opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-11-01 22:32:50 +08:00
Code Issues Packages Projects Releases Wiki Activity

In podman 1.* regression on --cap-add

Browse Source 
In podman 1.0 if  you executed a command like:

podman run --user dwalsh --cap-add net_bind_service alpine nc -l 80

It would work, and the user dwalsh would get the capability,  in
podman 2.0, only root and the binding set gets the capability.

This change restores us back to the way podman 1.0 worked.
Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
This commit is contained in:
Daniel J Walsh
2020-08-17 06:28:45 -04:00
parent 516196f096
commit 3848cac860
51 changed files with 630 additions and 332 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
vendor/github.com/containers/common/pkg/capabilities/capabilities.go generated vendored
View File

@ -57,9 +57,9 @@ func AllCapabilities() []string {
return capabilityList
}
// normalizeCapabilities normalizes caps by adding a "CAP_" prefix (if not yet
// NormalizeCapabilities normalizes caps by adding a "CAP_" prefix (if not yet
// present).
func normalizeCapabilities(caps []string) ([]string, error) {
func NormalizeCapabilities(caps []string) ([]string, error) {
normalized := make([]string, len(caps))
for i, c := range caps {
c = strings.ToUpper(c)
@ -98,7 +98,7 @@ func MergeCapabilities(base, adds, drops []string) ([]string, error) {
var caps []string
// Normalize the base capabilities
base, err := normalizeCapabilities(base)
base, err := NormalizeCapabilities(base)
if err != nil {
return nil, err
}
@ -106,11 +106,11 @@ func MergeCapabilities(base, adds, drops []string) ([]string, error) {
// Nothing to tweak; we're done
return base, nil
}
capDrop, err := normalizeCapabilities(drops)
capDrop, err := NormalizeCapabilities(drops)
if err != nil {
return nil, err
}
capAdd, err := normalizeCapabilities(adds)
capAdd, err := NormalizeCapabilities(adds)
if err != nil {
return nil, err
}