From 8f96d48267e57b9d727ccbf8408bb949e905e83d Mon Sep 17 00:00:00 2001 From: Eric Leblond Date: Thu, 3 Nov 2011 11:19:15 +0100 Subject: [PATCH] capability: rework capability assignement THis patch rework the capability code to use a switch instead of a if. It also "reduces" PF_RING and NFQ capabilities. --- src/util-privs.c | 26 +++++++++++++++++--------- 1 files changed, 17 insertions(+), 9 deletions(-) diff --git a/src/util-privs.c b/src/util-privs.c index 920a6d4..72dae52 100644 --- a/src/util-privs.c +++ b/src/util-privs.c @@ -69,15 +69,23 @@ void SCDropMainThreadCaps(uint32_t userid, uint32_t groupid) capng_clear(CAPNG_SELECT_BOTH); - if (run_mode == RUNMODE_PFRING || run_mode == RUNMODE_NFQ) { - capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, - CAP_NET_RAW, /* needed for pcap live mode */ - CAP_NET_ADMIN, /* needed for nfqueue inline mode */ - -1); - } else if (run_mode == RUNMODE_PCAP_DEV || run_mode == RUNMODE_AFP_DEV) { - capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, - CAP_NET_RAW, /* needed for pcap live mode */ - -1); + switch (run_mode) { + case RUNMODE_PCAP_DEV: + case RUNMODE_AFP_DEV: + capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, + CAP_NET_RAW, /* needed for pcap live mode */ + -1); + break; + case RUNMODE_PFRING: + capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, + CAP_NET_ADMIN, + -1); + break; + case RUNMODE_NFQ: + capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED, + CAP_NET_ADMIN, /* needed for nfqueue inline mode */ + -1); + break; } if (capng_change_id(userid, groupid, CAPNG_DROP_SUPP_GRP | -- 1.7.7.1