Bug 209873

Summary: capsh argument "==" does not work reliably
Product: Tools Reporter: Andrew G. Morgan (morgan)
Component: libcapAssignee: Andrew G. Morgan (morgan)
Status: RESOLVED CODE_FIX    
Severity: normal    
Priority: P1    
Hardware: All   
OS: Linux   
Kernel Version: a/a Subsystem:
Regression: No Bisected commit-id:

Description Andrew G. Morgan 2020-10-26 15:15:11 UTC 
[This bug was reported via email by Marcus Gelderie.]

The "==" argument is supposed to re-exec capsh with the remaining command line arguments. It only works reliably if you explicitly specify the full pathname of the capsh file. For example:

$ /sbin/capsh == --print
Current: =
[...]

However, if you rely on the PATH to find capsh it fails with a misleading error:

$ PATH=/sbin capsh == --print
execve /bin/bash failed!

There are two issues here:

1. The "==" attempt fails in this latter case
2. The error is displaying the shell path and not the failed capsh binary path.

This fails at HEAD.

There is a subtlety at work here related to --chroot. There may not be a capsh present at the same location in the PATH after the chroot.

We'll resolve this bug when 1 and 2 are no longer true and we've documented how things work in the case of chroot use.
Comment 2 Andrew G. Morgan 2020-10-28 13:01:02 UTC 
Bug fix still needed.