Kir Kolyshkin 3e3f96034f runc exec --cap: do not add capabilities to ambient ...

Commit 98fe566c removed setting inheritable capabilities from runc exec
--cap, but neglected to also remove ambient capabilities.

An ambient capability could only be set if the same inheritable
capability is set, so as a result of the above change ambient
capabilities were not set (but due to a bug in gocapability package,
those errors are never reported).

Once we start using a library with the fix [1], that bug will become
apparent. Alas, we do not have any tests for runc exec --cap, so add
one.

Yet, if some inheritable bits are already set from spec, let's set
ambient to avoid a possible regression. Add a test case for that, too.

[1]: https://github.com/kolyshkin/capability/pull/3

Fixes: 98fe566c ("runc: do not set inheritable capabilities")
Co-authored-by: lifubang <lifubang@acmcoder.com>
Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

2024-09-25 21:48:29 -07:00

..

cmd

mv contrib/cmd tests/cmd (except memfd-bind)

2024-08-16 00:55:48 +09:00

fuzzing

tests: Fix fuzzer location in oss-fuzz config

2023-03-23 03:21:17 +08:00

integration

runc exec --cap: do not add capabilities to ambient

2024-09-25 21:48:29 -07:00

rootless.sh

tests/rootless.sh: drop set -x

2023-06-08 09:23:29 -07:00