diff --git a/lib/fluent/command/cap_ctl.rb b/lib/fluent/command/cap_ctl.rb index 6d80f9f4f8..5407d8b17f 100644 --- a/lib/fluent/command/cap_ctl.rb +++ b/lib/fluent/command/cap_ctl.rb @@ -93,6 +93,15 @@ def call end end + def get_valid_capabilities + capabilities = [] + cap = CapNG::Capability.new + cap.each do |_code, capability| + capabilities << capability + end + capabilities + end + def clear_capabilities(opts, target_file) if !!opts[:clear_capabilities] @capng.clear(:caps) @@ -101,11 +110,20 @@ def clear_capabilities(opts, target_file) end end + def check_capabilities(capabilities, valid_capabilities) + capabilities.each do |capability| + unless valid_capabilities.include?(capability) + raise ArgumentError, "'#{capability}' is not valid capability. Valid Capabilities are: #{valid_capabilities.join(", ")}" + end + end + end + def add_capabilities(opts, target_file) if add_caps = opts[:add_capabilities] @capng.clear(:caps) @capng.caps_file(target_file) capabilities = add_caps.split(/\s*,\s*/) + check_capabilities(capabilities, get_valid_capabilities) ret = @capng.update(:add, CapNG::Type::EFFECTIVE | CapNG::Type::INHERITABLE | CapNG::Type::PERMITTED, capabilities) @@ -120,6 +138,7 @@ def drop_capabilities(opts, target_file) @capng.clear(:caps) @capng.caps_file(target_file) capabilities = drop_caps.split(/\s*,\s*/) + check_capabilities(capabilities, get_valid_capabilities) ret = @capng.update(:drop, CapNG::Type::EFFECTIVE | CapNG::Type::INHERITABLE | CapNG::Type::PERMITTED, capabilities) diff --git a/test/command/test_cap_ctl.rb b/test/command/test_cap_ctl.rb index dc11236b3d..067880b468 100644 --- a/test/command/test_cap_ctl.rb +++ b/test/command/test_cap_ctl.rb @@ -86,13 +86,13 @@ class TestFluentCapCtl < Test::Unit::TestCase sub_test_case "invalid" do test "add capability" do - assert_raise(RuntimeError) do + assert_raise(ArgumentError) do Fluent::CapCtl.new(["--add-cap", "nonexitent"]).call end end test "drop capability" do - assert_raise(RuntimeError) do + assert_raise(ArgumentError) do Fluent::CapCtl.new(["--drop-cap", "invalid"]).call end end