summaryrefslogtreecommitdiff
path: root/libpod/container_api.go
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2018-02-15 12:23:36 -0500
committerAtomic Bot <atomic-devel@projectatomic.io>2018-02-24 09:15:47 +0000
commit831dc488833e055dce1f1ba4c09f09346c85b67d (patch)
tree1bb780fafbe1bd32a85ce32e19a9d4f562669797 /libpod/container_api.go
parent1d9539337b7140f4631812a24f07a11540523c61 (diff)
downloadpodman-831dc488833e055dce1f1ba4c09f09346c85b67d.tar.gz
podman-831dc488833e055dce1f1ba4c09f09346c85b67d.tar.bz2
podman-831dc488833e055dce1f1ba4c09f09346c85b67d.zip
Add support for --no-new-privs
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com> Closes: #369 Approved by: rhatdan
Diffstat (limited to 'libpod/container_api.go')
-rw-r--r--libpod/container_api.go13
1 files changed, 7 insertions, 6 deletions
diff --git a/libpod/container_api.go b/libpod/container_api.go
index 2dfb166ec..f79be4ac7 100644
--- a/libpod/container_api.go
+++ b/libpod/container_api.go
@@ -237,12 +237,13 @@ func (c *Container) Exec(tty, privileged bool, env, cmd []string, user string) e
log: c.LogPath(),
}
execOpts := runcExecOptions{
- capAdd: capList,
- pidFile: filepath.Join(c.state.RunDir, fmt.Sprintf("%s-execpid", stringid.GenerateNonCryptoID()[:12])),
- env: env,
- user: user,
- cwd: c.config.Spec.Process.Cwd,
- tty: tty,
+ capAdd: capList,
+ pidFile: filepath.Join(c.state.RunDir, fmt.Sprintf("%s-execpid", stringid.GenerateNonCryptoID()[:12])),
+ env: env,
+ noNewPrivs: c.config.NoNewPrivs,
+ user: user,
+ cwd: c.config.Spec.Process.Cwd,
+ tty: tty,
}
return c.runtime.ociRuntime.execContainer(c, cmd, globalOpts, execOpts)