From d940c8e738ce011bbfafdc6ef8af6516f8ee2191 Mon Sep 17 00:00:00 2001 From: Vanient Date: Mon, 6 Jun 2022 20:23:46 +0800 Subject: [PATCH] runc: fix CVE-2022-29162 do not set inheritable capabilities upstream:https://github.com/opencontainers/runc/commit/98fe566c527479195ce3c8167136d2a555fe6b65 Signed-off-by: Vanient --- exec.go | 1 - libcontainer/specconv/example.go | 5 ----- 2 files changed, 6 deletions(-) diff --git a/exec.go b/exec.go index 9ed90ea..5e5ce00 100644 --- a/exec.go +++ b/exec.go @@ -176,7 +176,6 @@ func getProcess(context *cli.Context, bundle string) (*specs.Process, error) { if caps := context.StringSlice("cap"); len(caps) > 0 { for _, c := range caps { p.Capabilities.Bounding = append(p.Capabilities.Bounding, c) - p.Capabilities.Inheritable = append(p.Capabilities.Inheritable, c) p.Capabilities.Effective = append(p.Capabilities.Effective, c) p.Capabilities.Permitted = append(p.Capabilities.Permitted, c) p.Capabilities.Ambient = append(p.Capabilities.Ambient, c) diff --git a/libcontainer/specconv/example.go b/libcontainer/specconv/example.go index 9a4460c..973ea79 100644 --- a/libcontainer/specconv/example.go +++ b/libcontainer/specconv/example.go @@ -46,11 +46,6 @@ func Example() *specs.Spec { "CAP_KILL", "CAP_NET_BIND_SERVICE", }, - Inheritable: []string{ - "CAP_AUDIT_WRITE", - "CAP_KILL", - "CAP_NET_BIND_SERVICE", - }, Ambient: []string{ "CAP_AUDIT_WRITE", "CAP_KILL", -- 2.27.0