]> git.ipfire.org Git - thirdparty/lxc.git/commit
don't force dropping capabilities in lxc-init
authorDwight Engen <dwight.engen@oracle.com>
Thu, 19 Jun 2014 13:01:26 +0000 (09:01 -0400)
committerStéphane Graber <stgraber@ubuntu.com>
Fri, 20 Jun 2014 18:07:56 +0000 (14:07 -0400)
commit58558042dcdf042e8956a63dc6af78730800f188
tree2f7ed1be3a285a38b1dcd870f5808560cae460dc
parent99e616a6681f83ac1364d27eface9f0a7bb22527
don't force dropping capabilities in lxc-init

Commit 0af683cf added clearing of capabilities to lxc-init, but only
after lxc_setup_fs() was done, likely so that the mounting done in
that routine wouldn't fail.

However, in my testing lxc_caps_reset() wasn't really effective
anyway since it did not clear the bounding set. Adding prctl
PR_CAPBSET_DROP in a loop from 0 to CAP_LAST_CAP would fix this, but I
don't think its necessary to forcefully clear all capabilities since
users can now specify lxc.cap.keep = none to drop all capabilities.

Signed-off-by: Dwight Engen <dwight.engen@oracle.com>
Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
src/lxc/caps.c
src/lxc/caps.h
src/lxc/lxc_init.c