Re: [PATCH iproute2] ip: do not drop capabilities if net_admin=i is set

2018-05-14 Thread Stephen Hemminger
On Fri, 11 May 2018 13:39:56 +0100 Luca Boccassi wrote: > Users have reported a regression due to ip now dropping capabilities > unconditionally. > zerotier-one VPN and VirtualBox use ambient capabilities in their > binary and then fork out to ip to set routes and links, and this > does not work

[PATCH iproute2] ip: do not drop capabilities if net_admin=i is set

2018-05-11 Thread Luca Boccassi
Users have reported a regression due to ip now dropping capabilities unconditionally. zerotier-one VPN and VirtualBox use ambient capabilities in their binary and then fork out to ip to set routes and links, and this does not work anymore. As a workaround, do not drop caps if CAP_NET_ADMIN (the mo