Don't set ambient caps; switch to moby/sys/capability #5754
Conversation
|
Ephemeral COPR build failed. @containers/packit-build please check. |
kolyshkin
force-pushed
the
cap
branch
2 times, most recently
from
ccd44dc to
c48ee74
Compare
|
I think I found a bug :) One of the most important fixes in the capability package fork was this one: kolyshkin/capability@4d79446 Essentially, an error from setting ambient capabilities was ignored. Now it is not. Most probably ambient capabilities are set without setting inheritable ones. We found the same issue in runc. |
Right. Added a commit that fixes that. |
kolyshkin
force-pushed
the
cap
branch
2 times, most recently
from
4653d45 to
f4899b2
Compare
kolyshkin
changed the title
|
LGTM |
Ambient capabilities can't be raised without inheritable ones, and since we don't raise inheritable, we should not raise ambient either. This went unnoticed because of a bug in syndtr/gocapability which is only fixed in its fork (see the next commit). Amends commit e7e55c9. Signed-off-by: Kir Kolyshkin <[email protected]>
github.com/moby/sys/capability is a fork of the (no longer maintained) github.com/syndtr/gocapability package. For the list of changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md Signed-off-by: Kir Kolyshkin <[email protected]>
|
LGTM |
|
LGTM, thanks! |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: kolyshkin, nalind The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
github.com/moby/sys/capability is a fork of the (no longer maintained) github.com/syndtr/gocapability package.
For the list of changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md
What type of PR is this?
/kind other
What this PR does / why we need it:
How to verify it
Which issue(s) this PR fixes:
Special notes for your reviewer:
Note that removing the AMBENT caps from chroot is a no-op -- since ambient caps couldn't be set without inheritable, practically they were not set since commit e7e55c9.
See also
Does this PR introduce a user-facing change?