From ce45ded2a8c1b0c0e601779bcc3e54668a14e271 Mon Sep 17 00:00:00 2001 From: Roman Arutyunyan Date: Tue, 19 Dec 2017 19:00:27 +0300 Subject: Fixed capabilities version. Previously, capset(2) was called with the 64-bit capabilities version _LINUX_CAPABILITY_VERSION_3. With this version Linux kernel expected two copies of struct __user_cap_data_struct, while only one was submitted. As a result, random stack memory was accessed and random capabilities were requested by the worker. This sometimes caused capset() errors. Now the 32-bit version _LINUX_CAPABILITY_VERSION_1 is used instead. This is OK since CAP_NET_RAW is a 32-bit capability (CAP_NET_RAW = 13). --- auto/os/linux | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'auto') diff --git a/auto/os/linux b/auto/os/linux index 135280f99..2c8a9bb8e 100644 --- a/auto/os/linux +++ b/auto/os/linux @@ -181,7 +181,7 @@ ngx_feature_libs= ngx_feature_test="struct __user_cap_data_struct data; struct __user_cap_header_struct header; - header.version = _LINUX_CAPABILITY_VERSION_3; + header.version = _LINUX_CAPABILITY_VERSION_1; data.effective = CAP_TO_MASK(CAP_NET_RAW); data.permitted = 0; -- cgit