From 74f0f2289b0bd28afd1f64905386371c6023b7a7 Mon Sep 17 00:00:00 2001 From: Kir Kolyshkin Date: Tue, 6 Aug 2024 10:44:25 -0700 Subject: [PATCH] runc spec, libct/int: do not add ambient capabilities Commit 98fe566c removed inheritable capabilities from the example spec (used by runc spec) and from the libcontainer/integration test config, but neglected to also remove ambient capabilities. An ambient capability could only be set if the same inheritable capability is set, so as a result of the above change ambient capabilities were not set (but due to a bug in gocapability package, those errors are never reported). Once we start using a library with the fix [1], that bug will become apparent (both bats-based and libct/int tests will fail). [1]: https://github.com/kolyshkin/capability/pull/3 Fixes: 98fe566c ("runc: do not set inheritable capabilities") Signed-off-by: Kir Kolyshkin --- libcontainer/integration/template_test.go | 16 ---------------- libcontainer/specconv/example.go | 5 ----- 2 files changed, 21 deletions(-) diff --git a/libcontainer/integration/template_test.go b/libcontainer/integration/template_test.go index 63c46b28fae..473f601ed49 100644 --- a/libcontainer/integration/template_test.go +++ b/libcontainer/integration/template_test.go @@ -75,22 +75,6 @@ func newTemplateConfig(t *testing.T, p *tParam) *configs.Config { "CAP_KILL", "CAP_AUDIT_WRITE", }, - Ambient: []string{ - "CAP_CHOWN", - "CAP_DAC_OVERRIDE", - "CAP_FSETID", - "CAP_FOWNER", - "CAP_MKNOD", - "CAP_NET_RAW", - "CAP_SETGID", - "CAP_SETUID", - "CAP_SETFCAP", - "CAP_SETPCAP", - "CAP_NET_BIND_SERVICE", - "CAP_SYS_CHROOT", - "CAP_KILL", - "CAP_AUDIT_WRITE", - }, Effective: []string{ "CAP_CHOWN", "CAP_DAC_OVERRIDE", diff --git a/libcontainer/specconv/example.go b/libcontainer/specconv/example.go index 152d938a50a..1e9cfa2dbfe 100644 --- a/libcontainer/specconv/example.go +++ b/libcontainer/specconv/example.go @@ -41,11 +41,6 @@ func Example() *specs.Spec { "CAP_KILL", "CAP_NET_BIND_SERVICE", }, - Ambient: []string{ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - }, Effective: []string{ "CAP_AUDIT_WRITE", "CAP_KILL",