---
 src/lxc/cgroup.c      |   16 ++++++++--------
 src/lxc/conf.c        |   40 +++++++++++++++++++++++++---------------
 src/lxc/lxc_execute.c |    3 +++
 src/lxc/lxc_start.c   |    3 +++
 src/lxc/namespace.c   |    8 +++++---
 src/lxc/network.c     |   27 +++++++++++++++------------
 src/lxc/start.c       |    3 ++-
 7 files changed, 61 insertions(+), 39 deletions(-)

Index: lxc/src/lxc/cgroup.c
===================================================================
--- lxc.orig/src/lxc/cgroup.c
+++ lxc/src/lxc/cgroup.c
@@ -38,10 +38,10 @@
 
 #include "error.h"
 #include "config.h"
-
-#include <lxc/log.h>
-#include <lxc/cgroup.h>
-#include <lxc/start.h>
+#include "caps.h"
+#include "log.h"
+#include "cgroup.h"
+#include "start.h"
 
 lxc_log_define(lxc_cgroup, lxc);
 
@@ -103,7 +103,7 @@ int lxc_rename_nsgroup(const char *name,
 	/* there is a previous cgroup, assume it is empty, otherwise
 	 * that fails */
 	if (!access(newname, F_OK)) {
-		ret = rmdir(newname);
+		ret = lxc_privilegied(rmdir(newname));
 		if (ret) {
 			SYSERROR("failed to remove previous cgroup '%s'",
 				 newname);
@@ -111,7 +111,7 @@ int lxc_rename_nsgroup(const char *name,
 		}
 	}
 
-	ret = rename(oldname, newname);
+	ret = lxc_privilegied(rename(oldname, newname));
 	if (ret)
 		SYSERROR("failed to rename cgroup %s->%s", oldname, newname);
 	else
@@ -133,7 +133,7 @@ int lxc_unlink_nsgroup(const char *name)
 	}
 
 	snprintf(nsgroup, MAXPATHLEN, "%s/%s", cgroup, name);
-	ret = rmdir(nsgroup);
+	ret = lxc_privilegied(rmdir(nsgroup));
 	if (ret)
 		SYSERROR("failed to remove cgroup '%s'", nsgroup);
 	else
@@ -181,7 +181,7 @@ int lxc_cgroup_set(const char *name, con
 		return -1;
 	}
 
-	ret = write(fd, value, strlen(value));
+	ret = lxc_privilegied(write(fd, value, strlen(value)));
 	if (ret < 0) {
 		ERROR("write %s : %s", path, strerror(errno));
 		goto out;
Index: lxc/src/lxc/lxc_execute.c
===================================================================
--- lxc.orig/src/lxc/lxc_execute.c
+++ lxc/src/lxc/lxc_execute.c
@@ -92,6 +92,9 @@ int main(int argc, char *argv[])
 	char *rcfile;
 	struct lxc_conf *conf;
 
+	if (lxc_caps_init())
+		return -1;
+
 	lxc_list_init(&defines);
 
 	if (lxc_arguments_parse(&my_args, argc, argv))
Index: lxc/src/lxc/namespace.c
===================================================================
--- lxc.orig/src/lxc/namespace.c
+++ lxc/src/lxc/namespace.c
@@ -32,6 +32,7 @@
 #include <fcntl.h>
 
 #include "namespace.h"
+#include "caps.h"
 #include "log.h"
 
 #ifndef __NR_setns
@@ -83,10 +84,11 @@ pid_t lxc_clone(int (*fn)(void *), void 
 	pid_t ret;
 
 #ifdef __ia64__
-	ret = __clone2(do_clone, stack,
-		       stack_size, flags | SIGCHLD, &clone_arg);
+	ret = lxc_privilegied(__clone2(do_clone, stack, stack_size,
+				       flags | SIGCHLD, &clone_arg));
 #else
-	ret = clone(do_clone, stack, flags | SIGCHLD, &clone_arg);
+	ret = lxc_privilegied(clone(do_clone, stack,
+				    flags | SIGCHLD, &clone_arg));
 #endif
 	if (ret < 0)
 		ERROR("failed to clone(0x%x): %s", flags, strerror(errno));
Index: lxc/src/lxc/start.c
===================================================================
--- lxc.orig/src/lxc/start.c
+++ lxc/src/lxc/start.c
@@ -113,6 +113,7 @@ int signalfd(int fd, const sigset_t *mas
 #endif
 
 #include "start.h"
+#include "caps.h"
 #include "conf.h"
 #include "cgroup.h"
 #include "log.h"
@@ -436,7 +437,7 @@ static int do_start(void *data)
 		goto out_warn_father;
 	}
 
-	if (prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0)) {
+	if (lxc_privilegied(prctl(PR_CAPBSET_DROP, CAP_SYS_BOOT, 0, 0, 0))) {
 		SYSERROR("failed to remove CAP_SYS_BOOT capability");
 		return -1;
 	}
Index: lxc/src/lxc/conf.c
===================================================================
--- lxc.orig/src/lxc/conf.c
+++ lxc/src/lxc/conf.c
@@ -48,6 +48,7 @@
 #include <libgen.h>
 
 #include "network.h"
+#include "caps.h"
 #include "error.h"
 #include "parse.h"
 #include "config.h"
@@ -201,11 +202,12 @@ static int configure_find_fstype_cb(char
 	fstype += lxc_char_left_gc(fstype, strlen(fstype));
 	fstype[lxc_char_right_gc(fstype, strlen(fstype))] = '\0';
 
-	if (mount(cbarg->rootfs, cbarg->testdir, fstype, cbarg->mntopt, NULL))
+	if (lxc_privilegied(mount(cbarg->rootfs, cbarg->testdir,
+				  fstype, cbarg->mntopt, NULL)))
 		return 0;
 
 	/* found ! */
-	umount(cbarg->testdir);
+	lxc_privilegied(umount(cbarg->testdir));
 	strcpy(cbarg->fstype, fstype);
 
 	return 1;
@@ -396,7 +398,8 @@ static int setup_tty(const struct lxc_ro
 		 * to check the file is present or not because it fails
 		 * with EACCES errno and I don't know why :( */
 
-		if (mount(pty_info->name, path, "none", MS_BIND, 0)) {
+		if (lxc_privilegied(mount(pty_info->name, path, "none",
+					  MS_BIND, 0))) {
 			WARN("failed to mount '%s'->'%s'",
 			     pty_info->name, path);
 			continue;
@@ -501,7 +504,7 @@ static int umount_oldrootfs(const char *
 		lxc_list_for_each(iterator, &mountlist) {
 
 			/* umount normally */
-			if (!umount(iterator->elem)) {
+			if (!lxc_privilegied(umount(iterator->elem))) {
 				DEBUG("umounted '%s'", (char *)iterator->elem);
 				lxc_list_del(iterator);
 				continue;
@@ -564,7 +567,7 @@ static int setup_rootfs_pivot_root(const
 	DEBUG("mountpoint for old rootfs is '%s'", path);
 
 	/* pivot_root into our new root fs */
-	if (pivot_root(".", path)) {
+	if (lxc_privilegied(pivot_root(".", path))) {
 		SYSERROR("pivot_root syscall failed");
 		return -1;
 	}
@@ -606,7 +609,8 @@ static int setup_rootfs(const struct lxc
 		return -1;
 	}
 
-	if (mount(rootfs->path, mpath, "none", MS_BIND|MS_REC, NULL)) {
+	if (lxc_privilegied(mount(rootfs->path, mpath, "none",
+				  MS_BIND|MS_REC, NULL))) {
 		SYSERROR("failed to mount '%s'->'%s'", rootfs->path, mpath);
 		return -1;
 	}
@@ -626,12 +630,14 @@ static int setup_pts(int pts)
 	if (!pts)
 		return 0;
 
-	if (!access("/dev/pts/ptmx", F_OK) && umount("/dev/pts")) {
+	if (!access("/dev/pts/ptmx", F_OK) &&
+	    lxc_privilegied(umount("/dev/pts"))) {
 		SYSERROR("failed to umount 'dev/pts'");
 		return -1;
 	}
 
-	if (mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL, "newinstance,ptmxmode=0666")) {
+	if (lxc_privilegied(mount("devpts", "/dev/pts", "devpts", MS_MGC_VAL,
+				  "newinstance,ptmxmode=0666"))) {
 		SYSERROR("failed to mount a new instance of '/dev/pts'");
 		return -1;
 	}
@@ -644,7 +650,8 @@ static int setup_pts(int pts)
 	}
 
 	/* fallback here, /dev/pts/ptmx exists just mount bind */
-	if (mount("/dev/pts/ptmx", "/dev/ptmx", "none", MS_BIND, 0)) {
+	if (lxc_privilegied(mount("/dev/pts/ptmx",
+				  "/dev/ptmx", "none", MS_BIND, 0))) {
 		SYSERROR("mount failed '/dev/pts/ptmx'->'/dev/ptmx'");
 		return -1;
 	}
@@ -688,7 +695,7 @@ static int setup_console(const struct lx
 		return -1;
 	}
 
-	if (mount(console->name, path, "none", MS_BIND, 0)) {
+	if (lxc_privilegied(mount(console->name, path, "none", MS_BIND, 0))) {
 		ERROR("failed to mount '%s' on '%s'", console->name, path);
 		return -1;
 	}
@@ -798,8 +805,9 @@ static int mount_file_entries(FILE *file
 			goto out;
 		}
 
-		if (mount(mntent->mnt_fsname, mntent->mnt_dir,
-			  mntent->mnt_type, mntflags & ~MS_REMOUNT, mntdata)) {
+		if (lxc_privilegied(mount(mntent->mnt_fsname, mntent->mnt_dir,
+					  mntent->mnt_type,
+					  mntflags & ~MS_REMOUNT, mntdata))) {
 			SYSERROR("failed to mount '%s' on '%s'",
 					 mntent->mnt_fsname, mntent->mnt_dir);
 			goto out;
@@ -812,9 +820,11 @@ static int mount_file_entries(FILE *file
 			       "or remount options",
 			       mntent->mnt_fsname, mntent->mnt_dir);
 
-			if (mount(mntent->mnt_fsname, mntent->mnt_dir,
-				  mntent->mnt_type,
-				  mntflags | MS_REMOUNT, mntdata)) {
+			if (lxc_privilegied(mount(mntent->mnt_fsname,
+						  mntent->mnt_dir,
+						  mntent->mnt_type,
+						  mntflags | MS_REMOUNT,
+						  mntdata))) {
 				SYSERROR("failed to mount '%s' on '%s'",
 					 mntent->mnt_fsname, mntent->mnt_dir);
 				goto out;
Index: lxc/src/lxc/lxc_start.c
===================================================================
--- lxc.orig/src/lxc/lxc_start.c
+++ lxc/src/lxc/lxc_start.c
@@ -99,6 +99,9 @@ int main(int argc, char *argv[])
 		'\0',
 	};
 
+	if (lxc_caps_init())
+		return -1;
+
 	lxc_list_init(&defines);
 
 	if (lxc_arguments_parse(&my_args, argc, argv))
Index: lxc/src/lxc/network.c
===================================================================
--- lxc.orig/src/lxc/network.c
+++ lxc/src/lxc/network.c
@@ -47,6 +47,8 @@
 #include <nl.h>
 #include <network.h>
 
+#include "caps.h"
+
 #ifndef IFLA_LINKMODE
 #  define IFLA_LINKMODE 17
 #endif
@@ -115,7 +117,7 @@ int lxc_device_move(int ifindex, pid_t p
 	if (nla_put_u32(nlmsg, IFLA_NET_NS_PID, pid))
 		goto out;
 
-	err = netlink_transaction(&nlh, nlmsg, nlmsg);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, nlmsg));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(nlmsg);
@@ -162,7 +164,7 @@ int lxc_device_delete(const char *name)
 	if (nla_put_string(nlmsg, IFLA_IFNAME, name))
 		goto out;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(answer);
@@ -197,7 +199,7 @@ int lxc_device_delete_index(int ifindex)
 	nlmsg->nlmsghdr.nlmsg_flags = NLM_F_ACK|NLM_F_REQUEST;
 	nlmsg->nlmsghdr.nlmsg_type = RTM_DELLINK;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(answer);
@@ -244,7 +246,7 @@ static int device_set_flag(const char *n
 	nlmsg->nlmsghdr.nlmsg_flags = NLM_F_REQUEST|NLM_F_ACK;
 	nlmsg->nlmsghdr.nlmsg_type = RTM_NEWLINK;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(nlmsg);
@@ -292,7 +294,7 @@ int lxc_device_set_mtu(const char *name,
 	if (nla_put_u32(nlmsg, IFLA_MTU, mtu))
 		goto out;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(nlmsg);
@@ -354,7 +356,7 @@ int lxc_device_rename(const char *oldnam
 	if (nla_put_string(nlmsg, IFLA_IFNAME, newname))
 		goto out;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(answer);
@@ -429,7 +431,7 @@ int lxc_veth_create(const char *name1, c
 	if (nla_put_string(nlmsg, IFLA_IFNAME, name1))
 		goto out;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(answer);
@@ -582,7 +584,7 @@ int lxc_macvlan_create(const char *maste
 	if (nla_put_string(nlmsg, IFLA_IFNAME, name))
 		goto out;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(answer);
@@ -594,11 +596,12 @@ static int proc_sys_net_write(const char
 {
 	int fd, err = 0;
 
-	fd = open(path, O_WRONLY);
+	fd = lxc_privilegied(open(path, O_WRONLY));
 	if (fd < 0)
 		return -errno;
 
-	if (write(fd, value, strlen(value)) < 0)
+	err = write(fd, value, strlen(value));
+	if (err < 0)
 		err = -errno;
 
 	close(fd);
@@ -752,7 +755,7 @@ static int ip_addr_add(int family, int i
 	     memcmp(acast, &in6addr_any, sizeof(in6addr_any))))
 		goto out;
 
-	err = netlink_transaction(&nlh, nlmsg, answer);
+	err = lxc_privilegied(netlink_transaction(&nlh, nlmsg, answer));
 out:
 	netlink_close(&nlh);
 	nlmsg_free(answer);
@@ -795,7 +798,7 @@ int lxc_bridge_attach(const char *bridge
 
 	strncpy(ifr.ifr_name, bridge, IFNAMSIZ);
 	ifr.ifr_ifindex = index;
-	err = ioctl(fd, SIOCBRADDIF, &ifr);
+	err = lxc_privilegied(ioctl(fd, SIOCBRADDIF, &ifr));
 	close(fd);
 	if (err)
 		err = -errno;
