zishuo/runc
1
0
Fork 0
mirror of https://github.com/opencontainers/runc.git synced 2025-11-01 03:22:38 +08:00
Code Issues Packages Projects Releases Wiki Activity

capabilities: be more graceful in resetting ambient

Browse Source 
Similar to when SetAmbient() can fail, runc should be graceful about
ResetAmbient failing.

This functionality previously worked under gvisor, which doesn't
implement ambient capabilities atm. The hard error on reset broke gvisor
usage.

Signed-off-by: Evan Phoenix <evan@phx.io>
This commit is contained in:
Evan Phoenix
2025-01-19 19:45:59 -08:00
committed by Kir Kolyshkin
parent 71cef22161
commit 54fa0c5577
1 changed files with 8 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
libcontainer/capabilities/capabilities.go
View File

@@ -3,10 +3,12 @@
package capabilities package capabilities
import ( import (
"errors"
"fmt" "fmt"
"sort" "sort"
"strings" "strings"
"sync" "sync"
"syscall"
"github.com/moby/sys/capability" "github.com/moby/sys/capability"
"github.com/opencontainers/runc/libcontainer/configs" "github.com/opencontainers/runc/libcontainer/configs"
@@ -129,9 +131,13 @@ func (c *Caps) ApplyCaps() error {
// don't return any errors, only warn. // don't return any errors, only warn.
ambs := c.caps[capability.AMBIENT] ambs := c.caps[capability.AMBIENT]
err := capability.ResetAmbient() err := capability.ResetAmbient()
if err != nil {
return fmt.Errorf("can't reset ambient capabilities: %w", err) // EINVAL is returned when the kernel doesn't support ambient capabilities.
// We ignore this because runc supports running on older kernels.
if err != nil && !errors.Is(err, syscall.EINVAL) {
return err
} }
for _, a := range ambs { for _, a := range ambs {
err := capability.SetAmbient(true, a) err := capability.SetAmbient(true, a)
if err != nil { if err != nil {