1 files changed, 43 insertions, 16 deletions

diff --git a/netinstall.c b/netinstall.c
index 7a63d1866d5b..1d50e4cc24ad 100644
--- a/netinstall.c
+++ b/netinstall.c
@@ -12,7 +12,6 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <sys/capability.h>
-#include <sys/prctl.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
@@ -20,22 +19,45 @@
 #define NETINSTALL_EXE_PATH	"/usr/share/netinstall/netinstall.exe"
 
 int main(int argc, char ** argv) {
-  cap_value_t newcap[1];
-  cap_t caps = cap_get_proc();
-  newcap[0] = CAP_NET_BIND_SERVICE;
-  cap_set_flag(caps, CAP_INHERITABLE, 1, newcap, CAP_SET);
-  cap_set_proc(caps);
-  cap_free(caps);
+  cap_t caps;
+  cap_flag_value_t cap_effective = 0, cap_permitted = 0;
+  const cap_value_t cap = CAP_NET_BIND_SERVICE;
 
-  if (prctl(PR_CAP_AMBIENT, PR_CAP_AMBIENT_RAISE, CAP_NET_BIND_SERVICE, 0, 0)) {
-    perror("prctl: can not set CAP_NET_BIND_SERVICE");
-    return EXIT_FAILURE;
+  if (!CAP_IS_SUPPORTED(cap)) {
+    fprintf(stderr, "Capability CAP_NET_BIND_SERVICE is not supported.\n");
+    goto out10;
+  }
+  if ((caps = cap_get_proc()) == NULL) {
+    perror("cap_get_proc");
+    goto out10;
+  }
+  if (cap_get_flag(caps, cap, CAP_EFFECTIVE, &cap_effective) == -1 ||
+      cap_get_flag(caps, cap, CAP_PERMITTED, &cap_permitted) == -1 ||
+      cap_effective == 0 || cap_permitted == 0) {
+    fprintf(stderr, "Capability CAP_NET_BIND_SERVICE is not available. Set it with setcap(8).\n");
+    goto out20;
+  }
+  if (cap_set_flag(caps, CAP_INHERITABLE, 1, &cap, CAP_SET) == -1) {
+    perror("cap_set_flag: setting CAP_INHERITABLE for CAP_NET_BIND_SERVICE");
+    goto out20;
+  }
+  if (cap_set_proc(caps) == -1) {
+    perror("cap_set_proc");
+    goto out20;
+  }
+  if (cap_free(caps) == -1) {
+    perror("cap_free");
+    goto out10;
   }
-  
+  if (cap_set_ambient(cap, CAP_SET) == -1) {
+    perror("cap_set_ambient: setting CAP_NET_BIND_SERVICE");
+    goto out10;
+  }
+
   struct stat st;
   const char *home = getenv("HOME");
   char wineprefix[256];
-  snprintf(wineprefix, sizeof wineprefix, "%s/.netinstall/wine/", home);
+  snprintf(wineprefix, sizeof(wineprefix), "%s/.netinstall/wine/", home);
 
   setenv("WINEPREFIX", wineprefix, 1);
   setenv("WINEARCH", "win64", 1);
@@ -44,18 +66,18 @@ int main(int argc, char ** argv) {
 
   if (chdir(home) == -1) {
     perror("chdir: changing to home directory");
-    return EXIT_FAILURE;
+    goto out10;
   }
 
   if (stat(".netinstall/", &st) == -1) {
     if (mkdir(".netinstall/", 0777) == -1) {
       perror("mkdir: creating directory '.netinstall/'");
-      return EXIT_FAILURE;
+      goto out10;
     }
-    
+
     if (system("wineboot -u") != 0) {
       perror("system: running wineboot");
-      return EXIT_FAILURE;
+      goto out10;
     }
   }
 
@@ -64,5 +86,10 @@ int main(int argc, char ** argv) {
 
   /* execv() returns only on error */
   perror("execv");
+
+out20:
+  cap_free(caps);
+
+out10:
   return EXIT_FAILURE;
 }