diff options
| author | OpenShift Merge Robot <openshift-merge-robot@users.noreply.github.com> | 2021-01-07 09:44:37 -0500 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-01-07 09:44:37 -0500 |
| commit | 3cf41c4a7349d2f2529ce94801de2de9898ae27f (patch) | |
| tree | 0982a64d3ffd90561a8f1465be0581edfca489d3 /pkg | |
| parent | 74af9254b98eb21e25c9776b0cf0664d3cb2c46e (diff) | |
| parent | db71759b1aa575633649091b97ea9b856aebc687 (diff) | |
| download | podman-3cf41c4a7349d2f2529ce94801de2de9898ae27f.tar.gz podman-3cf41c4a7349d2f2529ce94801de2de9898ae27f.tar.bz2 podman-3cf41c4a7349d2f2529ce94801de2de9898ae27f.zip | |
Merge pull request #8821 from rhatdan/caps
Containers should not get inheritable caps by default
Diffstat (limited to 'pkg')
| -rw-r--r-- | pkg/specgen/generate/security.go | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go index 9fceec7b3..390b19beb 100644 --- a/pkg/specgen/generate/security.go +++ b/pkg/specgen/generate/security.go @@ -133,13 +133,13 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, configSpec := g.Config configSpec.Process.Capabilities.Ambient = []string{} configSpec.Process.Capabilities.Bounding = caplist - configSpec.Process.Capabilities.Inheritable = caplist user := strings.Split(s.User, ":")[0] if (user == "" && s.UserNS.NSMode != specgen.KeepID) || user == "root" || user == "0" { configSpec.Process.Capabilities.Effective = caplist configSpec.Process.Capabilities.Permitted = caplist + configSpec.Process.Capabilities.Inheritable = caplist } else { userCaps, err := capabilities.MergeCapabilities(nil, s.CapAdd, nil) if err != nil { @@ -147,6 +147,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator, } configSpec.Process.Capabilities.Effective = userCaps configSpec.Process.Capabilities.Permitted = userCaps + configSpec.Process.Capabilities.Inheritable = userCaps // Ambient capabilities were added to Linux 4.3. Set ambient // capabilities only when the kernel supports them. |