From b5ba4b04cef13cbe2d9a0ee9d4781a359fc20f5e Mon Sep 17 00:00:00 2001 From: bwzhang Date: Mon, 11 Mar 2024 16:12:02 +0800 Subject: [PATCH] fix CVE-2022-27652 --- server/container_create.go | 15 +++------------ 1 file changed, 3 insertions(+), 12 deletions(-) diff --git a/server/container_create.go b/server/container_create.go index 520efc7..7de2676 100644 --- a/server/container_create.go +++ b/server/container_create.go @@ -292,6 +292,9 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa // and pods expect that switching to a non-root user results in the capabilities being // dropped. This should be revisited in the future. specgen.Config.Process.Capabilities.Ambient = []string{} + // Also remove all inheritable capabilities in accordance with CVE-2022-27652, + // as it's not idiomatic for a manager of processes to set them. + specgen.Config.Process.Capabilities.Inheritable = []string{} if caps == nil { return nil @@ -329,9 +332,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa if err := specgen.AddProcessCapabilityEffective(c); err != nil { return err } - if err := specgen.AddProcessCapabilityInheritable(c); err != nil { - return err - } if err := specgen.AddProcessCapabilityPermitted(c); err != nil { return err } @@ -345,9 +345,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa if err := specgen.DropProcessCapabilityEffective(c); err != nil { return err } - if err := specgen.DropProcessCapabilityInheritable(c); err != nil { - return err - } if err := specgen.DropProcessCapabilityPermitted(c); err != nil { return err } @@ -369,9 +366,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa if err := specgen.AddProcessCapabilityEffective(capPrefixed); err != nil { return err } - if err := specgen.AddProcessCapabilityInheritable(capPrefixed); err != nil { - return err - } if err := specgen.AddProcessCapabilityPermitted(capPrefixed); err != nil { return err } @@ -388,9 +382,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa if err := specgen.DropProcessCapabilityEffective(capPrefixed); err != nil { return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err) } - if err := specgen.DropProcessCapabilityInheritable(capPrefixed); err != nil { - return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err) - } if err := specgen.DropProcessCapabilityPermitted(capPrefixed); err != nil { return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err) } -- 2.20.1