From 646e709fb1f794a8bd5837aaeb69ce41cd18f0ca Mon Sep 17 00:00:00 2001
From: DL6ER <dl6er@dl6er.de>
Date: Sun, 2 Jan 2022 14:52:17 +0100
Subject: [PATCH] Do not warn about missing capabilities during startup. The
 embedded dnsmasq does the same but config-aware, i.e. it will not complain
 about missing CAP_NET_ADMIN when DHCP is not used. As its warnings are now
 much more present in all logs, we don't need to do the check twice. The
 existing checks remain there but are only used in debug mode (DEBUG_CAPS).

Signed-off-by: DL6ER <dl6er@dl6er.de>
---
 src/capabilities.c | 27 ++++++++++++---------------
 src/main.c         |  6 +++---
 2 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/src/capabilities.c b/src/capabilities.c
index fbaccbfe..90ab5894 100644
--- a/src/capabilities.c
+++ b/src/capabilities.c
@@ -52,21 +52,18 @@ bool check_capabilities(void)
 	data = calloc(sizeof(*data), capsize);
 	capget(hdr, data);
 
-	if(config.debug & DEBUG_CAPS)
+	logg("***************************************");
+	logg("* Linux capability debugging enabled  *");
+	for(unsigned int i = 0u; i < numCaps; i++)
 	{
-		logg("***************************************");
-		logg("* Linux capability debugging enabled  *");
-		for(unsigned int i = 0u; i < numCaps; i++)
-		{
-			const unsigned int capid = capabilityIDs[i];
-			logg("* %-24s (%02u) = %s%s%s *",
-			     capabilityNames[capid], capid,
-			     ((data->permitted   & (1 << capid)) ? "P":"-"),
-			     ((data->inheritable & (1 << capid)) ? "I":"-"),
-			     ((data->effective   & (1 << capid)) ? "E":"-"));
-		}
-		logg("***************************************");
+		const unsigned int capid = capabilityIDs[i];
+		logg("* %-24s (%02u) = %s%s%s *",
+			capabilityNames[capid], capid,
+			((data->permitted   & (1 << capid)) ? "P":"-"),
+			((data->inheritable & (1 << capid)) ? "I":"-"),
+			((data->effective   & (1 << capid)) ? "E":"-"));
 	}
+	logg("***************************************");
 
 	bool capabilities_okay = true;
 	if (!(data->permitted & (1 << CAP_NET_ADMIN)) ||
@@ -93,7 +90,7 @@ bool check_capabilities(void)
 	if (!(data->permitted & (1 << CAP_SYS_NICE)) ||
 	    !(data->effective & (1 << CAP_SYS_NICE)))
 	{
-		// Necessary for dynamic port binding
+		// Necessary for setting higher process priority through nice
 		logg("WARNING: Required Linux capability CAP_SYS_NICE not available");
 		capabilities_okay = false;
 	}
@@ -107,7 +104,7 @@ bool check_capabilities(void)
 	if (!(data->permitted & (1 << CAP_CHOWN)) ||
 	    !(data->effective & (1 << CAP_CHOWN)))
 	{
-		// Necessary for chown() to work correctly
+		// Necessary to chown required files that are owned by another user
 		logg("WARNING: Required Linux capability CAP_CHOWN not available");
 		capabilities_okay = false;
 	}
diff --git a/src/main.c b/src/main.c
index 748d70eb..0253a56b 100644
--- a/src/main.c
+++ b/src/main.c
@@ -98,9 +98,9 @@ int main (int argc, char* argv[])
 	log_counter_info();
 	check_setupVarsconf();
 
-	// Check for availability of advanced capabilities
-	// immediately before starting the resolver.
-	check_capabilities();
+	// Check for availability of capabilities in debug mode
+	if(config.debug & DEBUG_CAPS)
+		check_capabilities();
 
 	// Start the resolver
 	startup = false;