}
if ((arg_settings_mask & SETTING_CAPABILITY) == 0) {
- uint64_t plus;
+ uint64_t plus, minus;
/* Note that we copy both the simple plus/minus caps here, and the full quintet from the
* Settings structure */
plus = settings->capability;
- if (settings_private_network(settings))
- plus |= UINT64_C(1) << CAP_NET_ADMIN;
+ minus = settings->drop_capability;
+
+ if ((arg_settings_mask & SETTING_NETWORK) == 0) {
+ if (settings_private_network(settings))
+ plus |= UINT64_C(1) << CAP_NET_ADMIN;
+ else
+ minus |= UINT64_C(1) << CAP_NET_ADMIN;
+ }
if (!arg_settings_trusted && plus != 0) {
if (settings->capability != 0)
} else
arg_caps_retain |= plus;
- arg_caps_retain &= ~settings->drop_capability;
+ arg_caps_retain &= ~minus;
/* Copy the full capabilities over too */
if (capability_quintet_is_set(&settings->full_capabilities)) {