From 73849e797f993cabc4cba7ceb989fcbac57f64d8 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 7 Jan 2025 19:32:27 -0800 Subject: [PATCH] libct: simplify Caps inheritance For all other properties that are available in both Config and Process, the merging is performed by newInitConfig. Let's do the same for Capabilities for the sake of code uniformity. Also, thanks to the previous commit, we no longer have to make sure we do not call capabilities.New(nil). Signed-off-by: Kir Kolyshkin --- libcontainer/container_linux.go | 5 ++++- libcontainer/init_linux.go | 8 +------- 2 files changed, 5 insertions(+), 8 deletions(-) diff --git a/libcontainer/container_linux.go b/libcontainer/container_linux.go index 3ee0cb2c2..a0d2ec260 100644 --- a/libcontainer/container_linux.go +++ b/libcontainer/container_linux.go @@ -700,7 +700,7 @@ func (c *Container) newInitConfig(process *Process) *initConfig { GID: process.GID, AdditionalGroups: process.AdditionalGroups, Cwd: process.Cwd, - Capabilities: process.Capabilities, + Capabilities: c.config.Capabilities, PassedFilesCount: len(process.ExtraFiles), ContainerID: c.ID(), NoNewPrivileges: c.config.NoNewPrivileges, @@ -714,6 +714,9 @@ func (c *Container) newInitConfig(process *Process) *initConfig { // Overwrite config properties with ones from process. + if process.Capabilities != nil { + cfg.Capabilities = process.Capabilities + } if process.NoNewPrivileges != nil { cfg.NoNewPrivileges = *process.NoNewPrivileges } diff --git a/libcontainer/init_linux.go b/libcontainer/init_linux.go index fba9bb32c..11a9069d8 100644 --- a/libcontainer/init_linux.go +++ b/libcontainer/init_linux.go @@ -322,13 +322,7 @@ func finalizeNamespace(config *initConfig) error { } } - caps := &configs.Capabilities{} - if config.Capabilities != nil { - caps = config.Capabilities - } else if config.Config.Capabilities != nil { - caps = config.Config.Capabilities - } - w, err := capabilities.New(caps) + w, err := capabilities.New(config.Capabilities) if err != nil { return err }