Bug 2184965

Description of problem:

dhcrelay always outputs an failure into journal log and /var/log/messages.

  dhcrelay[XXX]: libcap-ng used by "/usr/sbin/dhcrelay" failed dropping bounding set due to not having CAP_SETPCAP in capng_apply


dhcrelay's main() function has the following two places for capability operation.


 676 #ifdef HAVE_LIBCAP_NG
 677         /* Drop capabilities */
 678         if (!keep_capabilities) {
 679                 capng_clear(CAPNG_SELECT_BOTH);
 680                 capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
 681                                 CAP_NET_RAW, CAP_NET_BIND_SERVICE, -1);
 682                 capng_apply(CAPNG_SELECT_BOTH);
 683                 log_info ("Dropped all unnecessary capabilities.");
 684         }
 685 #endif


 843 #ifdef HAVE_LIBCAP_NG
 844         /* Drop all capabilities */
 845         if (!keep_capabilities) {
 846                 capng_clear(CAPNG_SELECT_BOTH);
 847                 capng_apply(CAPNG_SELECT_BOTH);
 848                 log_info ("Dropped all capabilities.");
 849         }       
 850 #endif  


It tries twice to drop all capabilities from bounding set, since the CAPNG_SELECT_BOTH is used in both places.
But, the second one never happens because CAP_SETPCAP has already been dropped from effective set in the first place.
The following is the capng_apply() definition in libcap-ng, and it checks CAP_SETPCAP in the effective set and output the failure message. In shorts, the failure message is always output in the second place, since it tries to drop all capabilities without CAP_SETPCAP.

int capng_apply(capng_select_t set)
{
        ... snip ...
        if (set & CAPNG_SELECT_BOUNDS) {
#ifdef PR_CAPBSET_DROP
                struct cap_ng state;
                memcpy(&state, &m, sizeof(state)); /* save state */
                capng_get_caps_process();
                if (capng_have_capability(CAPNG_EFFECTIVE, CAP_SETPCAP)) {  <<== 
                        ... snip ...
                } else {
                        memcpy(&m, &state, sizeof(m)); /* restore state */
//                      rc = -4;
                        log_problem(4);
                        goto try_caps;
                }


There are two ways to fix it, at least.
The first one is to keep CAP_SETPCAP in the first location.

 680                 capng_updatev(CAPNG_ADD, CAPNG_EFFECTIVE|CAPNG_PERMITTED,
 681                                 CAP_NET_RAW, CAP_NET_BIND_SERVICE, CAP_SETPCAP -1);


The second one is not to try dropping all capabilities from bounding set in the second place.

 846                 capng_clear(CAPNG_SELECT_CAPS);
 847                 capng_apply(CAPNG_SELECT_CAPS);


Version-Release number of selected component (if applicable):
RHEL9.1



How reproducible:
Always

Steps to Reproduce:
1. attach two network interfaces, at least
2. install dhcp-relay package into rhel9.1
3. configure /etc/systemd/system/dhcrelay.service by following:
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/networking_guide/dhcp-relay-agent

 NOTE: This is RHEL7 doc, but it still works for RHEL9.

4. start dhcrelay service and check journal log.

  # systemctl start dhcrelay
  # journalctl -e

optionally, check that the capabilities of the dhcrelay process is 0.

  # cat /etc/<PID>/status

  CapInh:	0000000000000000
  CapPrm:	0000000000000000
  CapEff:	0000000000000000
  CapBnd:	0000000000000000
  CapAmb:	0000000000000000


Actual results:

This failure message is output.
dhcrelay[XXX]: libcap-ng used by "/usr/sbin/dhcrelay" failed dropping bounding set due to not having CAP_SETPCAP in capng_apply


Expected results:

The failure message is not output.

Additional info: