Bug 1046008

Summary:	Some capabilities aren't be defined
Product:	Red Hat Enterprise Linux 7	Reporter:	Alex Jia <ajia>
Component:	libcap	Assignee:	Karsten Hopp <karsten>
Status:	CLOSED DEFERRED	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	7.2	CC:	jstancek
Target Milestone:	rc
Target Release:	---
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-02-01 08:55:41 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Alex Jia 2013-12-23 07:50:57 UTC

Description of problem:
The capabilities '35' and '36' are not be defined

Version-Release number of selected component (if applicable):
# rpm -q libcap libvirt-sandbox libvirt systemd kernel
libcap-2.22-6.el7.x86_64
libvirt-sandbox-0.5.0-7.el7.x86_64
libvirt-1.1.1-16.el7.x86_64
systemd-207-8.el7.x86_64
kernel-3.10.0-0.rc7.64.el7.x86_64


How reproducible:
always

Steps to Reproduce:
1. To create a sandbox container
# virt-sandbox -c lxc:/// -n test_1 -- /bin/sh
sh-4.2# 

2. To open a new terminal and get PID of the process 'libvirt-sandbox-init-common'
# ps -auxf | grep -A 3 -i [L]ibvirt_lxc
root     20372  0.0  0.0 164056  3164 ?        Ssl  15:42   0:00 /usr/libexec/libvirt_lxc --name test_1 --console 23 --console 24 --security=selinux --handshake 27 --background
root     20374  0.0  0.0 164712  4720 pts/0    Ss+  15:42   0:00  \_ /usr/libexec/libvirt-sandbox-init-common
root     20380  0.0  0.0  11772  1376 pts/2    Ss+  15:42   0:00      \_ /bin/sh

3. To check all of caps on process 'libvirt-sandbox-init-common'
# grep CapBnd /proc/20374/status
CapBnd:	0000001db5feffff

# capsh --decode=0000001db5feffff
0x0000001db5feffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_tty_config,cap_lease,cap_audit_write,cap_setfcap,cap_mac_override,cap_syslog,35,36


Actual results:
The capabilities '35' and '36' are not be defined.

Expected results:


Additional info:

Comment 2 RHEL Program Management 2014-03-22 06:20:38 UTC

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 3 Jan Stancek 2014-09-10 08:27:17 UTC

LTP testcase "check_keepcaps" is hitting it too:
http://article.gmane.org/gmane.linux.ltp/21530

Comment 5 Karsten Hopp 2016-02-01 08:55:41 UTC

It looks like they are defined, only the translation into text doesn't work. So this can be fixed when an erratum for a real bug is needed