From 8292fc0a4447bd744d86938a76f53f9a3618987c Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Mon, 28 Feb 2022 09:48:52 +0100 Subject: do not set the inheritable capabilities The kernel never sets the inheritable capabilities for a process, they are only set by userspace. Emulate the same behavior. Closes: CVE-2022-27649 Signed-off-by: Giuseppe Scrivano (cherry picked from commit aafa80918a245edcbdaceb1191d749570f1872d0) --- libpod/oci_conmon_exec_linux.go | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) (limited to 'libpod/oci_conmon_exec_linux.go') diff --git a/libpod/oci_conmon_exec_linux.go b/libpod/oci_conmon_exec_linux.go index 553c91833..5be8144e7 100644 --- a/libpod/oci_conmon_exec_linux.go +++ b/libpod/oci_conmon_exec_linux.go @@ -757,11 +757,14 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio } else { pspec.Capabilities.Bounding = ctrSpec.Process.Capabilities.Bounding } + + // Always unset the inheritable capabilities similarly to what the Linux kernel does + // They are used only when using capabilities with uid != 0. + pspec.Capabilities.Inheritable = []string{} + if execUser.Uid == 0 { pspec.Capabilities.Effective = pspec.Capabilities.Bounding - pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding pspec.Capabilities.Permitted = pspec.Capabilities.Bounding - pspec.Capabilities.Ambient = pspec.Capabilities.Bounding } else { if user == c.config.User { pspec.Capabilities.Effective = ctrSpec.Process.Capabilities.Effective -- cgit v1.2.3-54-g00ecf