netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Drop capabilities when they are not needed

Browse Source 
Without this fix, the sandbox process continues running with CAP_SYS_ADMIN
and CAP_CHROOT:
CapInh:	0000000000240000
CapPrm:	0000000000240000
CapEff:	0000000000240000
CapBnd:	000001ffffffffff
CapAmb:	0000000000240000

We need to add CAP_SETPCAP to be able to clean the bounding set.
Unfortunately, gocapability doesn't report an error in this case:
https://github.com/syndtr/gocapability/blob/master/capability/capability_linux.go#L446

PiperOrigin-RevId: 532214156
This commit is contained in:
Andrei Vagin
2023-05-15 13:53:53 -07:00
committed by gVisor bot
parent c3abb8c00a
commit ef20c9dc19
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/cmd/cmd.go
+4
View File
@@ -89,6 +89,10 @@ func callSelfAsNobody(args []string) error {
if _, _, err := unix.RawSyscall(unix.SYS_SETUID, uintptr(nobody), 0, 0); err != 0 {
return fmt.Errorf("error setting gid: %v", err)
}
// Drop all capabilities.
if err := applyCaps(&specs.LinuxCapabilities{}); err != nil {
return fmt.Errorf("error dropping capabilities: %w", err)
}
binPath := specutils.ExePath
runsc/sandbox/sandbox.go
+6 -1
View File
@@ -881,7 +881,12 @@ func (s *Sandbox) createSandboxProcess(conf *config.Config, args *Args, startSyn
// A sandbox process will construct an empty root for itself, so it has
// to have CAP_SYS_ADMIN and CAP_SYS_CHROOT capabilities.
cmd.SysProcAttr.AmbientCaps = append(cmd.SysProcAttr.AmbientCaps, uintptr(capability.CAP_SYS_ADMIN), uintptr(capability.CAP_SYS_CHROOT))
cmd.SysProcAttr.AmbientCaps = append(cmd.SysProcAttr.AmbientCaps,
uintptr(capability.CAP_SYS_ADMIN),
uintptr(capability.CAP_SYS_CHROOT),
// CAP_SETPCAP is required to clear the bounding set.
uintptr(capability.CAP_SETPCAP),
)
} else {
return fmt.Errorf("can't run sandbox process as user nobody since we don't have CAP_SETUID or CAP_SETGID")