From 444cc2989aca50986b45a56bfd8a32bd7ea23c1c Mon Sep 17 00:00:00 2001 From: Andrey Vagin Date: Tue, 27 Jan 2015 14:00:15 +0300 Subject: [PATCH] namespaces: allow to use pid namespace without mount namespace The gocapability package uses /proc/PID/status to get a bounding set. If a container uses pidns without mntns, it sees /proc from the host namespace, but the process doesn't know its own pid in this namespace. In this case it can use /proc/self/status, which is always the right one. Signed-off-by: Andrew Vagin --- security/capabilities/capabilities.go | 6 ++---- update-vendor.sh | 2 +- 2 files changed, 3 insertions(+), 5 deletions(-) diff --git a/security/capabilities/capabilities.go b/security/capabilities/capabilities.go index 7aef5fa67..e01464fdb 100644 --- a/security/capabilities/capabilities.go +++ b/security/capabilities/capabilities.go @@ -1,8 +1,6 @@ package capabilities import ( - "os" - "github.com/syndtr/gocapability/capability" ) @@ -11,7 +9,7 @@ const allCapabilityTypes = capability.CAPS | capability.BOUNDS // DropBoundingSet drops the capability bounding set to those specified in the // container configuration. func DropBoundingSet(capabilities []string) error { - c, err := capability.NewPid(os.Getpid()) + c, err := capability.NewPid(0) if err != nil { return err } @@ -29,7 +27,7 @@ func DropBoundingSet(capabilities []string) error { // DropCapabilities drops all capabilities for the current process except those specified in the container configuration. func DropCapabilities(capList []string) error { - c, err := capability.NewPid(os.Getpid()) + c, err := capability.NewPid(0) if err != nil { return err } diff --git a/update-vendor.sh b/update-vendor.sh index 15bae1858..6f61083cb 100755 --- a/update-vendor.sh +++ b/update-vendor.sh @@ -43,6 +43,6 @@ clone() { clone git github.com/codegangsta/cli 1.1.0 clone git github.com/coreos/go-systemd v2 clone git github.com/godbus/dbus v2 -clone git github.com/syndtr/gocapability 3c85049eae +clone git github.com/syndtr/gocapability 1cf3ac4dc4 # intentionally not vendoring Docker itself... that'd be a circle :)