Re: [libvirt] [PATCH] util: Call capng_setpid() before using cap-ng

On Fri, Jul 01, 2016 at 04:30:44PM +0200, Andrea Bolognani wrote: > audit is using cap-ng itself since version 2.6.1, and it gets > to initialize the internal state of the cap-ng library before > we call fork(). Because of that, our own use of cap-ng in the > child process ends up attempting to change the capabilities of > the parent process instead of the child process, which fails. > > Calling capng_setpid() before using any other cap-ng API > ensures we're altering the capabilities of the right process. I really don't want to do any hack workaround in libvirt until we've got feedback from the cap-ng maintainers, as I think it is really their bug to fix.