toolshed/docker-cli
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #36587 from justincormack/unpriv-caps

Browse Source 
If container will run as non root user, drop permitted, effective caps early
Upstream-commit: b67c1e078c7eeb20199dce301e95fa8999c98109
Component: engine
This commit is contained in:
Vincent Demeester
2018-03-22 14:51:29 +01:00
committed by GitHub
parent 34dd223936 3d783d5dbf
commit 1f699969f9
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
components/engine/daemon/oci_linux.go
+7 -1
View File
@@ -255,7 +255,7 @@ func setCapabilities(s *specs.Spec, c *container.Container) error {
if c.HostConfig.Privileged {
caplist = caps.GetAllCapabilities()
} else {
caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Effective, c.HostConfig.CapAdd, c.HostConfig.CapDrop)
caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Bounding, c.HostConfig.CapAdd, c.HostConfig.CapDrop)
if err != nil {
return err
}
@@ -264,6 +264,12 @@ func setCapabilities(s *specs.Spec, c *container.Container) error {
s.Process.Capabilities.Bounding = caplist
s.Process.Capabilities.Permitted = caplist
s.Process.Capabilities.Inheritable = caplist
// setUser has already been executed here
// if non root drop capabilities in the way execve does
if s.Process.User.UID != 0 {
s.Process.Capabilities.Effective = []string{}
s.Process.Capabilities.Permitted = []string{}
}
return nil
}
components/engine/profiles/seccomp/seccomp.go
+2 -2
View File
@@ -105,7 +105,7 @@ Loop:
}
if len(call.Excludes.Caps) > 0 {
for _, c := range call.Excludes.Caps {
if inSlice(rs.Process.Capabilities.Effective, c) {
if inSlice(rs.Process.Capabilities.Bounding, c) {
continue Loop
}
}
@@ -117,7 +117,7 @@ Loop:
}
if len(call.Includes.Caps) > 0 {
for _, c := range call.Includes.Caps {
if !inSlice(rs.Process.Capabilities.Effective, c) {
if !inSlice(rs.Process.Capabilities.Bounding, c) {
continue Loop
}
}