summaryrefslogtreecommitdiff
path: root/libpod
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2022-02-28 09:48:52 +0100
committerGiuseppe Scrivano <gscrivan@redhat.com>2022-03-23 09:05:18 +0100
commitaafa80918a245edcbdaceb1191d749570f1872d0 (patch)
treebbd84ae1ea3eef9e6f9ffd4684956f4b0f8a0010 /libpod
parentc39dffe83db9fa3cfa6897b971956821f1bbcce2 (diff)
downloadpodman-aafa80918a245edcbdaceb1191d749570f1872d0.tar.gz
podman-aafa80918a245edcbdaceb1191d749570f1872d0.tar.bz2
podman-aafa80918a245edcbdaceb1191d749570f1872d0.zip
do not set the inheritable capabilities
The kernel never sets the inheritable capabilities for a process, they are only set by userspace. Emulate the same behavior. Closes: CVE-2022-27649 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'libpod')
-rw-r--r--libpod/oci_conmon_exec_linux.go7
1 files changed, 5 insertions, 2 deletions
diff --git a/libpod/oci_conmon_exec_linux.go b/libpod/oci_conmon_exec_linux.go
index aa970bbde..65123b37e 100644
--- a/libpod/oci_conmon_exec_linux.go
+++ b/libpod/oci_conmon_exec_linux.go
@@ -758,11 +758,14 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio
} else {
pspec.Capabilities.Bounding = ctrSpec.Process.Capabilities.Bounding
}
+
+ // Always unset the inheritable capabilities similarly to what the Linux kernel does
+ // They are used only when using capabilities with uid != 0.
+ pspec.Capabilities.Inheritable = []string{}
+
if execUser.Uid == 0 {
pspec.Capabilities.Effective = pspec.Capabilities.Bounding
- pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding
pspec.Capabilities.Permitted = pspec.Capabilities.Bounding
- pspec.Capabilities.Ambient = pspec.Capabilities.Bounding
} else {
if user == c.config.User {
pspec.Capabilities.Effective = ctrSpec.Process.Capabilities.Effective