Skip to content

Commit e1635d5

Browse files
kolyshkinkolyshkin
authored
Merge pull request #4367 from kolyshkin/ambient-caps
Don't set ambient caps without inheritable ones
2 parents 8e03054 + 7a44910 commit e1635d5

File tree

5 files changed

+69
-74
lines changed

5 files changed

+69
-74
lines changed

‎exec.go

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -234,7 +234,12 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) {
234234
p.Capabilities.Bounding = append(p.Capabilities.Bounding, c)
235235
p.Capabilities.Effective = append(p.Capabilities.Effective, c)
236236
p.Capabilities.Permitted = append(p.Capabilities.Permitted, c)
237-
p.Capabilities.Ambient = append(p.Capabilities.Ambient, c)
237+
// Since ambient capabilities can't be set without inherritable,
238+
// and runc exec --cap don't set inheritable, let's only set
239+
// ambient if we already have some inheritable bits set from spec.
240+
if p.Capabilities.Inheritable != nil {
241+
p.Capabilities.Ambient = append(p.Capabilities.Ambient, c)
242+
}
238243
}
239244
}
240245
// append the passed env variables

‎libcontainer/README.md

Lines changed: 0 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -59,66 +59,14 @@ config := &configs.Config{
5959
Rootfs: "/your/path/to/rootfs",
6060
Capabilities: &configs.Capabilities{
6161
Bounding: []string{
62-
"CAP_CHOWN",
63-
"CAP_DAC_OVERRIDE",
64-
"CAP_FSETID",
65-
"CAP_FOWNER",
66-
"CAP_MKNOD",
67-
"CAP_NET_RAW",
68-
"CAP_SETGID",
69-
"CAP_SETUID",
70-
"CAP_SETFCAP",
71-
"CAP_SETPCAP",
72-
"CAP_NET_BIND_SERVICE",
73-
"CAP_SYS_CHROOT",
7462
"CAP_KILL",
7563
"CAP_AUDIT_WRITE",
7664
},
7765
Effective: []string{
78-
"CAP_CHOWN",
79-
"CAP_DAC_OVERRIDE",
80-
"CAP_FSETID",
81-
"CAP_FOWNER",
82-
"CAP_MKNOD",
83-
"CAP_NET_RAW",
84-
"CAP_SETGID",
85-
"CAP_SETUID",
86-
"CAP_SETFCAP",
87-
"CAP_SETPCAP",
88-
"CAP_NET_BIND_SERVICE",
89-
"CAP_SYS_CHROOT",
9066
"CAP_KILL",
9167
"CAP_AUDIT_WRITE",
9268
},
9369
Permitted: []string{
94-
"CAP_CHOWN",
95-
"CAP_DAC_OVERRIDE",
96-
"CAP_FSETID",
97-
"CAP_FOWNER",
98-
"CAP_MKNOD",
99-
"CAP_NET_RAW",
100-
"CAP_SETGID",
101-
"CAP_SETUID",
102-
"CAP_SETFCAP",
103-
"CAP_SETPCAP",
104-
"CAP_NET_BIND_SERVICE",
105-
"CAP_SYS_CHROOT",
106-
"CAP_KILL",
107-
"CAP_AUDIT_WRITE",
108-
},
109-
Ambient: []string{
110-
"CAP_CHOWN",
111-
"CAP_DAC_OVERRIDE",
112-
"CAP_FSETID",
113-
"CAP_FOWNER",
114-
"CAP_MKNOD",
115-
"CAP_NET_RAW",
116-
"CAP_SETGID",
117-
"CAP_SETUID",
118-
"CAP_SETFCAP",
119-
"CAP_SETPCAP",
120-
"CAP_NET_BIND_SERVICE",
121-
"CAP_SYS_CHROOT",
12270
"CAP_KILL",
12371
"CAP_AUDIT_WRITE",
12472
},

‎libcontainer/integration/template_test.go

Lines changed: 0 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -75,22 +75,6 @@ func newTemplateConfig(t *testing.T, p *tParam) *configs.Config {
7575
"CAP_KILL",
7676
"CAP_AUDIT_WRITE",
7777
},
78-
Ambient: []string{
79-
"CAP_CHOWN",
80-
"CAP_DAC_OVERRIDE",
81-
"CAP_FSETID",
82-
"CAP_FOWNER",
83-
"CAP_MKNOD",
84-
"CAP_NET_RAW",
85-
"CAP_SETGID",
86-
"CAP_SETUID",
87-
"CAP_SETFCAP",
88-
"CAP_SETPCAP",
89-
"CAP_NET_BIND_SERVICE",
90-
"CAP_SYS_CHROOT",
91-
"CAP_KILL",
92-
"CAP_AUDIT_WRITE",
93-
},
9478
Effective: []string{
9579
"CAP_CHOWN",
9680
"CAP_DAC_OVERRIDE",

‎libcontainer/specconv/example.go

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,11 +41,6 @@ func Example() *specs.Spec {
4141
"CAP_KILL",
4242
"CAP_NET_BIND_SERVICE",
4343
},
44-
Ambient: []string{
45-
"CAP_AUDIT_WRITE",
46-
"CAP_KILL",
47-
"CAP_NET_BIND_SERVICE",
48-
},
4944
Effective: []string{
5045
"CAP_AUDIT_WRITE",
5146
"CAP_KILL",

‎tests/integration/capabilities.bats

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,3 +53,66 @@ function teardown() {
5353
[[ "${output}" == *"CapPrm: 0000000000200000"* ]]
5454
[[ "${output}" == *"NoNewPrivs: 1"* ]]
5555
}
56+
57+
@test "runc exec --cap" {
58+
update_config ' .process.args = ["/bin/sh"]
59+
| .process.capabilities = {}'
60+
runc run -d --console-socket "$CONSOLE_SOCKET" test_exec_cap
61+
[ "$status" -eq 0 ]
62+
63+
runc exec test_exec_cap cat /proc/self/status
64+
[ "$status" -eq 0 ]
65+
# Check no capabilities are set.
66+
[[ "${output}" == *"CapInh: 0000000000000000"* ]]
67+
[[ "${output}" == *"CapPrm: 0000000000000000"* ]]
68+
[[ "${output}" == *"CapEff: 0000000000000000"* ]]
69+
[[ "${output}" == *"CapBnd: 0000000000000000"* ]]
70+
[[ "${output}" == *"CapAmb: 0000000000000000"* ]]
71+
72+
runc exec --cap CAP_KILL --cap CAP_AUDIT_WRITE test_exec_cap cat /proc/self/status
73+
[ "$status" -eq 0 ]
74+
# Check capabilities are added into bounding/effective/permitted only,
75+
# but not to inheritable or ambient.
76+
#
77+
# CAP_KILL is 5, the bit mask is 0x20 (1 << 5).
78+
# CAP_AUDIT_WRITE is 26, the bit mask is 0x20000000 (1 << 26).
79+
[[ "${output}" == *"CapInh: 0000000000000000"* ]]
80+
[[ "${output}" == *"CapPrm: 0000000020000020"* ]]
81+
[[ "${output}" == *"CapEff: 0000000020000020"* ]]
82+
[[ "${output}" == *"CapBnd: 0000000020000020"* ]]
83+
[[ "${output}" == *"CapAmb: 0000000000000000"* ]]
84+
}
85+
86+
@test "runc exec --cap [ambient is set from spec]" {
87+
update_config ' .process.args = ["/bin/sh"]
88+
| .process.capabilities.inheritable = ["CAP_CHOWN", "CAP_SYSLOG"]
89+
| .process.capabilities.permitted = ["CAP_KILL", "CAP_CHOWN"]
90+
| .process.capabilities.effective = ["CAP_KILL"]
91+
| .process.capabilities.bounding = ["CAP_KILL", "CAP_CHOWN", "CAP_SYSLOG"]
92+
| .process.capabilities.ambient = ["CAP_CHOWN"]'
93+
runc run -d --console-socket "$CONSOLE_SOCKET" test_some_caps
94+
[ "$status" -eq 0 ]
95+
96+
runc exec test_some_caps cat /proc/self/status
97+
[ "$status" -eq 0 ]
98+
# Check that capabilities are as set in spec.
99+
#
100+
# CAP_CHOWN is 0, the bit mask is 0x1 (1 << 0)
101+
# CAP_KILL is 5, the bit mask is 0x20 (1 << 5).
102+
# CAP_SYSLOG is 34, the bit mask is 0x400000000 (1 << 34).
103+
[[ "${output}" == *"CapInh: 0000000400000001"* ]]
104+
[[ "${output}" == *"CapPrm: 0000000000000021"* ]]
105+
[[ "${output}" == *"CapEff: 0000000000000021"* ]]
106+
[[ "${output}" == *"CapBnd: 0000000400000021"* ]]
107+
[[ "${output}" == *"CapAmb: 0000000000000001"* ]]
108+
109+
# Check that if config.json has an inheritable capability set,
110+
# runc exec --cap adds ambient capabilities.
111+
runc exec --cap CAP_SYSLOG test_some_caps cat /proc/self/status
112+
[ "$status" -eq 0 ]
113+
[[ "${output}" == *"CapInh: 0000000400000001"* ]]
114+
[[ "${output}" == *"CapPrm: 0000000400000021"* ]]
115+
[[ "${output}" == *"CapEff: 0000000400000021"* ]]
116+
[[ "${output}" == *"CapBnd: 0000000400000021"* ]]
117+
[[ "${output}" == *"CapAmb: 0000000400000001"* ]]
118+
}

0 commit comments

Comments
 (0)