From e85cf8f4a2a9fa838087e2b55c93c61f7996b9b7 Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Fri, 19 Mar 2021 12:10:33 +0100 Subject: security: use the bounding caps with --privileged when --privileged is used, make sure to not request more capabilities than currently available in the current context. [NO TESTS NEEDED] since it fixes existing tests. Signed-off-by: Giuseppe Scrivano --- libpod/oci_conmon_linux.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'libpod/oci_conmon_linux.go') diff --git a/libpod/oci_conmon_linux.go b/libpod/oci_conmon_linux.go index ef5f6fb0c..1c7089e5d 100644 --- a/libpod/oci_conmon_linux.go +++ b/libpod/oci_conmon_linux.go @@ -1268,7 +1268,10 @@ func prepareProcessExec(c *Container, options *ExecOptions, env []string, sessio return nil, err } - allCaps := capabilities.AllCapabilities() + allCaps, err := capabilities.BoundingSet() + if err != nil { + return nil, err + } if options.Privileged { pspec.Capabilities.Bounding = allCaps } else { -- cgit v1.2.3-54-g00ecf