(is_container: bool)
| 1004 | |
| 1005 | #[context("Querying root privilege")] |
| 1006 | pub(crate) fn require_root(is_container: bool) -> Result<()> { |
| 1007 | ensure!( |
| 1008 | rustix::process::getuid().is_root(), |
| 1009 | if is_container { |
| 1010 | "The user inside the container from which you are running this command must be root" |
| 1011 | } else { |
| 1012 | "This command must be executed as the root user" |
| 1013 | } |
| 1014 | ); |
| 1015 | |
| 1016 | ensure!( |
| 1017 | rustix::thread::capability_is_in_bounding_set(rustix::thread::CapabilitySet::SYS_ADMIN)?, |
| 1018 | if is_container { |
| 1019 | "The container must be executed with full privileges (e.g. --privileged flag)" |
| 1020 | } else { |
| 1021 | "This command requires full root privileges (CAP_SYS_ADMIN)" |
| 1022 | } |
| 1023 | ); |
| 1024 | |
| 1025 | tracing::trace!("Verified uid 0 with CAP_SYS_ADMIN"); |
| 1026 | |
| 1027 | Ok(()) |
| 1028 | } |
| 1029 | |
| 1030 | /// Check if a deployment has soft reboot capability |
| 1031 | fn has_soft_reboot_capability(deployment: Option<&crate::spec::BootEntry>) -> bool { |
no outgoing calls
no test coverage detected