diff options
| author | Stefan Hajnoczi <stefanha@redhat.com> | 2020-07-27 20:02:21 +0100 |
|---|---|---|
| committer | Dr. David Alan Gilbert <dgilbert@redhat.com> | 2020-08-28 13:34:52 +0100 |
| commit | 1c7cb1f52e2577e190c09c9a14e6b6f56f4a3ec3 (patch) | |
| tree | 52416a99fdcca726b1dbf76d4b63f02ec9e5651f | |
| parent | e9a78564a12c5cb670c4cbd5398a1ea8cd9ae642 (diff) | |
virtiofsd: drop CAP_DAC_READ_SEARCH
virtiofsd does not need CAP_DAC_READ_SEARCH because it already has
the more powerful CAP_DAC_OVERRIDE. Drop it from the list of
capabilities.
This is important because container runtimes may not include
CAP_DAC_READ_SEARCH by default. This patch allows virtiofsd to reduce
its capabilities when running inside a Docker container.
Note that CAP_DAC_READ_SEARCH may be necessary again in the future if
virtiofsd starts using open_by_handle_at(2).
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Message-Id: <20200727190223.422280-2-stefanha@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| -rw-r--r-- | tools/virtiofsd/passthrough_ll.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c index a9feb90fd0..784330e0e4 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -2596,7 +2596,6 @@ static void setup_capabilities(char *modcaps_in) if (capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE, CAP_CHOWN, CAP_DAC_OVERRIDE, - CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_FSETID, CAP_SETGID, |