vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

SETUID/SETGID not required for changing user

Browse source 
It is no longer necessary to pass "SETUID" or "SETGID" capabilities to
the container when a "user" is specified in the config.

Docker-DCO-1.1-Signed-off-by: Bernerd Schaefer <bj.schaefer@gmail.com> (github: bernerdschaefer)
This commit is contained in:
Bernerd Schaefer 2014-05-28 16:41:48 +02:00
parent b6ee193b8e
commit 906451091d
2 changed files with 40 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

19
libcontainer/security/capabilities/capabilities.go
View file

@ -9,6 +9,25 @@ import (
const allCapabilityTypes = capability.CAPS | capability.BOUNDS
// DropBoundingSet drops the capability bounding set to those specified in the
// container configuration.
func DropBoundingSet(container *libcontainer.Container) error {
c, err := capability.NewPid(os.Getpid())
if err != nil {
return err
}
keep := getEnabledCapabilities(container)
c.Clear(capability.BOUNDS)
c.Set(capability.BOUNDS, keep...)
if err := c.Apply(capability.BOUNDS); err != nil {
return err
}
return nil
}
// DropCapabilities drops all capabilities for the current process expect those specified in the container configuration.
func DropCapabilities(container *libcontainer.Container) error {
c, err := capability.NewPid(os.Getpid())