| #!/bin/sh |
| # Copyright (c) 2011 The Chromium OS Authors. All rights reserved. |
| # Use of this source code is governed by a BSD-style license that can be |
| # found in the LICENSE file. |
| # args: -u 1000 -g 1000 -c 2 --ambient |
| # note that 2 = CAP_DAC_OVERRIDE |
| |
| . "$(dirname "$0")"/common.sh |
| |
| needreuid 1000 |
| needregid 1000 |
| |
| # Test we've kept CAP_DAC_OVERRIDE. |
| [ ! -w "$0" ] && die "Can't write to '$0'" |
| |
| # Test we've lost everything else. |
| mismatch="" |
| matched=0 |
| while read line; do |
| if echo "$line" | grep -q '^CapEff:'; then |
| caps=$(echo "$line" | awk '{print $NF}') |
| if echo "$caps" | grep -q '^0000000000000002$'; then |
| matched=1 |
| else |
| mismatch="$caps" |
| fi |
| fi |
| done </proc/self/status |
| [ $matched -eq 1 ] || die "Did not drop non-CAP_DAC_OVERRIDE caps: $mismatch" |
| |
| exit 0 |
