From 1e9f0d76fb2a984c53adc4ddb7b481ae8f3f9b90 Mon Sep 17 00:00:00 2001 From: Michael Vogt Date: Thu, 26 Mar 2026 13:25:02 +0100 Subject: [PATCH] core: drop incorrect comment about SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT) The comment about `SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT)` is incorrect. To quote @YHNdnzj: ``` nah, the capability-based permission model is a legacy from kdbus. We cannot do it race-freely without it. Please simply drop the comment. ``` Thanks to @YHNdnzj for suggesting this. --- src/core/varlink-manager.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/src/core/varlink-manager.c b/src/core/varlink-manager.c index 5528c2f8ef..8082b000aa 100644 --- a/src/core/varlink-manager.c +++ b/src/core/varlink-manager.c @@ -431,9 +431,6 @@ static int manager_do_set_objective(sd_varlink *link, sd_json_variant *parameter if (r < 0) return r; - /* dbus uses SD_BUS_VTABLE_CAPABILITY(CAP_SYS_BOOT) in its checking. We cannot do the same - * because reading capabilities from /proc is racy (TOCTOU). So we use the stricter check - * TODO: figure out a way to check for CAP_SYS_BOOT */ r = varlink_check_privileged_peer(link); if (r < 0) return r;