Add warning if FS capabilities don't match process capabilities

2 files changed, 8 insertions, 0 deletions

diff --git a/main.go b/main.go
index aeb3ad7..7af98b1 100644
--- a/main.go
+++ b/main.go
@@ -199,6 +199,7 @@ func main() {
 	go paConnectionWatchdog(&ctx)
 
 	ctx.haveCapabilities = hasCapSysResource(getCurrentCaps())
+	ctx.capsMismatch = hasCapSysResource(getCurrentCaps()) != hasCapSysResource(getSelfFileCaps())
 
 	wnd := nucular.NewMasterWindowSize(0, appName, image.Point{600, 400}, func(w *nucular.Window) {
 		updatefn(&ctx, w)
diff --git a/ui.go b/ui.go
index cf171bc..7792c3a 100644
--- a/ui.go
+++ b/ui.go
@@ -35,6 +35,7 @@ type ntcontext struct {
 	reloadRequired           bool
 	haveCapabilities         bool
 	errorMsg                 string
+	capsMismatch             bool
 }
 
 var green = color.RGBA{34, 187, 69, 255}
@@ -394,6 +395,12 @@ func capabilitiesScreen(ctx *ntcontext, w *nucular.Window) {
 	w.Label("NoiseTorch currently does not have the capabilities to function properly.", "CB")
 	w.Row(15).Dynamic(1)
 	w.Label("We require CAP_SYS_RESOURCE. If that doesn't mean anything to you, don't worry. I'll fix it for you.", "CB")
+	if ctx.capsMismatch {
+		w.Row(15).Dynamic(1)
+		w.LabelColored("Warning: File has CAP_SYS_RESOURCE but our process doesn't.", "CB", orange)
+		w.Row(15).Dynamic(1)
+		w.LabelColored("Check if your filesystem has nosuid set or check the troubleshooting page.", "CB", orange)
+	}
 	w.Row(40).Dynamic(1)
 	w.Row(25).Dynamic(1)
 	if w.ButtonText("Grant capability (requires root)") {