Explicitly set permissions to minimum required for mctpd

Signed-off-by: James Lee <james@codeconstruct.com.au>

Author: SafetyInObscurity

src/mctpd.c

@@ -6,8 +6,6 @@
  * Copyright (c) 2021 Google
  */
 
-#include "linux/capability.h"
-#include <stddef.h>
 #define _GNU_SOURCE
 #include "config.h"
 
@@ -1444,14 +1442,10 @@ static int cb_listen_control_msg(sd_event_source *s, int sd, uint32_t revents,
 
 static int listen_control_msg(struct ctx *ctx, uint32_t net)
 {
-	cap_flag_t dropped_sets[] = { CAP_EFFECTIVE, CAP_INHERITABLE,
-				      CAP_PERMITTED };
-	cap_value_t dropped_capability[] = { CAP_NET_BIND_SERVICE };
 	struct sockaddr_mctp addr = { 0 };
 	int rc, sd = -1, val;
 	char *failed;
 	cap_t cap;
-	size_t i;
 
 	sd = mctp_ops.mctp.socket();
 	if (sd < 0) {
@@ -1471,21 +1465,12 @@ static int listen_control_msg(struct ctx *ctx, uint32_t net)
 		goto warn_out;
 	}
 
-	cap = cap_get_proc();
+	cap = cap_from_text("CAP_NET_ADMIN=pe");
 	if (!cap) {
-		failed = "cap_get_proc()";
+		failed = "cap_from_text()";
 		goto warn_out;
 	}
 
-	for (i = 0; i < ARRAY_SIZE(dropped_sets); i++) {
-		rc = cap_set_flag(cap, dropped_sets[i], 1, dropped_capability,
-				  CAP_CLEAR);
-		if (rc < 0) {
-			failed = "cap_clear_flag()";
-			goto cap_out;
-		}
-	}
-
 	rc = cap_set_proc(cap);
 	if (rc < 0) {
 		failed = "cap_set_proc()";
@@ -6389,6 +6374,7 @@ static int endpoint_allocate_eids(struct peer *peer)
 int main(int argc, char **argv)
 {
 	struct ctx ctxi = { 0 }, *ctx = &ctxi;
+	cap_t cap;
 	int rc;
 
 	setlinebuf(stdout);
@@ -6408,6 +6394,26 @@ int main(int argc, char **argv)
 		err(EXIT_FAILURE, "Can't read configuration");
 	}
 
+	cap = cap_from_text("CAP_NET_BIND_SERVICE=pe CAP_NET_ADMIN=p");
+	if (!cap) {
+		warnx("Failed allocating capability state, %s %d",
+		      strerror(errno), -errno);
+		return 1;
+	}
+
+	rc = cap_set_proc(cap);
+	if (rc < 0) {
+		warnx("Could not set capabilites %s %d", strerror(errno),
+		      -errno);
+		return 1;
+	}
+
+	rc = cap_free(cap);
+	if (rc < 0) {
+		warnx("Failed freeing capability state");
+		return 1;
+	}
+
 	ctx->nl = mctp_nl_new(false);
 	if (!ctx->nl) {
 		warnx("Failed creating netlink object");