Repository navigation
[release-1.0] Cherry-pick #3487: Unknown Linux capability names in an ActorTemplate are rejected at admission - #3514
Merged
Dmitry Berkovich (dberkov) merged 1 commit intoOct 31, 2026
Conversation
…ected at admission (agent-substrate#3487) Part of agent-substrate#3226. We only checked the shape of capability names, so a typo passed admission. In `add` it failed at actor start, and on microVM kata-agent panics converting it ([trans.rs](https://github.com/kata-containers/kata-containers/blob/03cf2ec06a5d302f23af811744f6bcea49988bfb/src/libs/protocols/src/trans.rs#L40-L52)). In `drop` it was ignored, so `drop: [NET_BIND_SERVIC]` kept `NET_BIND_SERVICE`. Names are now checked against the 41 Linux capabilities, the same set runsc ([specutils.go](https://github.com/google/gvisor/blob/760b80785dc53311d4c87bd2de167525a99709c1/runsc/specutils/specutils.go#L510-L552)) and kata's oci-spec ([capability.rs](https://github.com/youki-dev/oci-spec-rs/blob/1cc1afb0e9a68403d8fb5bde1a3d05db968f41d3/src/runtime/capability.rs#L26-L520)) accept. atelet runs the same check on Run and Restore. AI use: AI-assisted, I reviewed it. Breaking change: a template with an unknown name in `drop` is now rejected, check `drop` lists for typos. Unknown names in `add` already failed at actor start. - [x] Tests pass - [x] Docs updated --------- Signed-off-by: Benjamin Elder <[email protected]> (cherry picked from commit 75a061c) Signed-off-by: Benjamin Elder <[email protected]>
Benjamin Elder (BenTheElder)
added
area/api
Dmitry Berkovich (dberkov)
merged commit Oct 31, 2026
7b5023d
into
agent-substrate:release-1.0
9 checks passed
16 of 23 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cherry-pick of #3487 onto
release-1.0(git cherry-pick -xof the squash commit), it applied cleanly with no changes.Capability names in
addanddropare checked against the 41 Linux capabilities at admission, and atelet runs the same check on Run and Restore. Before, a typo inaddfailed at actor start and a typo indropwas ignored. Part of #3226.AI use: AI-assisted. Clean pick.
This carries the same breaking change as #3487: a template with an unknown name in
dropis now rejected, checkdroplists for typos. Unknown names inaddalready failed at actor start.