diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2022-02-28 09:48:52 +0100 |
|---|---|---|
| committer | Matthew Heon <mheon@redhat.com> | 2022-04-12 14:27:41 -0400 |
| commit | 8292fc0a4447bd744d86938a76f53f9a3618987c (patch) | |
| tree | c1c23781cfb9bf1b2ecd9ec9d9530bcadd1c0920 /libpod/oci_conmon_exec_linux.go | |
| parent | 02bd13031eaf7d62ab976aed1696726b6d055dbf (diff) | |
| download | podman-8292fc0a4447bd744d86938a76f53f9a3618987c.tar.gz podman-8292fc0a4447bd744d86938a76f53f9a3618987c.tar.bz2 podman-8292fc0a4447bd744d86938a76f53f9a3618987c.zip | |
do not set the inheritable capabilities
The kernel never sets the inheritable capabilities for a process, they
are only set by userspace. Emulate the same behavior.
Closes: CVE-2022-27649
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
(cherry picked from commit aafa80918a245edcbdaceb1191d749570f1872d0)
Diffstat (limited to 'libpod/oci_conmon_exec_linux.go')
| -rw-r--r-- | libpod/oci_conmon_exec_linux.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libpod/oci_conmon_exec_linux.go b/libpod/oci_conmon_exec_linux.go index 553c91833..5be8144e7 100644 --- a/libpod/oci_conmon_exec_linux.go +++ b/libpod/oci_conmon_exec_linux.go @@ -757,11 +757,14 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio } else { pspec.Capabilities.Bounding = ctrSpec.Process.Capabilities.Bounding } + + // Always unset the inheritable capabilities similarly to what the Linux kernel does + // They are used only when using capabilities with uid != 0. + pspec.Capabilities.Inheritable = []string{} + if execUser.Uid == 0 { pspec.Capabilities.Effective = pspec.Capabilities.Bounding - pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding pspec.Capabilities.Permitted = pspec.Capabilities.Bounding - pspec.Capabilities.Ambient = pspec.Capabilities.Bounding } else { if user == c.config.User { pspec.Capabilities.Effective = ctrSpec.Process.Capabilities.Effective |