From 0034f40b67aaaf4b26f0852bc02bf44b459a8120 Mon Sep 17 00:00:00 2001 From: Peng Tao Date: Wed, 13 Oct 2021 15:46:45 +0800 Subject: [PATCH] agent: exec should inherit container process capabilities Otherwise rustjail would not set its capabilities and it ends up getting all capabilities. Fixes: #2828 Signed-off-by: Peng Tao --- src/agent/rustjail/src/container.rs | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/src/agent/rustjail/src/container.rs b/src/agent/rustjail/src/container.rs index b9bf964486..f422599f2c 100644 --- a/src/agent/rustjail/src/container.rs +++ b/src/agent/rustjail/src/container.rs @@ -833,6 +833,20 @@ impl BaseContainer for LinuxContainer { } let linux = spec.linux.as_ref().unwrap(); + if p.oci.capabilities.is_none() { + // No capabilities, inherit from container process + let process = spec + .process + .as_ref() + .ok_or_else(|| anyhow!("no process config"))?; + p.oci.capabilities = Some( + process + .capabilities + .clone() + .ok_or_else(|| anyhow!("missing process capabilities"))?, + ); + } + let (pfd_log, cfd_log) = unistd::pipe().context("failed to create pipe")?; let _ = fcntl::fcntl(pfd_log, FcntlArg::F_SETFD(FdFlag::FD_CLOEXEC))