diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2020-12-23 21:53:55 +0100 |
|---|---|---|
| committer | Giuseppe Scrivano <gscrivan@redhat.com> | 2020-12-24 22:11:14 +0100 |
| commit | 2a39a6195aeb547c319e7de849f613e95c22c608 (patch) | |
| tree | f0619e3df23cafb2377f6699f79ab9e189f80fcf /libpod/oci_conmon_linux.go | |
| parent | 2a976392632fb1eee80e215ba84ff1365ae816a9 (diff) | |
| download | podman-2a39a6195aeb547c319e7de849f613e95c22c608.tar.gz podman-2a39a6195aeb547c319e7de849f613e95c22c608.tar.bz2 podman-2a39a6195aeb547c319e7de849f613e95c22c608.zip | |
exec: honor --privileged
write the capabilities to the configuration passed to the OCI
runtime.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'libpod/oci_conmon_linux.go')
| -rw-r--r-- | libpod/oci_conmon_linux.go | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index 10f97a8f9..199b40097 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -1193,6 +1193,13 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio pspec := c.config.Spec.Process pspec.SelinuxLabel = c.config.ProcessLabel pspec.Args = options.Cmd + for _, cap := range options.CapAdd { + pspec.Capabilities.Bounding = append(pspec.Capabilities.Bounding, cap) + pspec.Capabilities.Effective = append(pspec.Capabilities.Effective, cap) + pspec.Capabilities.Inheritable = append(pspec.Capabilities.Inheritable, cap) + pspec.Capabilities.Permitted = append(pspec.Capabilities.Permitted, cap) + pspec.Capabilities.Ambient = append(pspec.Capabilities.Ambient, cap) + } // We need to default this to false else it will inherit terminal as true // from the container. pspec.Terminal = false |