[PATCH] 52027: whitelist capability CAP_WAKE_ALARM in 'privasserted' function

[Robert Woods <robert.woods@xxxxxxxxxxxxxxxxx>]

This patch is a follow up of this issue: https://zsh.org/workers/52027

Since the systemd update v254 from July 28, 2023, the capability
'CAP_WAKE_ALARM' is passed by default to some user process (especially
desktop managers). Since 'CAP_WAKE_ALARM' is very narrow in focus, it
is preferable that zsh does not consider it as a 'privileged'
capability.

For context, in the release note of systemd v254 the following is
written in the Section "Security Relevant Changes"[1]:
> pam_systemd will now by default pass the CAP_WAKE_ALARM ambient
> process capability to invoked session processes of regular users on
> local seats (as well as to systemd --user), unless configured
> otherwise [...]. This is useful in order allow desktop tools such as
> GNOME's Alarm Clock application to set a timer for
> LOCK_REALTIME_ALARM that wakes up the system when it elapses. [...].
> Note that this capability is relatively narrow in focus (in
> particular compared to other process capabilities such as
> CAP_SYS_ADMIN) and we already — by default — permit more impactful
> operations such as system suspend to local users.

[1] https://github.com/systemd/systemd/releases/tag/v254

Signed-off-by: Robert Woods <141646993+RobieWoods@xxxxxxxxxxxxxxxxxxxxxxxx>

---
 Src/utils.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/Src/utils.c b/Src/utils.c
index 94a33453f..7040d0954 100644
--- a/Src/utils.c
+++ b/Src/utils.c
@@ -7551,9 +7551,9 @@ privasserted(void)
 	    /* POSIX doesn't define a way to test whether a capability set *
 	     * is empty or not.  Typical.  I hope this is conforming...    */
 	    cap_flag_value_t val;
-	    cap_value_t n;
-	    for(n = 0; !cap_get_flag(caps, n, CAP_EFFECTIVE, &val); n++)
-		if(val) {
+	    cap_value_t cap;
+	    for(cap = 0; !cap_get_flag(caps, cap, CAP_EFFECTIVE, &val); cap++)
+		if(val && cap != CAP_WAKE_ALARM) {
 		    cap_free(caps);
 		    return 1;
 		}
-- 
2.41.0