From e5999b46792b859043a62431d426a280f26a16d7 Mon Sep 17 00:00:00 2001 From: Tom Gundersen Date: Tue, 3 Jun 2014 11:46:25 +0200 Subject: [PATCH] shared: capability - don't loop over the cap bits if they are all unset --- src/shared/capability.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/shared/capability.c b/src/shared/capability.c index 58270ad8c..439aac7ea 100644 --- a/src/shared/capability.c +++ b/src/shared/capability.c @@ -264,11 +264,11 @@ int drop_privileges(uid_t uid, gid_t gid, uint64_t keep_capabilities) { if (!d) return log_oom(); - for (i = 0; i < sizeof(keep_capabilities)*8; i++) - if (keep_capabilities & (1ULL << i)) - bits[j++] = i; - if (keep_capabilities) { + for (i = 0; i < sizeof(keep_capabilities)*8; i++) + if (keep_capabilities & (1ULL << i)) + bits[j++] = i; + if (cap_set_flag(d, CAP_EFFECTIVE, j, bits, CAP_SET) < 0 || cap_set_flag(d, CAP_PERMITTED, j, bits, CAP_SET) < 0) { log_error("Failed to enable capabilities bits: %m"); -- 2.30.2