diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2020-12-09 16:04:45 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-12-09 16:04:45 -0500 |
| commit | eb053df7843d9ec4aba4ee331e04b1d1d5a4ceee (patch) | |
| tree | 553d8317ff4dfd04d4fb93d9d183911e76cf8a55 | |
| parent | 059c2ee739c156287237c07e07f497602bd9958d (diff) | |
| parent | 1ace9e3ba618bc21ea41957f1bc60509b56a0a95 (diff) | |
| download | podman-eb053df7843d9ec4aba4ee331e04b1d1d5a4ceee.tar.gz podman-eb053df7843d9ec4aba4ee331e04b1d1d5a4ceee.tar.bz2 podman-eb053df7843d9ec4aba4ee331e04b1d1d5a4ceee.zip | |
Merge pull request #8670 from rhatdan/caps
Properly handle --cap-add all when running with a --user flag
| -rw-r--r-- | pkg/specgen/generate/security.go | 2 | ||||
| -rw-r--r-- | test/e2e/run_privileged_test.go | 12 |
2 files changed, 13 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go index dee140282..56947ff24 100644 --- a/pkg/specgen/generate/security.go +++ b/pkg/specgen/generate/security.go @@ -141,7 +141,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, configSpec.Process.Capabilities.Effective = caplist configSpec.Process.Capabilities.Permitted = caplist } else { - userCaps, err := capabilities.NormalizeCapabilities(s.CapAdd) + userCaps, err := capabilities.MergeCapabilities(nil, s.CapAdd, nil) if err != nil { return errors.Wrapf(err, "capabilities requested by user are not valid: %q", strings.Join(s.CapAdd, ",")) } diff --git a/test/e2e/run_privileged_test.go b/test/e2e/run_privileged_test.go index ab11128ba..760de55b6 100644 --- a/test/e2e/run_privileged_test.go +++ b/test/e2e/run_privileged_test.go @@ -90,6 +90,18 @@ var _ = Describe("Podman privileged container tests", func() { containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString()) }) + It("podman cap-add CapEff with --user", func() { + // Get caps of current process + host_cap := SystemExec("awk", []string{"/^CapEff/ { print $2 }", "/proc/self/status"}) + Expect(host_cap.ExitCode()).To(Equal(0)) + + session := podmanTest.Podman([]string{"run", "--user=bin", "--cap-add", "all", "busybox", "awk", "/^CapEff/ { print $2 }", "/proc/self/status"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + + containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString()) + }) + It("podman cap-drop CapEff", func() { session := podmanTest.Podman([]string{"run", "--cap-drop", "all", "busybox", "grep", "CapEff", "/proc/self/status"}) session.WaitWithDefaultTimeout() |