From a0959da3680b4ce8cf911caf3293a6d90f88eeb7 Mon Sep 17 00:00:00 2001 From: Damien Miller Date: Wed, 5 Feb 2014 10:33:45 +1100 Subject: - (djm) [sandbox-capsicum.c] Don't fatal if Capsicum is offered by headers/libc but not supported by the kernel. Patch from Loganaden Velvindron @ AfriNIC --- sandbox-capsicum.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) (limited to 'sandbox-capsicum.c') diff --git a/sandbox-capsicum.c b/sandbox-capsicum.c index ee2a7e79e..655f0d217 100644 --- a/sandbox-capsicum.c +++ b/sandbox-capsicum.c @@ -94,10 +94,12 @@ ssh_sandbox_child(struct ssh_sandbox *box) fatal("can't limit stderr: %m"); cap_rights_init(&rights, CAP_READ, CAP_WRITE); - if (cap_rights_limit(box->monitor->m_recvfd, &rights) == -1) + if (cap_rights_limit(box->monitor->m_recvfd, &rights) < 0 && + errno != ENOSYS) fatal("%s: failed to limit the network socket", __func__); cap_rights_init(&rights, CAP_WRITE); - if (cap_rights_limit(box->monitor->m_log_sendfd, &rights) == -1) + if (cap_rights_limit(box->monitor->m_log_sendfd, &rights) < 0 && + errno != ENOSYS) fatal("%s: failed to limit the logging socket", __func__); if (cap_enter() < 0 && errno != ENOSYS) fatal("%s: failed to enter capability mode", __func__); -- cgit v1.2.3