From 40d0707827ee154bcb03013abe6f72f1026a70c9 Mon Sep 17 00:00:00 2001
From: James Peach <jpeach@samba.org>
Date: Wed, 22 Mar 2006 23:49:09 +0000
Subject: r14668: Set the FILE_STATUS_OFFLINE bit by observing the events a
 DMAPI-based HSM is interested in. Tested on both IRIX and SLES9. (This used
 to be commit 514a767c57f8194547e5b708ad2573ab9a0719c6)

---
 source3/lib/system.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

(limited to 'source3/lib/system.c')

diff --git a/source3/lib/system.c b/source3/lib/system.c
index ffb7031715..2e5f42307b 100644
--- a/source3/lib/system.c
+++ b/source3/lib/system.c
@@ -22,6 +22,10 @@
 
 #include "includes.h"
 
+#ifdef HAVE_SYS_PRCTL_H
+#include <sys/prctl.h>
+#endif
+
 /*
    The idea is that this file will eventually have wrappers around all
    important system calls in samba. The aims are:
@@ -661,6 +665,19 @@ static BOOL set_process_capability(enum smbd_capability capability,
 
 	cap_t cap;
 
+#if defined(HAVE_PRCTL) && defined(PR_GET_KEEPCAPS) && defined(PR_SET_KEEPCAPS)
+	/* On Linux, make sure that any capabilities we grab are sticky
+	 * across UID changes. We expect that this would allow us to keep both
+	 * the effective and permitted capability sets, but as of circa 2.6.16,
+	 * only the permitted set is kept. It is a bug (which we work around)
+	 * that the effective set is lost, but we still require the effective
+	 * set to be kept.
+	 */
+	if (!prctl(PR_GET_KEEPCAPS)) {
+		prctl(PR_SET_KEEPCAPS, 1);
+	}
+#endif
+
 	cap = cap_get_proc();
 	if (cap == NULL) {
 		DEBUG(0,("set_process_capability: cap_get_proc failed: %s\n",
@@ -673,6 +690,15 @@ static BOOL set_process_capability(enum smbd_capability capability,
 #ifdef CAP_NETWORK_MGT
 			/* IRIX has CAP_NETWORK_MGT for oplocks. */
 			cap_vals[num_cap_vals++] = CAP_NETWORK_MGT;
+#endif
+			break;
+		case DMAPI_ACCESS_CAPABILITY:
+#ifdef CAP_DEVICE_MGT
+			/* IRIX has CAP_DEVICE_MGT for DMAPI access. */
+			cap_vals[num_cap_vals++] = CAP_DEVICE_MGT;
+#elif CAP_MKNOD
+			/* Linux has CAP_MKNOD for DMAPI access. */
+			cap_vals[num_cap_vals++] = CAP_MKNOD;
 #endif
 			break;
 	}
@@ -686,6 +712,10 @@ static BOOL set_process_capability(enum smbd_capability capability,
 
 	cap_set_flag(cap, CAP_EFFECTIVE, num_cap_vals, cap_vals,
 		enable ? CAP_SET : CAP_CLEAR);
+
+	/* We never want to pass capabilities down to our children, so make
+	 * sure they are not inherited.
+	 */
 	cap_set_flag(cap, CAP_INHERITABLE, num_cap_vals, cap_vals, CAP_CLEAR);
 
 	if (cap_set_proc(cap) == -1) {
-- 
cgit