exec: Assigning the empty string to CapabilityBoundSet= should drop all caps

Previously, it would set all caps, but it should drop them all, anything
else makes little sense.

Also, document that this works as it does, and what to do in order to
assign all caps to the bounding set.

https://bugzilla.redhat.com/show_bug.cgi?id=914705

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index b1cd685cc0ba39be5920ba2e5a0e53e1ea7b573a..69ee4fc5e88c71b4168711d4350d6534f5a296b7 100644 (file)
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -719,29 +719,38 @@
                                 for details. Takes a whitespace
                                 separated list of capability names as
                                 read by
-                                <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>.
+                                <citerefentry><refentrytitle>cap_from_name</refentrytitle><manvolnum>3</manvolnum></citerefentry>,
+                                e.g. <literal>CAP_SYS_ADMIN
+                                CAP_DAC_OVERRIDE
+                                CAP_SYS_PTRACE</literal>.
                                 Capabilities listed will be included
                                 in the bounding set, all others are
                                 removed. If the list of capabilities
-                                is prefixed with ~ all but the listed
-                                capabilities will be included, the
-                                effect of the assignment
-                                inverted. Note that this option also
-                                effects the respective capabilities in
-                                the effective, permitted and
-                                inheritable capability sets, on top of
-                                what <varname>Capabilities=</varname>
+                                is prefixed with <literal>~</literal>
+                                all but the listed capabilities will
+                                be included, the effect of the
+                                assignment inverted. Note that this
+                                option also affects the respective
+                                capabilities in the effective,
+                                permitted and inheritable capability
+                                sets, on top of what
+                                <varname>Capabilities=</varname>
                                 does. If this option is not used the
                                 capability bounding set is not
                                 modified on process execution, hence
                                 no limits on the capabilities of the
                                 process are enforced. This option may
                                 appear more than once in which case
-                                the bounding sets are merged. If the empty
-                                string is assigned to this option the
-                                bounding set is reset, and all prior
-                                settings have no
-                                effect.</para></listitem>
+                                the bounding sets are merged. If the
+                                empty string is assigned to this
+                                option the bounding set is reset to
+                                the empty capability set, and all
+                                prior settings have no effect. If set
+                                to <literal>~</literal> (without any
+                                further argument) the bounding set is
+                                reset to the full set of available
+                                capabilities, also undoing any
+                                previous settings.</para></listitem>
                         </varlistentry>
 
                         <varlistentry>

diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index 2204c67a4b636abc6a82eac777d5a2a042fd993b..6d90428af01ac945fafd0105ff6101649417a33c 100644 (file)
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -889,12 +889,6 @@ int config_parse_bounding_set(
         assert(rvalue);
         assert(data);
 
-        if (isempty(rvalue)) {
-                /* An empty assignment resets */
-                *capability_bounding_set_drop = 0;
-                return 0;
-        }
-
         if (rvalue[0] == '~') {
                 invert = true;
                 rvalue++;

diff --git a/src/core/unit.c b/src/core/unit.c
index a1249dc093b47de9c172c571f200449c7fcb6fff..d43558e6df2838fcb9b7e073b0c1a96002e1cdab 100644 (file)
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -2645,7 +2645,14 @@ int unit_kill(Unit *u, KillWho w, int signo, DBusError *error) {
         return UNIT_VTABLE(u)->kill(u, w, signo, error);
 }
 
-int unit_kill_common(Unit *u, KillWho who, int signo, pid_t main_pid, pid_t control_pid, DBusError *error) {
+int unit_kill_common(
+                Unit *u,
+                KillWho who,
+                int signo,
+                pid_t main_pid,
+                pid_t control_pid,
+                DBusError *error) {
+
         int r = 0;
 
         if (who == KILL_MAIN && main_pid <= 0) {