> /* prune the bounding set to nothing */
> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
> - ret = prctl(PR_CAPBSET_DROP, i);
> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0 ; ++i) {
> + ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
> if (ret) {
> xlog(L_ERROR, "Unable to prune capability %lu from "
> "bounding set: %m", i);
Thanks, looks like a reasonable method. Did you find this by
inspection, or did you or someone else hit the problem?
Reviewed-by: Jeff Layton <jlayton@redhat.com>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] Before clearing the capability bounding set, check if we have the cap
2012-06-12 12:17 ` Jeff Layton
@ 2012-06-12 12:22 ` Harald Hoyer
0 siblings, 0 replies; 4+ messages in thread
From: Harald Hoyer @ 2012-06-12 12:22 UTC (permalink / raw)
To: Jeff Layton; +Cc: steved, linux-nfs
On 06/12/2012 02:17 PM, Jeff Layton wrote:
> On Tue, 12 Jun 2012 13:51:06 +0200
> harald@redhat.com wrote:
>
>> From: Harald Hoyer <harald@redhat.com>
>>
>> PR_CAPBSET_DROP can return EINVAL, if an older kernel does support
>> some capabilities, which are defined by CAP_LAST_CAP, which results in
>> a failure of the service.
>>
>> For example kernel 3.4 errors on CAP_EPOLLWAKEUP, which was newly
>> introduced in 3.5.
>>
>> So, for future capabilities, we clear until we get an EINVAL for
>> PR_CAPBSET_READ.
>> ---
>> support/nsm/file.c | 2 +-
>> utils/nfsdcld/nfsdcld.c | 4 ++--
>> 2 files changed, 3 insertions(+), 3 deletions(-)
>>
>> diff --git a/support/nsm/file.c b/support/nsm/file.c
>> index 5476446..4711c2c 100644
>> --- a/support/nsm/file.c
>> +++ b/support/nsm/file.c
>> @@ -386,7 +386,7 @@ prune_bounding_set(void)
>> }
>>
>> /* prune the bounding set to nothing */
>> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
>> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >=0 ; ++i) {
>> ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
>> if (ret) {
>> xlog(L_ERROR, "Unable to prune capability %lu from "
>> diff --git a/utils/nfsdcld/nfsdcld.c b/utils/nfsdcld/nfsdcld.c
>> index e7af4e3..473d069 100644
>> --- a/utils/nfsdcld/nfsdcld.c
>> +++ b/utils/nfsdcld/nfsdcld.c
>> @@ -102,8 +102,8 @@ cld_set_caps(void)
>> }
>>
>> /* prune the bounding set to nothing */
>> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
>> - ret = prctl(PR_CAPBSET_DROP, i);
>> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0 ; ++i) {
>> + ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
>> if (ret) {
>> xlog(L_ERROR, "Unable to prune capability %lu from "
>> "bounding set: %m", i);
>
> Thanks, looks like a reasonable method. Did you find this by
> inspection, or did you or someone else hit the problem?
>
> Reviewed-by: Jeff Layton <jlayton@redhat.com>
>
I am currently running rawhide with kernel 3.4.0 and rpc.statd failed.
rpc.statd[19338]: Unable to prune capability 36 from bounding set: Invalid argument
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] Before clearing the capability bounding set, check if we have the cap
2012-06-12 11:51 [PATCH] Before clearing the capability bounding set, check if we have the cap harald
2012-06-12 12:17 ` Jeff Layton
@ 2012-06-19 14:53 ` Steve Dickson
1 sibling, 0 replies; 4+ messages in thread
From: Steve Dickson @ 2012-06-19 14:53 UTC (permalink / raw)
To: harald; +Cc: linux-nfs, jlayton
On 06/12/2012 07:51 AM, harald@redhat.com wrote:
> From: Harald Hoyer <harald@redhat.com>
>
> PR_CAPBSET_DROP can return EINVAL, if an older kernel does support
> some capabilities, which are defined by CAP_LAST_CAP, which results in
> a failure of the service.
>
> For example kernel 3.4 errors on CAP_EPOLLWAKEUP, which was newly
> introduced in 3.5.
>
> So, for future capabilities, we clear until we get an EINVAL for
> PR_CAPBSET_READ.
Committed...
steved.
> ---
> support/nsm/file.c | 2 +-
> utils/nfsdcld/nfsdcld.c | 4 ++--
> 2 files changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/support/nsm/file.c b/support/nsm/file.c
> index 5476446..4711c2c 100644
> --- a/support/nsm/file.c
> +++ b/support/nsm/file.c
> @@ -386,7 +386,7 @@ prune_bounding_set(void)
> }
>
> /* prune the bounding set to nothing */
> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >=0 ; ++i) {
> ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
> if (ret) {
> xlog(L_ERROR, "Unable to prune capability %lu from "
> diff --git a/utils/nfsdcld/nfsdcld.c b/utils/nfsdcld/nfsdcld.c
> index e7af4e3..473d069 100644
> --- a/utils/nfsdcld/nfsdcld.c
> +++ b/utils/nfsdcld/nfsdcld.c
> @@ -102,8 +102,8 @@ cld_set_caps(void)
> }
>
> /* prune the bounding set to nothing */
> - for (i = 0; i <= CAP_LAST_CAP; ++i) {
> - ret = prctl(PR_CAPBSET_DROP, i);
> + for (i = 0; prctl(PR_CAPBSET_READ, i, 0, 0, 0) >= 0 ; ++i) {
> + ret = prctl(PR_CAPBSET_DROP, i, 0, 0, 0);
> if (ret) {
> xlog(L_ERROR, "Unable to prune capability %lu from "
> "bounding set: %m", i);
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2012-06-19 14:54 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-06-12 11:51 [PATCH] Before clearing the capability bounding set, check if we have the cap harald
2012-06-12 12:17 ` Jeff Layton
2012-06-12 12:22 ` Harald Hoyer
2012-06-19 14:53 ` Steve Dickson
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).