Re: [PATCH iproute2] ip: do not drop capabilities if net_admin=i is set
From: Stephen Hemminger <stephen@networkplumber.org>
Date: 2018-05-15 04:10:13
On Fri, 11 May 2018 13:39:56 +0100 Luca Boccassi [off-list ref] wrote:
Users have reported a regression due to ip now dropping capabilities
unconditionally.
zerotier-one VPN and VirtualBox use ambient capabilities in their
binary and then fork out to ip to set routes and links, and this
does not work anymore.
As a workaround, do not drop caps if CAP_NET_ADMIN (the most common
capability used by ip) is set with the INHERITABLE flag.
Users that want ip vrf exec to work do not need to set INHERITABLE,
which will then only set when the calling program had privileges to
give itself the ambient capability.
Fixes: ba2fc55b99f8 ("Drop capabilities if not running ip exec vrf with libcap")
Signed-off-by: Luca Boccassi <redacted>Applied