summaryrefslogtreecommitdiff
path: root/pkg/specgen/generate
diff options
context:
space:
mode:
authorGiuseppe Scrivano <gscrivan@redhat.com>2020-09-29 10:06:48 +0200
committerGiuseppe Scrivano <gscrivan@redhat.com>2020-09-30 15:14:07 +0200
commit703381b4a2b1dc761ffee0d8e36b47f21ffd92c5 (patch)
treeecad6d09a25728b94a5939dc884b4f9fcb52c48d /pkg/specgen/generate
parent2ee415be90b8d6ab75f9fe579fc1b8690e023d3c (diff)
downloadpodman-703381b4a2b1dc761ffee0d8e36b47f21ffd92c5.tar.gz
podman-703381b4a2b1dc761ffee0d8e36b47f21ffd92c5.tar.bz2
podman-703381b4a2b1dc761ffee0d8e36b47f21ffd92c5.zip
capabilities: always set ambient and inheritable
change capabilities handling to reflect what docker does. Bounding: set to caplist Inheritable: set to caplist Effective: if uid != 0 then clear; else set to caplist Permitted: if uid != 0 then clear; else set to caplist Ambient: clear Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'pkg/specgen/generate')
-rw-r--r--pkg/specgen/generate/security.go3
1 files changed, 2 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index 7c818cf62..d17cd4a9a 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -131,12 +131,13 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
}
configSpec := g.Config
+ configSpec.Process.Capabilities.Ambient = []string{}
configSpec.Process.Capabilities.Bounding = caplist
+ configSpec.Process.Capabilities.Inheritable = caplist
if s.User == "" || s.User == "root" || s.User == "0" {
configSpec.Process.Capabilities.Effective = caplist
configSpec.Process.Capabilities.Permitted = caplist
- configSpec.Process.Capabilities.Inheritable = caplist
} else {
userCaps, err := capabilities.NormalizeCapabilities(s.CapAdd)
if err != nil {