From: Lennart Poettering <lennart@poettering.net>
Date: Tue, 9 Oct 2012 20:25:32 +0000 (+0200)
Subject: detect-virt: install with fs caps by default to allow unprivileged access
X-Git-Tag: v195~146
X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=commitdiff_plain;h=96ede2601f27cd5fe52eed96b873bef55cd0ce23;hp=7a69007a24cfff30158ea80665cb6c3c9d3251b0

detect-virt: install with fs caps by default to allow unprivileged access
---

diff --git a/Makefile.am b/Makefile.am
index 621da0326..0b3013b44 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -1403,6 +1403,12 @@ systemd_detect_virt_SOURCES = \
 systemd_detect_virt_LDADD = \
 	libsystemd-shared.la
 
+systemd-detect-virt-install-hook:
+	$(SETCAP) cap_dac_override,cap_sys_ptrace=ep $(DESTDIR)$(bindir)/systemd-detect-virt ||:
+
+INSTALL_EXEC_HOOKS += \
+	systemd-detect-virt-install-hook
+
 # ------------------------------------------------------------------------------
 systemd_delta_SOURCES = \
 	src/delta/delta.c
diff --git a/configure.ac b/configure.ac
index 5d7d0c286..09818d6ec 100644
--- a/configure.ac
+++ b/configure.ac
@@ -67,6 +67,8 @@ AC_PATH_PROG([XSLTPROC], [xsltproc])
 AC_PATH_PROG([QUOTAON], [quotaon], [/sbin/quotaon])
 AC_PATH_PROG([QUOTACHECK], [quotacheck], [/sbin/quotacheck])
 
+AC_PATH_PROG([SETCAP], [setcap], [/sbin/setcap])
+
 # gtkdocize greps for '^GTK_DOC_CHECK', so it needs to be on its own line
 m4_ifdef([GTK_DOC_CHECK], [
 GTK_DOC_CHECK([1.18],[--flavour no-tmpl])
diff --git a/src/shared/virt.c b/src/shared/virt.c
index 6e4479449..fc62c7232 100644
--- a/src/shared/virt.c
+++ b/src/shared/virt.c
@@ -159,10 +159,10 @@ int detect_container(const char **id) {
         /* Unfortunately many of these operations require root access
          * in one way or another */
 
-        if (geteuid() != 0)
-                return -EPERM;
-
-        if (running_in_chroot() > 0) {
+        r = running_in_chroot();
+        if (r < 0)
+                return r;
+        if (r > 0) {
 
                 if (id)
                         *id = "chroot";