opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-08-06 19:44:14 +08:00
Code Issues Packages Projects Releases Wiki Activity

Properly handle --cap-add all when running with a --user flag

Browse Source 
Handle the ALL Flag when running with an account as a user.

Currently we throw an error when the user specifies

podman run --user bin --cap-add all fedora echo hello

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2020-12-09 14:13:53 -05:00
parent 9abbe0728c
commit 1ace9e3ba6
2 changed files with 13 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
pkg/specgen/generate/security.go
View File

@ -141,7 +141,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
configSpec.Process.Capabilities.Effective = caplist configSpec.Process.Capabilities.Effective = caplist
configSpec.Process.Capabilities.Permitted = caplist configSpec.Process.Capabilities.Permitted = caplist
} else { } else {
userCaps, err := capabilities.NormalizeCapabilities(s.CapAdd) userCaps, err := capabilities.MergeCapabilities(nil, s.CapAdd, nil)
if err != nil { if err != nil {
return errors.Wrapf(err, "capabilities requested by user are not valid: %q", strings.Join(s.CapAdd, ",")) return errors.Wrapf(err, "capabilities requested by user are not valid: %q", strings.Join(s.CapAdd, ","))
} }

12
test/e2e/run_privileged_test.go
View File

@ -90,6 +90,18 @@ var _ = Describe("Podman privileged container tests", func() {
containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString()) containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString())
}) })
It("podman cap-add CapEff with --user", func() {
// Get caps of current process
host_cap := SystemExec("awk", []string{"/^CapEff/ { print $2 }", "/proc/self/status"})
Expect(host_cap.ExitCode()).To(Equal(0))
session := podmanTest.Podman([]string{"run", "--user=bin", "--cap-add", "all", "busybox", "awk", "/^CapEff/ { print $2 }", "/proc/self/status"})
session.WaitWithDefaultTimeout()
Expect(session.ExitCode()).To(Equal(0))
containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString())
})
It("podman cap-drop CapEff", func() { It("podman cap-drop CapEff", func() {
session := podmanTest.Podman([]string{"run", "--cap-drop", "all", "busybox", "grep", "CapEff", "/proc/self/status"}) session := podmanTest.Podman([]string{"run", "--cap-drop", "all", "busybox", "grep", "CapEff", "/proc/self/status"})
session.WaitWithDefaultTimeout() session.WaitWithDefaultTimeout()