Torsten Hilbrich 7be830c6e8 nspawn: Allow Capability= to overrule private network setting ...

The commit:

a3fc6b55ac nspawn: mask out CAP_NET_ADMIN again if settings file turns off private networking

turned off the CAP_NET_ADMIN capability whenever no private networking
feature was enabled. This broke configurations where the CAP_NET_ADMIN
capability was explicitly requested in the configuration.

Changing the order of evalution here to allow the Capability= setting
to overrule this implicit setting:

Order of evaluation:

1. if no private network setting is enabled, CAP_NET_ADMIN is removed
2. if a private network setting is enabled, CAP_NET_ADMIN is added
3. the settings of Capability= are added
4. the settings of DropCapability= are removed

This allows the fix for #11755 to be retained and to still allow the
admin to specify CAP_NET_ADMIN as additional capability.

Fixes: a3fc6b55ac
Fixes: #13995

2019-11-15 10:13:51 +01:00

..

ac-power

…

activate

tree-wide: drop socket.h when socket-util.h is included

2019-11-04 00:30:32 +09:00

analyze

verify: fix segmentation fault

2019-11-13 22:20:01 +01:00

ask-password

…

backlight

util-lib: move shall_restore_state() to shared/reboot-util

2019-09-16 18:08:01 +02:00

basic

seccomp: more comprehensive protection against libseccomp's __NR_xyz namespace invasion

2019-11-15 08:13:36 +01:00

binfmt

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

boot

boot: Add ARM64 support to the EFI stub

2019-11-14 10:03:08 +01:00

busctl

tree-wide: drop double newline

2019-11-04 00:30:32 +09:00

cgls

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

cgroups-agent

tree-wide: drop socket.h when socket-util.h is included

2019-11-04 00:30:32 +09:00

cgtop

tree-wide: drop alloca.h when alloc-util.h is included

2019-11-04 00:30:32 +09:00

core

bpf: make sure the kernel do not submit an invalid program if no pattern matched

2019-11-11 15:14:09 +01:00

coredump

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

cryptsetup

Allow overriding /etc/fstab with $SYSTEMD_FSTAB

2019-11-13 22:04:51 +01:00

debug-generator

util-lib: move runlevel_to_target() to shared/unit-file

2019-09-16 18:08:00 +02:00

delta

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

detect-virt

…

dissect

…

environment-d-generator

environment-d-generator: output logs in debug mode

2019-08-30 13:17:37 +02:00

escape

…

firstboot

firstboot: drop duplicate trailing whitespace from root pw question

2019-08-11 06:13:57 +09:00

fsck

tree-wide: drop stdio.h when stdio-util.h is included

2019-11-04 00:30:32 +09:00

fstab-generator

Allow overriding /etc/fstab with $SYSTEMD_FSTAB

2019-11-13 22:04:51 +01:00

fuzz

tree-wide: drop missing.h

2019-10-31 17:57:03 +09:00

getty-generator

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

gpt-auto-generator

tree-wide: drop stat.h or statfs.h when stat-util.h is included

2019-11-04 00:30:32 +09:00

hibernate-resume

…

hostname

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

hwdb

…

id128

id128: actually support --pretty

2019-08-20 12:01:23 +02:00

import

include missing_fcntl.h where needed

2019-11-07 10:17:44 +00:00

initctl

…

journal

journal-file: delete some unnecessary braces

2019-11-10 12:39:44 +01:00

journal-remote

tree-wide: drop stdio.h when stdio-util.h is included

2019-11-04 00:30:32 +09:00

kernel-install

kernel-install: do not require non-empty kernel cmdline

2019-08-27 18:30:49 +02:00

libsystemd

sd-device-enumerator: do not return error when a device is removed

2019-11-05 22:13:11 +01:00

libsystemd-network

sd-radv: fix memleak

2019-11-05 13:30:00 +09:00

libudev

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

locale

tree-wide: drop locale.h when locale-util.h is included

2019-11-04 00:30:32 +09:00

login

logind: fix (again) the race that might happen when logind restores VT

2019-11-12 14:53:24 +01:00

machine

tree-wide: drop locale.h when locale-util.h is included

2019-11-04 00:30:32 +09:00

machine-id-setup

machine-id-setup: avoid unexpected aborting

2019-10-25 13:35:37 +09:00

modules-load

tree-wide: drop libkmod.h when module-util.h is included

2019-11-04 00:30:32 +09:00

mount

basic/fs-util: change CHASE_OPEN flag into a separate output parameter

2019-10-24 22:44:24 +09:00

network

network: split struct Prefix into Prefix and RoutePrefix

2019-11-05 22:31:20 +09:00

notify

…

nspawn

nspawn: Allow Capability= to overrule private network setting

2019-11-15 10:13:51 +01:00

nss-myhostname

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

nss-mymachines

…

nss-resolve

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

nss-systemd

…

partition

tree-wide: drop signal.h when signal-util.h is included

2019-11-04 00:30:32 +09:00

path

…

portable

basic/fs-util: change CHASE_OPEN flag into a separate output parameter

2019-10-24 22:44:24 +09:00

pstore

tree-wide: drop missing.h

2019-10-31 17:57:03 +09:00

quotacheck

…

random-seed

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

rc-local-generator

…

remount-fs

Allow overriding /etc/fstab with $SYSTEMD_FSTAB

2019-11-13 22:04:51 +01:00

reply-password

tree-wide: drop socket.h when socket-util.h is included

2019-11-04 00:30:32 +09:00

resolve

tree-wide: drop gcrypt.h when gcrypt-util.h is included

2019-11-04 00:30:32 +09:00

rfkill

util-lib: move shall_restore_state() to shared/reboot-util

2019-09-16 18:08:01 +02:00

run

run: propagate return code/status from the child

2019-11-05 21:38:21 +01:00

run-generator

…

shared

core: do not propagate polkit error to caller

2019-11-15 08:17:01 +01:00

shutdown

tree-wide: drop signal.h when signal-util.h is included

2019-11-04 00:30:32 +09:00

sleep

tree-wide: drop stdio.h when stdio-util.h is included

2019-11-04 00:30:32 +09:00

socket-proxy

tree-wide: drop socket.h when socket-util.h is included

2019-11-04 00:30:32 +09:00

stdio-bridge

…

sulogin-shell

…

sysctl

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

system-update-generator

util-lib: move runlevel_to_target() to shared/unit-file

2019-09-16 18:08:00 +02:00

systemctl

Merge pull request #13554 from keur/systemctl_status_timer

2019-11-08 14:19:40 +01:00

systemd

networkd: dhcp server Support Vendor specific 43

2019-10-31 09:03:43 +09:00

sysusers

Revert "sysusers: properly mark generated accounts as locked"

2019-10-22 17:59:11 +09:00

sysv-generator

…

test

seccomp: more comprehensive protection against libseccomp's __NR_xyz namespace invasion

2019-11-15 08:13:36 +01:00

time-wait-sync

tree-wide: drop signal.h when signal-util.h is included

2019-11-04 00:30:32 +09:00

timedate

Merge pull request #14010 from poettering/localtime-symlink

2019-11-13 16:38:41 +01:00

timesync

tree-wide: drop socket.h when socket-util.h is included

2019-11-04 00:30:32 +09:00

tmpfiles

Merge pull request #13862 from zachsmith/systemd-tmpfiles-deprecate-for-force

2019-11-12 10:28:59 +01:00

tty-ask-password-agent

tree-wide: drop signal.h when signal-util.h is included

2019-11-04 00:30:32 +09:00

udev

Merge pull request #13961 from mwilck/udev-no-exit-timeout

2019-11-13 08:56:49 +01:00

update-done

…

update-utmp

tree-wide: drop string.h when string-util.h or friends are included

2019-11-04 00:30:32 +09:00

user-sessions

…

vconsole

tree-wide: drop stdio.h when stdio-util.h is included

2019-11-04 00:30:32 +09:00

veritysetup

…

version

…

volatile-root

basic/fs-util: change CHASE_OPEN flag into a separate output parameter

2019-10-24 22:44:24 +09:00