SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

systemd-nspawn: Allow setting ambient capability set

Browse Source 
The old code was only able to pass the value 0 for the inheritable
and ambient capability set when a non-root user was specified.

However, sometimes it is useful to run a program in its own container
with a user specification and some capabilities set. This is needed
when the capabilities cannot be provided by file capabilities (because
the file system is mounted with MS_NOSUID for additional security).

This commit introduces the option --ambient-capability and the config
file option AmbientCapability=. Both are used in a similar way to the
existing Capability= setting. It changes the inheritable and ambient
set (which is 0 by default). The code also checks that the settings
for the bounding set (as defined by Capability= and DropCapability=)
and the setting for the ambient set (as defined by AmbientCapability=)
are compatible. Otherwise, the operation would fail in any way.

Due to the current use of -1 to indicate no support for ambient
capability set the special value "all" cannot be supported.

Also, the setting of ambient capability is restricted to running a
single program in the container payload.
This commit is contained in:
Torsten Hilbrich
2020-12-07 19:56:59 +01:00
committed by Zbigniew Jędrzejewski-Szmek
parent bf20d93750
commit 88fc9c9bad
5 changed files with 100 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/systemd-nspawn.xml
+31 -2
View File
@@ -1002,7 +1002,11 @@
If the special value <literal>all</literal> is passed, all capabilities are retained.</para>
<para>If the special value of <literal>help</literal> is passed, the program will print known
capability names and exit.</para></listitem>
capability names and exit.</para>
<para>This option sets the bounding set of capabilities which
also limits the ambient capabilities as given with the
<option>--ambient-capability=</option>.</para></listitem>
</varlistentry>
<varlistentry>
@@ -1014,7 +1018,32 @@
above).</para>
<para>If the special value of <literal>help</literal> is passed, the program will print known
capability names and exit.</para></listitem>
capability names and exit.</para>
<para>This option sets the bounding set of capabilities which
also limits the ambient capabilities as given with the
<option>--ambient-capability=</option>.</para></listitem>
</varlistentry>
<varlistentry>
<term><option>--ambient-capability=</option></term>
<listitem><para>Specify one or more additional capabilities to
pass in the inheritable and ambient set to the program started
within the container. The value <literal>all</literal> is not
supported for this setting.</para>
<para>All capabilities specified here must be in the set
allowed with the <option>--capability=</option> and
<option>--drop-capability=</option> options. Otherwise, an
error message will be shown.</para>
<para>This option cannot be combined with the boot mode of the
container (as requested via <option>--boot</option>).</para>
<para>If the special value of <literal>help</literal> is
passed, the program will print known capability names and
exit.</para></listitem>
</varlistentry>
<varlistentry>