fix: don't attempt to set unavailable capabilities in privileged mode#42911
fix: don't attempt to set unavailable capabilities in privileged mode#42911smira wants to merge 1 commit intomoby:masterfrom
Conversation
Fixes moby#42906 Signed-off-by: Andrey Smirnov <[email protected]>
|
FWIW, I also opened a PR for consideration in runc (opencontainers/runc#3240), to make it match the runtime spec (opencontainers/runc#2854) |
|
@theJeztah this looks like much better solution, thanks! |
|
I marked this PR as draft, as it works for |
Thanks! I was also considering situations where |
| capabilityList[capName] = &c | ||
| cc := capability.Cap(i) | ||
|
|
||
| capabilityList[c] = &cc |
There was a problem hiding this comment.
Should this be using capName as key?
|
Pending the discussion on the runc repository, I opened #42933, which ~ does the same as this PR (with some changes) |
|
thanks @thaJeztah it looks much better than my draft, so I'm going to close it. |
3 participants
fixes #42906
Signed-off-by: Andrey Smirnov [email protected]
- What I did
Filtering capabilities via the
dockerdprocess capabilities.- How I did it
- How to verify it
There should be no changes if
dockerdruns with full caps.But if the
dockerdcapabilities are reduced,docker run --privileged <anything>fails withapply caps: not permitted.- Description for the changelog
Set only available capabilities when container runs in --privileged mode.
- A picture of a cute animal (not mandatory but encouraged)