diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2020-11-03 11:44:23 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2020-11-03 11:44:23 +0100 |
| commit | aae3e71f9a6e32307956c3c890455cb11af2ccbf (patch) | |
| tree | 9cf284a5b81013c5580014c68bae302cb8f5df25 /pkg/specgen/generate/security.go | |
| parent | 8dfbdb561be5e2313dfa9f665e1f184089c8e967 (diff) | |
| parent | afa4ec0db01b620be540e72e25fc86092e2fa303 (diff) | |
| download | podman-aae3e71f9a6e32307956c3c890455cb11af2ccbf.tar.gz podman-aae3e71f9a6e32307956c3c890455cb11af2ccbf.tar.bz2 podman-aae3e71f9a6e32307956c3c890455cb11af2ccbf.zip | |
Merge pull request #8217 from giuseppe/caps-ambient
specgen: add support for ambient capabilities
Diffstat (limited to 'pkg/specgen/generate/security.go')
| -rw-r--r-- | pkg/specgen/generate/security.go | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go index d17cd4a9a..dee140282 100644 --- a/pkg/specgen/generate/security.go +++ b/pkg/specgen/generate/security.go @@ -135,7 +135,9 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, configSpec.Process.Capabilities.Bounding = caplist configSpec.Process.Capabilities.Inheritable = caplist - if s.User == "" || s.User == "root" || s.User == "0" { + user := strings.Split(s.User, ":")[0] + + if (user == "" && s.UserNS.NSMode != specgen.KeepID) || user == "root" || user == "0" { configSpec.Process.Capabilities.Effective = caplist configSpec.Process.Capabilities.Permitted = caplist } else { @@ -145,6 +147,12 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, } configSpec.Process.Capabilities.Effective = userCaps configSpec.Process.Capabilities.Permitted = userCaps + + // Ambient capabilities were added to Linux 4.3. Set ambient + // capabilities only when the kernel supports them. + if supportAmbientCapabilities() { + configSpec.Process.Capabilities.Ambient = userCaps + } } g.SetProcessNoNewPrivileges(s.NoNewPrivileges) |