From ee3625a998badc733dacb03c631ec90170de35fc Mon Sep 17 00:00:00 2001 From: Andrei Vagin Date: Fri, 27 Oct 2023 14:43:28 -0700 Subject: [PATCH] capset doesn't fail if CAP_NET_RAW isn't enabled CAP_NET_RAW is set only if the --net-raw option is set. Some applications such as Docker expect to run with all capabilities, so they can fail if one or more capabilities are not set. PiperOrigin-RevId: 577309869 --- pkg/sentry/kernel/task_identity.go | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/pkg/sentry/kernel/task_identity.go b/pkg/sentry/kernel/task_identity.go index 1de90ea97..67aca0d5e 100644 --- a/pkg/sentry/kernel/task_identity.go +++ b/pkg/sentry/kernel/task_identity.go @@ -359,6 +359,9 @@ func (t *Task) SetExtraGIDs(gids []auth.GID) error { return nil } +// weakCaps is a set of capabilities that can be disabled externally. +var weakCaps = auth.CapabilitySetOf(linux.CAP_NET_RAW) + // SetCapabilitySets attempts to change t's permitted, inheritable, and // effective capability sets. func (t *Task) SetCapabilitySets(permitted, inheritable, effective auth.CapabilitySet) error { @@ -370,6 +373,13 @@ func (t *Task) SetCapabilitySets(permitted, inheritable, effective auth.Capabili return linuxerr.EPERM } creds := t.Credentials() + + // Don't fail if one or more weak capabilities can't be set, just drop them. + mask := (weakCaps & creds.BoundingCaps) | (auth.AllCapabilities &^ weakCaps) + permitted &= mask + inheritable &= mask + effective &= mask + // "It is also a limiting superset for the capabilities that may be added // to the inheritable set by a thread that does not have the CAP_SETPCAP // capability in its effective set."