main: drop capabilities of userhelpers before ours

First drop the capabilities of the userhelpers before dropping our own,
otherwise we might not be allowed to drop the capabilities of the
userhelpers. Especially, if we want to drop CAP_SYS_MODULE.

Credits: Matteo Sasso

diff --git a/src/core/main.c b/src/core/main.c
index 0178f107200a300e7f38199204f2f39c5d61a00d..72bd542af01a9a0978f1f6d99328f87425a96624 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1509,14 +1509,14 @@ int main(int argc, char *argv[]) {
                         log_error("Failed to adjust timer slack: %m");
 
         if (arg_capability_bounding_set_drop) {
-                r = capability_bounding_set_drop(arg_capability_bounding_set_drop, true);
+                r = capability_bounding_set_drop_usermode(arg_capability_bounding_set_drop);
                 if (r < 0) {
-                        log_error("Failed to drop capability bounding set: %s", strerror(-r));
+                        log_error("Failed to drop capability bounding set of usermode helpers: %s", strerror(-r));
                         goto finish;
                 }
-                r = capability_bounding_set_drop_usermode(arg_capability_bounding_set_drop);
+                r = capability_bounding_set_drop(arg_capability_bounding_set_drop, true);
                 if (r < 0) {
-                        log_error("Failed to drop capability bounding set of usermode helpers: %s", strerror(-r));
+                        log_error("Failed to drop capability bounding set: %s", strerror(-r));
                         goto finish;
                 }
         }