diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2021-03-19 12:10:33 +0100 |
|---|---|---|
| committer | Giuseppe Scrivano <gscrivan@redhat.com> | 2021-03-19 15:17:11 +0100 |
| commit | e85cf8f4a2a9fa838087e2b55c93c61f7996b9b7 (patch) | |
| tree | 4165210e38bee2b0fa12c46a02d8fccdb203d50a /libpod | |
| parent | f46b34ecd265fe86f6b67669fd545584cbe85a39 (diff) | |
| download | podman-e85cf8f4a2a9fa838087e2b55c93c61f7996b9b7.tar.gz podman-e85cf8f4a2a9fa838087e2b55c93c61f7996b9b7.tar.bz2 podman-e85cf8f4a2a9fa838087e2b55c93c61f7996b9b7.zip | |
security: use the bounding caps with --privileged
when --privileged is used, make sure to not request more capabilities
than currently available in the current context.
[NO TESTS NEEDED] since it fixes existing tests.
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/oci_conmon_linux.go | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index ef5f6fb0c..1c7089e5d 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -1268,7 +1268,10 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio return nil, err } - allCaps := capabilities.AllCapabilities() + allCaps, err := capabilities.BoundingSet() + if err != nil { + return nil, err + } if options.Privileged { pspec.Capabilities.Bounding = allCaps } else { |