diff options
| author | Giuseppe Scrivano <gscrivan@redhat.com> | 2020-09-29 10:06:48 +0200 |
|---|---|---|
| committer | Giuseppe Scrivano <gscrivan@redhat.com> | 2020-09-30 15:14:07 +0200 |
| commit | 703381b4a2b1dc761ffee0d8e36b47f21ffd92c5 (patch) | |
| tree | ecad6d09a25728b94a5939dc884b4f9fcb52c48d /pkg/specgen | |
| parent | 2ee415be90b8d6ab75f9fe579fc1b8690e023d3c (diff) | |
| download | podman-703381b4a2b1dc761ffee0d8e36b47f21ffd92c5.tar.gz podman-703381b4a2b1dc761ffee0d8e36b47f21ffd92c5.tar.bz2 podman-703381b4a2b1dc761ffee0d8e36b47f21ffd92c5.zip | |
capabilities: always set ambient and inheritable
change capabilities handling to reflect what docker does.
Bounding: set to caplist
Inheritable: set to caplist
Effective: if uid != 0 then clear; else set to caplist
Permitted: if uid != 0 then clear; else set to caplist
Ambient: clear
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
Diffstat (limited to 'pkg/specgen')
| -rw-r--r-- | pkg/specgen/generate/security.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go index 7c818cf62..d17cd4a9a 100644 --- a/pkg/specgen/generate/security.go +++ b/pkg/specgen/generate/security.go @@ -131,12 +131,13 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, } configSpec := g.Config + configSpec.Process.Capabilities.Ambient = []string{} configSpec.Process.Capabilities.Bounding = caplist + configSpec.Process.Capabilities.Inheritable = caplist if s.User == "" || s.User == "root" || s.User == "0" { configSpec.Process.Capabilities.Effective = caplist configSpec.Process.Capabilities.Permitted = caplist - configSpec.Process.Capabilities.Inheritable = caplist } else { userCaps, err := capabilities.NormalizeCapabilities(s.CapAdd) if err != nil { |