Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[merged] Don't call capset() unless we need to #122

Closed
wants to merge 1 commit into from
Closed

[merged] Don't call capset() unless we need to #122

wants to merge 1 commit into from

Commits on Dec 1, 2016

  1. Don't call capset() unless we need to 

    Fedora runs rpm-ostree (which uses bwrap) in systemd-nspawn (in mock via
`--new-chroot`).  nspawn by default installs a seccomp policy that
denies `capset()`.

This started failing with bubblewrap-0.1.4:
https://pagure.io/releng/issue/6550

The process currently runs as *real* uid 0, outside of a user namespace.
(It's honestly a bit nonsensical for nspawn to give a process `CAP_SYS_ADMIN`
 outside of a userns, but use seccomp to deny `capset()`, but let's leave
 that aside for now.)

Due to the way this code was structured, we set `is_privileged = TRUE`
simply because we have uid 0, even in the Fedora case where we *aren't*
privileged.

Fix this so we only set is_privileged if `uid != euid`, hence we
won't try to gain/drop any capabilities, which fixes compatibility
with what nspawn is doing.

In theory of course we *could* drop privileges in a userns scenario,
but we'd only be dropping privs in our userns...eh.
    @cgwalters
    cgwalters committed Dec 1, 2016
    Configuration menu
    Copy the full SHA
    0b66e9f View commit details
    Browse the repository at this point in the history