summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2020-12-23 21:53:55 +0100
committerGiuseppe Scrivano <gscrivan@redhat.com>2020-12-24 22:11:14 +0100
commit2a39a6195aeb547c319e7de849f613e95c22c608 (patch)
treef0619e3df23cafb2377f6699f79ab9e189f80fcf /libpod
parent2a976392632fb1eee80e215ba84ff1365ae816a9 (diff)
downloadpodman-2a39a6195aeb547c319e7de849f613e95c22c608.tar.gz
podman-2a39a6195aeb547c319e7de849f613e95c22c608.tar.bz2
podman-2a39a6195aeb547c319e7de849f613e95c22c608.zip
exec: honor --privileged
write the capabilities to the configuration passed to the OCI runtime. Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'libpod')
-rw-r--r--libpod/oci_conmon_linux.go7
1 files changed, 7 insertions, 0 deletions
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go
index 10f97a8f9..199b40097 100644
--- a/libpod/oci_conmon_linux.go
+++ b/libpod/oci_conmon_linux.go
@@ -1193,6 +1193,13 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio
pspec := c.config.Spec.Process
pspec.SelinuxLabel = c.config.ProcessLabel
pspec.Args = options.Cmd
+ for _, cap := range options.CapAdd {
+ pspec.Capabilities.Bounding = append(pspec.Capabilities.Bounding, cap)
+ pspec.Capabilities.Effective = append(pspec.Capabilities.Effective, cap)
+ pspec.Capabilities.Inheritable = append(pspec.Capabilities.Inheritable, cap)
+ pspec.Capabilities.Permitted = append(pspec.Capabilities.Permitted, cap)
+ pspec.Capabilities.Ambient = append(pspec.Capabilities.Ambient, cap)
+ }
// We need to default this to false else it will inherit terminal as true
// from the container.
pspec.Terminal = false