diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2022-04-12 17:17:40 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2022-04-12 17:17:40 -0400 |
| commit | f83adcc57e567c89afac0bd73a0d8061123b2292 (patch) | |
| tree | bcbe9d7a86ab5160a5cc6e1cf075f385046ecf8f /pkg | |
| parent | 16f7a75033a036cf17d9e825caf318840f05e166 (diff) | |
| parent | 19b9f4cb5dd1ea429ce3fbe818e146dd7762ea24 (diff) | |
| download | podman-f83adcc57e567c89afac0bd73a0d8061123b2292.tar.gz podman-f83adcc57e567c89afac0bd73a0d8061123b2292.tar.bz2 podman-f83adcc57e567c89afac0bd73a0d8061123b2292.zip | |
Merge pull request #13850 from mheon/bump_345
Bump to v3.4.5
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/specgen/generate/security.go | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go index a12cc09e2..ec0bddd77 100644 --- a/pkg/specgen/generate/security.go +++ b/pkg/specgen/generate/security.go @@ -146,6 +146,10 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, configSpec := g.Config configSpec.Process.Capabilities.Ambient = []string{} + + // Always unset the inheritable capabilities similarly to what the Linux kernel does + // They are used only when using capabilities with uid != 0. + configSpec.Process.Capabilities.Inheritable = []string{} configSpec.Process.Capabilities.Bounding = caplist user := strings.Split(s.User, ":")[0] @@ -153,7 +157,6 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, if (user == "" && s.UserNS.NSMode != specgen.KeepID) || user == "root" || user == "0" { configSpec.Process.Capabilities.Effective = caplist configSpec.Process.Capabilities.Permitted = caplist - configSpec.Process.Capabilities.Inheritable = caplist } else { mergedCaps, err := capabilities.MergeCapabilities(nil, s.CapAdd, nil) if err != nil { @@ -175,12 +178,12 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, } configSpec.Process.Capabilities.Effective = userCaps configSpec.Process.Capabilities.Permitted = userCaps - configSpec.Process.Capabilities.Inheritable = userCaps // Ambient capabilities were added to Linux 4.3. Set ambient // capabilities only when the kernel supports them. if supportAmbientCapabilities() { configSpec.Process.Capabilities.Ambient = userCaps + configSpec.Process.Capabilities.Inheritable = userCaps } } |