diff options
| -rw-r--r-- | pkg/spec/spec.go | 19 | ||||
| -rw-r--r-- | test/e2e/run_test.go | 9 |
2 files changed, 28 insertions, 0 deletions
diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go index 959a24213..5260b9b19 100644 --- a/pkg/spec/spec.go +++ b/pkg/spec/spec.go @@ -388,8 +388,19 @@ func addRlimits(config *CreateConfig, g *generate.Generator) error { } func setupCapabilities(config *CreateConfig, configSpec *spec.Spec) error { + useNotRoot := func(user string) bool { + if user == "" || user == "root" || user == "0" { + return false + } + return true + } + var err error var caplist []string + bounding := configSpec.Process.Capabilities.Bounding + if useNotRoot(config.User) { + configSpec.Process.Capabilities.Bounding = caplist + } caplist, err = caps.TweakCapabilities(configSpec.Process.Capabilities.Bounding, config.CapAdd, config.CapDrop) if err != nil { return err @@ -399,6 +410,14 @@ func setupCapabilities(config *CreateConfig, configSpec *spec.Spec) error { configSpec.Process.Capabilities.Permitted = caplist configSpec.Process.Capabilities.Inheritable = caplist configSpec.Process.Capabilities.Effective = caplist + configSpec.Process.Capabilities.Ambient = caplist + if useNotRoot(config.User) { + caplist, err = caps.TweakCapabilities(bounding, config.CapAdd, config.CapDrop) + if err != nil { + return err + } + } + configSpec.Process.Capabilities.Bounding = caplist return nil } diff --git a/test/e2e/run_test.go b/test/e2e/run_test.go index cc8492958..5f2bccdac 100644 --- a/test/e2e/run_test.go +++ b/test/e2e/run_test.go @@ -5,6 +5,7 @@ import ( "io/ioutil" "os" "path/filepath" + "strings" "github.com/mrunalp/fileutils" . "github.com/onsi/ginkgo" @@ -369,6 +370,14 @@ var _ = Describe("Podman run", func() { Expect(session.OutputToString()).To(Equal("uid=8(mail) gid=21(ftp)")) }) + It("podman run with user, verify caps dropped", func() { + session := podmanTest.Podman([]string{"run", "--rm", "--user=1234", ALPINE, "grep", "CapEff", "/proc/self/status"}) + session.WaitWithDefaultTimeout() + Expect(session.ExitCode()).To(Equal(0)) + capEff := strings.Split(session.OutputToString(), " ") + Expect("0000000000000000").To(Equal(capEff[1])) + }) + It("podman run with attach stdin outputs container ID", func() { session := podmanTest.Podman([]string{"run", "--attach", "stdin", ALPINE, "printenv"}) session.WaitWithDefaultTimeout() |