opensource/podman
1
0
Fork 0
mirror of https://github.com/containers/podman.git synced 2025-05-20 08:36:23 +08:00
Code Issues Packages Projects Releases Wiki Activity

Clarify the docs on DropCapability

Browse Source 
It was a bit unclear what setting it to empty means.

Also, add to the tests verification that this works.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
This commit is contained in:
Alexander Larsson
2022-10-21 08:07:13 +02:00
parent 33eb45c475
commit bac907abf8
2 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
docs/source/markdown/podman-systemd.unit.5.md
View File

@ -126,8 +126,8 @@ setuid and file capabilities.
#### `DropCapability=` (defaults to `all`)
Drop these capabilities from the default container capability set. The default is `all`, allowing
addition of capabilities with `AddCapability`. Set this to empty to drop no capabilities.
Drop these capabilities from the default podman capability set, or `all` for all capabilities. The default if no
`DropCapability` is set is `all`. Set this to empty (i.e. `DropCapability=`) to use the default podman capability set.
This is a space separated list of capabilities. This key can be listed multiple times.

4
test/e2e/quadlet/capabilities.container
View File

@ -1,9 +1,11 @@
## assert-podman-args "--cap-drop=all"
## !assert-podman-args "--cap-drop=all"
## assert-podman-args "--cap-add=cap_dac_override"
## assert-podman-args "--cap-add=cap_audit_write"
## assert-podman-args "--cap-add=cap_ipc_owner"
[Container]
Image=imagename
# Verify that we can reset to the default cap set
DropCapability=
AddCapability=CAP_DAC_OVERRIDE CAP_AUDIT_WRITE
AddCapability=CAP_IPC_OWNER