From 36137c76fa0b0046daf56cf78c7f9af2ff8f913d Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Dec 07 2021 18:57:55 +0000
Subject: import irqbalance-1.8.0-4.el9


---

diff --git a/SOURCES/irqbalance-1.8.0-Drop-CapabilityBoundingSet-from-irqbalance-service.patch b/SOURCES/irqbalance-1.8.0-Drop-CapabilityBoundingSet-from-irqbalance-service.patch
new file mode 100644
index 0000000..c855f8a
--- /dev/null
+++ b/SOURCES/irqbalance-1.8.0-Drop-CapabilityBoundingSet-from-irqbalance-service.patch
@@ -0,0 +1,32 @@
+From efab2725ea5165732c5e98c0e083a4eec6e355e3 Mon Sep 17 00:00:00 2001
+From: Kairui Song <kasong@redhat.com>
+Date: Fri, 24 Sep 2021 17:43:30 +0800
+Subject: [PATCH] Drop CapabilityBoundingSet from irqbalance service
+
+libcapng is issuing an error in the system log when irqbalance attempts
+to drop capabilities, but systemd service unit has already done dropped
+all capabilities. commit 43751df tried to fix this but it didn't fix it
+completely. CapabilityBoundingSet also need to be dropped.
+
+Fixes #182
+
+Signed-off-by: Kairui Song <kasong@redhat.com>
+---
+ misc/irqbalance.service | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/misc/irqbalance.service b/misc/irqbalance.service
+index 014798c..fcc29c2 100644
+--- a/misc/irqbalance.service
++++ b/misc/irqbalance.service
+@@ -8,7 +8,6 @@ ConditionVirtualization=!container
+ EnvironmentFile=-/usr/lib/irqbalance/defaults.env
+ EnvironmentFile=-/path/to/irqbalance.env
+ ExecStart=/usr/sbin/irqbalance --foreground $IRQBALANCE_ARGS
+-CapabilityBoundingSet=
+ ReadOnlyPaths=/
+ ReadWritePaths=/proc/irq
+ RestrictAddressFamilies=AF_UNIX
+-- 
+2.31.1
+
diff --git a/SPECS/irqbalance.spec b/SPECS/irqbalance.spec
index 4473a23..1a719e2 100644
--- a/SPECS/irqbalance.spec
+++ b/SPECS/irqbalance.spec
@@ -1,6 +1,6 @@
 Name:           irqbalance
 Version:        1.8.0
-Release:        3%{?dist}
+Release:        4%{?dist}
 Epoch:          2
 Summary:        IRQ balancing daemon
 
@@ -25,6 +25,7 @@ ExcludeArch: s390 s390x
 
 Patch1: irqbalance-1.8.0-drop-NoNewPrivs-from-irqbalance-service.patch
 Patch2: irqbalance-1.8.0-Disable-the-communication-socket-when-UI-is-disabled.patch
+Patch3: irqbalance-1.8.0-Drop-CapabilityBoundingSet-from-irqbalance-service.patch
 
 %description
 irqbalance is a daemon that evenly distributes IRQ load across
@@ -34,6 +35,7 @@ multiple CPUs for enhanced performance.
 %setup -q
 %patch1 -p1
 %patch2 -p1
+%patch3 -p1
 
 %build
 ./autogen.sh
@@ -74,6 +76,9 @@ fi
 /sbin/chkconfig --del irqbalance >/dev/null 2>&1 || :
 
 %changelog
+* Mon Sep 27 2021 Kairui Song <kasong@redhat.com> - 2:1.8.0-4
+- Drop CapabilityBoundingSet from irqbalance service. Resolves: rhbz1963152
+
 * Mon Aug 09 2021 Mohan Boddu <mboddu@redhat.com> - 2:1.8.0-3
 - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
   Related: rhbz#1991688