[PATCH] teamd: add CAP_NET_RAW capability for LACP packet sockets

[Pawel Wieczorkiewicz]

The CAP_NET_RAW capability is needed in order to facilitate
socket(PF_PACKET...) calls (see: packet(7)), which are used
within teamd_packet_sock_open() function.
Without the CAP_NET_RAW capability, teamd running as non-root
user is unable to add lacp ports.

Signed-off-by: Pawel Wieczorkiewicz 
---
 teamd/teamd.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/teamd/teamd.c b/teamd/teamd.c
index 391b981..aac2511 100644
--- a/teamd/teamd.c
+++ b/teamd/teamd.c
@@ -1681,7 +1681,7 @@ static void teamd_context_fini(struct teamd_context *ctx)

static int teamd_drop_privileges()
 {
-	cap_value_t cv[] = {CAP_NET_ADMIN, CAP_NET_BIND_SERVICE};
+	cap_value_t cv[] = {CAP_NET_ADMIN, CAP_NET_BIND_SERVICE, CAP_NET_RAW};
    cap_t my_caps;
    struct passwd *pw = NULL;
    struct group *grpent = NULL;
@@ -1731,9 +1731,9 @@ static int teamd_drop_privileges()

if ((my_caps = cap_init()) == NULL)
    	goto error;
-	if (cap_set_flag(my_caps, CAP_EFFECTIVE, 2, cv, CAP_SET) < 0)
+	if (cap_set_flag(my_caps, CAP_EFFECTIVE, ARRAY_SIZE(cv), cv, CAP_SET) < 0)
    	goto error;
-	if (cap_set_flag(my_caps, CAP_PERMITTED, 2, cv, CAP_SET) < 0)
+	if (cap_set_flag(my_caps, CAP_PERMITTED, ARRAY_SIZE(cv), cv, CAP_SET) < 0)
    	goto error;
    if (cap_set_proc(my_caps) < 0)
    	goto error;

[Jiri Pirko]

Tue, Oct 06, 2015 at 03:35:41PM CEST, [e-mail] wrote:
> The CAP_NET_RAW capability is needed in order to facilitate
> socket(PF_PACKET...) calls (see: packet(7)), which are used
> within teamd_packet_sock_open() function.
> Without the CAP_NET_RAW capability, teamd running as non-root
> user is unable to add lacp ports.
>
> Signed-off-by: Pawel Wieczorkiewicz

applied, thanks!