67 lines
2.7 KiB
Diff
67 lines
2.7 KiB
Diff
From b5ba4b04cef13cbe2d9a0ee9d4781a359fc20f5e Mon Sep 17 00:00:00 2001
|
|
From: bwzhang <zhangbowei@kylinos.cn>
|
|
Date: Mon, 11 Mar 2024 16:12:02 +0800
|
|
Subject: [PATCH] fix CVE-2022-27652
|
|
|
|
---
|
|
server/container_create.go | 15 +++------------
|
|
1 file changed, 3 insertions(+), 12 deletions(-)
|
|
|
|
diff --git a/server/container_create.go b/server/container_create.go
|
|
index 520efc7..7de2676 100644
|
|
--- a/server/container_create.go
|
|
+++ b/server/container_create.go
|
|
@@ -292,6 +292,9 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
|
|
// and pods expect that switching to a non-root user results in the capabilities being
|
|
// dropped. This should be revisited in the future.
|
|
specgen.Config.Process.Capabilities.Ambient = []string{}
|
|
+ // Also remove all inheritable capabilities in accordance with CVE-2022-27652,
|
|
+ // as it's not idiomatic for a manager of processes to set them.
|
|
+ specgen.Config.Process.Capabilities.Inheritable = []string{}
|
|
|
|
if caps == nil {
|
|
return nil
|
|
@@ -329,9 +332,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
|
|
if err := specgen.AddProcessCapabilityEffective(c); err != nil {
|
|
return err
|
|
}
|
|
- if err := specgen.AddProcessCapabilityInheritable(c); err != nil {
|
|
- return err
|
|
- }
|
|
if err := specgen.AddProcessCapabilityPermitted(c); err != nil {
|
|
return err
|
|
}
|
|
@@ -345,9 +345,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
|
|
if err := specgen.DropProcessCapabilityEffective(c); err != nil {
|
|
return err
|
|
}
|
|
- if err := specgen.DropProcessCapabilityInheritable(c); err != nil {
|
|
- return err
|
|
- }
|
|
if err := specgen.DropProcessCapabilityPermitted(c); err != nil {
|
|
return err
|
|
}
|
|
@@ -369,9 +366,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
|
|
if err := specgen.AddProcessCapabilityEffective(capPrefixed); err != nil {
|
|
return err
|
|
}
|
|
- if err := specgen.AddProcessCapabilityInheritable(capPrefixed); err != nil {
|
|
- return err
|
|
- }
|
|
if err := specgen.AddProcessCapabilityPermitted(capPrefixed); err != nil {
|
|
return err
|
|
}
|
|
@@ -388,9 +382,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
|
|
if err := specgen.DropProcessCapabilityEffective(capPrefixed); err != nil {
|
|
return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err)
|
|
}
|
|
- if err := specgen.DropProcessCapabilityInheritable(capPrefixed); err != nil {
|
|
- return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err)
|
|
- }
|
|
if err := specgen.DropProcessCapabilityPermitted(capPrefixed); err != nil {
|
|
return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err)
|
|
}
|
|
--
|
|
2.20.1
|
|
|