From b6ee193b8e59c198a751a957830ef96c85ba9adc Mon Sep 17 00:00:00 2001
From: Bernerd Schaefer <bj.schaefer@gmail.com>
Date: Wed, 28 May 2014 16:40:36 +0200
Subject: [PATCH 1/2] Add system.SetKeepCaps and system.ClearKeepCaps

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
---
 system/calls_linux.go | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/system/calls_linux.go b/system/calls_linux.go
index faead01..6986051 100644
--- a/system/calls_linux.go
+++ b/system/calls_linux.go
@@ -135,6 +135,22 @@ func GetParentDeathSignal() (int, error) {
 	return sig, nil
 }
 
+func SetKeepCaps() error {
+	if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_KEEPCAPS, 1, 0); err != 0 {
+		return err
+	}
+
+	return nil
+}
+
+func ClearKeepCaps() error {
+	if _, _, err := syscall.RawSyscall(syscall.SYS_PRCTL, syscall.PR_SET_KEEPCAPS, 0, 0); err != 0 {
+		return err
+	}
+
+	return nil
+}
+
 func Setctty() error {
 	if _, _, err := syscall.RawSyscall(syscall.SYS_IOCTL, 0, uintptr(syscall.TIOCSCTTY), 0); err != 0 {
 		return err

From 906451091d64cb2ee059a704737548eb4597e1e3 Mon Sep 17 00:00:00 2001
From: Bernerd Schaefer <bj.schaefer@gmail.com>
Date: Wed, 28 May 2014 16:41:48 +0200
Subject: [PATCH 2/2] SETUID/SETGID not required for changing user

It is no longer necessary to pass "SETUID" or "SETGID" capabilities to
the container when a "user" is specified in the config.

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
---
 libcontainer/nsinit/init.go                   | 24 ++++++++++++++++---
 .../security/capabilities/capabilities.go     | 19 +++++++++++++++
 2 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/libcontainer/nsinit/init.go b/libcontainer/nsinit/init.go
index 8139865..0f1f484 100644
--- a/libcontainer/nsinit/init.go
+++ b/libcontainer/nsinit/init.go
@@ -172,15 +172,33 @@ func setupNetwork(container *libcontainer.Container, context libcontainer.Contex
 // and working dir, and closes any leaky file descriptors
 // before execing the command inside the namespace
 func FinalizeNamespace(container *libcontainer.Container) error {
-	if err := capabilities.DropCapabilities(container); err != nil {
-		return fmt.Errorf("drop capabilities %s", err)
-	}
 	if err := system.CloseFdsFrom(3); err != nil {
 		return fmt.Errorf("close open file descriptors %s", err)
 	}
+
+	// drop capabilities in bounding set before changing user
+	if err := capabilities.DropBoundingSet(container); err != nil {
+		return fmt.Errorf("drop bounding set %s", err)
+	}
+
+	// preserve existing capabilities while we change users
+	if err := system.SetKeepCaps(); err != nil {
+		return fmt.Errorf("set keep caps %s", err)
+	}
+
 	if err := SetupUser(container.User); err != nil {
 		return fmt.Errorf("setup user %s", err)
 	}
+
+	if err := system.ClearKeepCaps(); err != nil {
+		return fmt.Errorf("clear keep caps %s", err)
+	}
+
+	// drop all other capabilities
+	if err := capabilities.DropCapabilities(container); err != nil {
+		return fmt.Errorf("drop capabilities %s", err)
+	}
+
 	if container.WorkingDir != "" {
 		if err := system.Chdir(container.WorkingDir); err != nil {
 			return fmt.Errorf("chdir to %s %s", container.WorkingDir, err)
diff --git a/libcontainer/security/capabilities/capabilities.go b/libcontainer/security/capabilities/capabilities.go
index ba72070..64ea961 100644
--- a/libcontainer/security/capabilities/capabilities.go
+++ b/libcontainer/security/capabilities/capabilities.go
@@ -9,6 +9,25 @@ import (
 
 const allCapabilityTypes = capability.CAPS | capability.BOUNDS
 
+// DropBoundingSet drops the capability bounding set to those specified in the
+// container configuration.
+func DropBoundingSet(container *libcontainer.Container) error {
+	c, err := capability.NewPid(os.Getpid())
+	if err != nil {
+		return err
+	}
+
+	keep := getEnabledCapabilities(container)
+	c.Clear(capability.BOUNDS)
+	c.Set(capability.BOUNDS, keep...)
+
+	if err := c.Apply(capability.BOUNDS); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 // DropCapabilities drops all capabilities for the current process expect those specified in the container configuration.
 func DropCapabilities(container *libcontainer.Container) error {
 	c, err := capability.NewPid(os.Getpid())