mirror of
https://passt.top/passt
synced 2025-06-11 18:15:34 +02:00
isolation: Replace drop_caps() with a version that actually does something
The current implementation of drop_caps() doesn't really work because it attempts to drop capabilities from the bounding set. That's not the set that really matters, it's about limiting the abilities of things we might later exec() rather than our own capabilities. It also requires CAP_SETPCAP which we won't usually have. Replace it with a new version which uses setcap(2) to drop capabilities from the effective and permitted sets. For now we leave the inheritable set as is, since we don't want to preclude the user from passing inheritable capabilities to the command spawed by pasta. Correctly dropping caps reveals that we were relying on some capabilities we'd supposedly dropped. Re-divide the dropping of capabilities between isolate_initial(), isolate_user() and isolate_prefork() to make this work. Signed-off-by: David Gibson <david@gibson.dropbear.id.au> Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
This commit is contained in:
parent
ceb2061587
commit
c22ebccba8
3 changed files with 92 additions and 11 deletions
2
conf.c
2
conf.c
|
@ -1547,7 +1547,7 @@ void conf(struct ctx *c, int argc, char **argv)
|
|||
usage(argv[0]);
|
||||
}
|
||||
|
||||
isolate_user(uid, gid, !netns_only, userns);
|
||||
isolate_user(uid, gid, !netns_only, userns, c->mode);
|
||||
|
||||
if (c->pasta_conf_ns)
|
||||
c->no_ra = 1;
|
||||
|
|
Loading…
Add table
Add a link
Reference in a new issue