diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2022-04-12 17:17:40 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-04-12 17:17:40 -0400 |
| commit | f83adcc57e567c89afac0bd73a0d8061123b2292 (patch) | |
| tree | bcbe9d7a86ab5160a5cc6e1cf075f385046ecf8f /libpod | |
| parent | 16f7a75033a036cf17d9e825caf318840f05e166 (diff) | |
| parent | 19b9f4cb5dd1ea429ce3fbe818e146dd7762ea24 (diff) | |
| download | podman-f83adcc57e567c89afac0bd73a0d8061123b2292.tar.gz podman-f83adcc57e567c89afac0bd73a0d8061123b2292.tar.bz2 podman-f83adcc57e567c89afac0bd73a0d8061123b2292.zip | |
Merge pull request #13850 from mheon/bump_345
Bump to v3.4.5
Diffstat (limited to 'libpod')
| -rw-r--r-- | libpod/oci_conmon_exec_linux.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/libpod/oci_conmon_exec_linux.go b/libpod/oci_conmon_exec_linux.go index 553c91833..5be8144e7 100644 --- a/libpod/oci_conmon_exec_linux.go +++ b/libpod/oci_conmon_exec_linux.go @@ -757,11 +757,14 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio } else { pspec.Capabilities.Bounding = ctrSpec.Process.Capabilities.Bounding } + + // Always unset the inheritable capabilities similarly to what the Linux kernel does + // They are used only when using capabilities with uid != 0. + pspec.Capabilities.Inheritable = []string{} + if execUser.Uid == 0 { pspec.Capabilities.Effective = pspec.Capabilities.Bounding - pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding pspec.Capabilities.Permitted = pspec.Capabilities.Bounding - pspec.Capabilities.Ambient = pspec.Capabilities.Bounding } else { if user == c.config.User { pspec.Capabilities.Effective = ctrSpec.Process.Capabilities.Effective |