vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

[DROP #493] disable caps set

Browse source 
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This commit is contained in:
Antonio Murdaca 2017-05-06 14:52:45 +02:00
parent 37b5d432bd
commit e0d677594c
No known key found for this signature in database
GPG key ID: B2BEAD150DE936B9
1 changed files with 25 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

50
server/container_create.go
View file

@ -399,32 +399,32 @@ func (s *Server) createSandboxContainer(ctx context.Context, containerID string,
} }
} }
capabilities := linux.GetSecurityContext().GetCapabilities() //capabilities := linux.GetSecurityContext().GetCapabilities()
toCAPPrefixed := func(cap string) string { //toCAPPrefixed := func(cap string) string {
if !strings.HasPrefix(strings.ToLower(cap), "cap_") { //if !strings.HasPrefix(strings.ToLower(cap), "cap_") {
return "CAP_" + cap //return "CAP_" + cap
} //}
return cap //return cap
} //}
if capabilities != nil { //if capabilities != nil {
addCaps := capabilities.AddCapabilities //addCaps := capabilities.AddCapabilities
if addCaps != nil { //if addCaps != nil {
for _, cap := range addCaps { //for _, cap := range addCaps {
if err := specgen.AddProcessCapability(toCAPPrefixed(cap)); err != nil { //if err := specgen.AddProcessCapability(toCAPPrefixed(cap)); err != nil {
return nil, err //return nil, err
} //}
} //}
} //}
dropCaps := capabilities.DropCapabilities //dropCaps := capabilities.DropCapabilities
if dropCaps != nil { //if dropCaps != nil {
for _, cap := range dropCaps { //for _, cap := range dropCaps {
if err := specgen.DropProcessCapability(toCAPPrefixed(cap)); err != nil { //if err := specgen.DropProcessCapability(toCAPPrefixed(cap)); err != nil {
return nil, err //return nil, err
} //}
} //}
} //}
} //}
specgen.SetProcessSelinuxLabel(sb.processLabel) specgen.SetProcessSelinuxLabel(sb.processLabel)
specgen.SetLinuxMountLabel(sb.mountLabel) specgen.SetLinuxMountLabel(sb.mountLabel)