tree f40e9ae17206142321353526f2b84d8579406ba3
parent bdef79a2994d6f0383e07e9597675711662b3031
author Corey Bryant <coreyb@linux.vnet.ibm.com> 1327588946 -0500
committer Anthony Liguori <aliguori@us.ibm.com> 1328135079 -0600

Add cap reduction support to enable use as SUID

The ideal way to use qemu-bridge-helper is to give it an fscap of using:

 setcap cap_net_admin=ep qemu-bridge-helper

Unfortunately, most distros still do not have a mechanism to package files
with fscaps applied.  This means they'll have to SUID the qemu-bridge-helper
binary.

To improve security, use libcap to reduce our capability set to just
cap_net_admin, then reduce privileges down to the calling user.  This is
hopefully close to equivalent to fscap support from a security perspective.

Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>