From 2be9453c6f92829d9dbc68fb85bc65215cda836e Mon Sep 17 00:00:00 2001
From: Jan Synacek <jsynacek@redhat.com>
Date: Tue, 13 Nov 2012 13:12:36 +0100
Subject: [PATCH] Wrap SO_BINDTODEVICE with the correct capability

---
 ...-s20121112-sobindtodevice-capability.patch | 20 +++++++++++++++++++
 iputils.spec                                  |  4 ++++
 2 files changed, 24 insertions(+)
 create mode 100644 iputils-s20121112-sobindtodevice-capability.patch

diff --git a/iputils-s20121112-sobindtodevice-capability.patch b/iputils-s20121112-sobindtodevice-capability.patch
new file mode 100644
index 0000000..416500e
--- /dev/null
+++ b/iputils-s20121112-sobindtodevice-capability.patch
@@ -0,0 +1,20 @@
+--- iputils-s20121112/ping.c.orig	2012-11-13 12:54:16.000000000 +0100
++++ iputils-s20121112/ping.c	2012-11-13 12:59:42.800466410 +0100
+@@ -314,9 +314,16 @@ main(int argc, char **argv)
+ 		}
+ 		if (device) {
+ 			struct ifreq ifr;
++			int rc;
++
+ 			memset(&ifr, 0, sizeof(ifr));
+ 			strncpy(ifr.ifr_name, device, IFNAMSIZ-1);
+-			if (setsockopt(probe_fd, SOL_SOCKET, SO_BINDTODEVICE, device, strlen(device)+1) == -1) {
++
++			enable_capability_raw();
++			rc = setsockopt(probe_fd, SOL_SOCKET, SO_BINDTODEVICE, device, strlen(device)+1);
++			disable_capability_raw();
++
++			if (rc == -1) {
+ 				if (IN_MULTICAST(ntohl(dst.sin_addr.s_addr))) {
+ 					struct ip_mreqn imr;
+ 					if (ioctl(probe_fd, SIOCGIFINDEX, &ifr) < 0) {
diff --git a/iputils.spec b/iputils.spec
index d0fa1dd..b2d0367 100644
--- a/iputils.spec
+++ b/iputils.spec
@@ -25,6 +25,8 @@ Patch12: iputils-20100418-convtoint.patch
 Patch15: iputils-20101006-unused.patch
 # Use getifaddrs() instead of this?
 Patch17: iputils-20101006-eth.patch
+# Accepted upstream, will be in the next release
+Patch18: iputils-s20121112-sobindtodevice-capability.patch
 
 BuildRequires: docbook-utils perl-SGMLSpm
 BuildRequires: glibc-kernheaders >= 2.4-8.19
@@ -72,6 +74,7 @@ The iputils-sysvinit contains SysV initscritps support.
 %patch12 -p1 -b .convtoint
 %patch15 -p1 -b .unused
 %patch17 -p1 -b .eth
+%patch18 -p1 -b .bindtodevice-cap
 
 %build
 %ifarch s390 s390x
@@ -158,6 +161,7 @@ mv -f RELNOTES.tmp RELNOTES
 - Update to iputils-s20121112 (#875767)
   + drop unnecessary patches
   + update patches
+  + wrap SO_BINDTODEVICE with the correct capability
 
 * Thu Nov 08 2012 Jan Synáček <jsynacek@redhat.com> - 20121106-2
 - Update ifenslave tarball (#859182)