guiwf/lix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

libstore: remove unnecessary linux-specific RunOptions

Browse Source 
Change-Id: I07303c2aea78cf9f17b89b5cea922271ce26f029
This commit is contained in:
eldritch horrors
2026-01-30 00:29:27 +00:00
parent d43c6dd100
commit a2500db977
2 changed files with 0 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lix/libutil/processes.cc
-53
View File
@@ -368,59 +368,6 @@ RunningProgram runProgram2(const RunOptions & options)
}
}
#if __linux__
if (!options.caps.empty() && prctl(PR_SET_KEEPCAPS, 1) < 0) {
throw SysError("setting keep-caps failed");
}
#endif
if (options.gid && setgid(*options.gid) == -1)
throw SysError("setgid failed");
/* Drop all other groups if we're setgid. */
if (options.gid && setgroups(0, 0) == -1)
throw SysError("setgroups failed");
if (options.uid && setuid(*options.uid) == -1)
throw SysError("setuid failed");
#if __linux__
if (!options.caps.empty()) {
if (prctl(PR_SET_KEEPCAPS, 0)) {
throw SysError("clearing keep-caps failed");
}
// we do the capability dance like this to avoid a dependency
// on libcap, which has a rather large build closure and many
// more features that we need for now. maybe some other time.
static constexpr uint32_t LINUX_CAPABILITY_VERSION_3 = 0x20080522;
static constexpr uint32_t LINUX_CAPABILITY_U32S_3 = 2;
struct user_cap_header_struct
{
uint32_t version;
int pid;
} hdr = {LINUX_CAPABILITY_VERSION_3, 0};
struct user_cap_data_struct
{
uint32_t effective;
uint32_t permitted;
uint32_t inheritable;
} data[LINUX_CAPABILITY_U32S_3] = {};
for (auto cap : options.caps) {
assert(cap / 32 < LINUX_CAPABILITY_U32S_3);
data[cap / 32].permitted |= 1 << (cap % 32);
data[cap / 32].inheritable |= 1 << (cap % 32);
}
if (syscall(SYS_capset, &hdr, data)) {
throw SysError("couldn't set capabilities");
}
for (auto cap : options.caps) {
if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, cap, 0, 0) < 0) {
throw SysError("couldn't set ambient caps");
}
}
}
#endif
Strings args_(options.args);
args_.push_front(options.argv0.value_or(options.program));
lix/libutil/processes.hh
-5
View File
@@ -107,14 +107,9 @@ struct RunOptions
bool searchPath = true;
std::optional<std::string> argv0;
Strings args = {};
std::optional<uid_t> uid = {};
std::optional<uid_t> gid = {};
std::optional<std::map<std::string, std::string>> environment = {};
bool captureStdout = false;
std::vector<Redirection> redirections;
#if __linux__
std::set<long> caps;
#endif
};
struct [[nodiscard("you must call RunningProgram::wait()")]] RunningProgram