summaryrefslogtreecommitdiff
path: root/pkg/specgen
diff options
context:
space:
mode:
authorOpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com>2020-09-30 17:22:54 +0000
committerGitHub <noreply@github.com>2020-09-30 17:22:54 +0000
commitf86e01ab10821d99cebb82d10c3bd5dad77af8c6 (patch)
tree8076aa51152c2c6f5e17719e896acec1182f2676 /pkg/specgen
parente2050d7c351d14cab2ccaa09f8a6409688496727 (diff)
parent703381b4a2b1dc761ffee0d8e36b47f21ffd92c5 (diff)
downloadpodman-f86e01ab10821d99cebb82d10c3bd5dad77af8c6.tar.gz
podman-f86e01ab10821d99cebb82d10c3bd5dad77af8c6.tar.bz2
podman-f86e01ab10821d99cebb82d10c3bd5dad77af8c6.zip
Merge pull request #7820 from giuseppe/fix-capabilities-not-root
capabilities: always set ambient and inheritable
Diffstat (limited to 'pkg/specgen')
-rw-r--r--pkg/specgen/generate/security.go3
1 files changed, 2 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index 7c818cf62..d17cd4a9a 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -131,12 +131,13 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
}
configSpec := g.Config
+ configSpec.Process.Capabilities.Ambient = []string{}
configSpec.Process.Capabilities.Bounding = caplist
+ configSpec.Process.Capabilities.Inheritable = caplist
if s.User == "" || s.User == "root" || s.User == "0" {
configSpec.Process.Capabilities.Effective = caplist
configSpec.Process.Capabilities.Permitted = caplist
- configSpec.Process.Capabilities.Inheritable = caplist
} else {
userCaps, err := capabilities.NormalizeCapabilities(s.CapAdd)
if err != nil {