diff options
| author | Giuseppe Scrivano <giuseppe@scrivano.org> | 2022-03-24 17:02:20 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-03-24 17:02:20 +0100 |
| commit | ab8e15f6ac05a4f35604fa1b2c4f37765aae3007 (patch) | |
| tree | c7cb5c36cca79c25fa2806f9c11b93b86fd409e7 /libpod | |
| parent | a416fd6de40820e266e9e1e312c5f13bbb0b189f (diff) | |
| parent | aafa80918a245edcbdaceb1191d749570f1872d0 (diff) | |
| download | podman-ab8e15f6ac05a4f35604fa1b2c4f37765aae3007.tar.gz podman-ab8e15f6ac05a4f35604fa1b2c4f37765aae3007.tar.bz2 podman-ab8e15f6ac05a4f35604fa1b2c4f37765aae3007.zip | |
Merge pull request from GHSA-qvf8-p83w-v58j
do not set the inheritable capabilities
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/oci_conmon_exec_linux.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libpod/oci_conmon_exec_linux.go b/libpod/oci_conmon_exec_linux.go index aa970bbde..65123b37e 100644 --- a/libpod/oci_conmon_exec_linux.go +++ b/libpod/oci_conmon_exec_linux.go @@ -758,11 +758,14 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio } else { pspec.Capabilities.Bounding = ctrSpec.Process.Capabilities.Bounding } + + // Always unset the inheritable capabilities similarly to what the Linux kernel does + // They are used only when using capabilities with uid != 0. + pspec.Capabilities.Inheritable = []string{} + if execUser.Uid == 0 { pspec.Capabilities.Effective = pspec.Capabilities.Bounding - pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding pspec.Capabilities.Permitted = pspec.Capabilities.Bounding - pspec.Capabilities.Ambient = pspec.Capabilities.Bounding } else { if user == c.config.User { pspec.Capabilities.Effective = ctrSpec.Process.Capabilities.Effective |