diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2021-03-19 16:00:32 -0700 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-03-19 16:00:32 -0700 |
| commit | ebc9871c9358b41daefc37e5db8119f596770cb7 (patch) | |
| tree | 2ea4b54edf71e94d8a37918b8658326b1d194772 /libpod | |
| parent | 5325957d536be3515fb7a782e4755afca38fca4c (diff) | |
| parent | adf652e2a1a67a8c70840fb9dfbc796f5b5b3c03 (diff) | |
| download | podman-ebc9871c9358b41daefc37e5db8119f596770cb7.tar.gz podman-ebc9871c9358b41daefc37e5db8119f596770cb7.tar.bz2 podman-ebc9871c9358b41daefc37e5db8119f596770cb7.zip | |
Merge pull request #9762 from giuseppe/use-bounding-caps-for---privileged
security: use the bounding caps with --privileged
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/oci_conmon_linux.go | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index ef5f6fb0c..1c7089e5d 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -1268,7 +1268,10 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio return nil, err } - allCaps := capabilities.AllCapabilities() + allCaps, err := capabilities.BoundingSet() + if err != nil { + return nil, err + } if options.Privileged { pspec.Capabilities.Bounding = allCaps } else { |