Luboslav Pivarc 3aef732e61 Do not drop effective&permitted set ...

Currently moby drops ep sets before the entrypoint is executed.
This does mean that with combination of no-new-privileges the
file capabilities stops working with non-root containers.
This is undesired as the usability of such containers is harmed
comparing to running root containers.

This commit therefore sets the effective/permitted set in order
to allow use of file capabilities or libcap(3)/prctl(2) respectively
with combination of no-new-privileges and without respectively.

For no-new-privileges the container will be able to obtain capabilities
that are requested.

Signed-off-by: Luboslav Pivarc <lpivarc@redhat.com>
Signed-off-by: Bjorn Neergaard <bjorn.neergaard@docker.com>

2023-07-06 13:23:30 -06:00

..

caps

Switch all logging to use containerd log pkg

2023-06-24 00:23:44 +00:00

fixtures

Fix permissions on oci fixtures files

2020-11-27 10:29:47 +07:00

defaults.go

pkg/system: deprecate DefaultPathEnv, move to oci

2022-11-29 17:02:50 +01:00

devices_linux.go

oci: use filepath.WalkDir instead of filepath.Walk

2022-10-09 17:21:04 +02:00

fuzz_test.go

testing: move fuzzers over from OSS-Fuzz

2022-11-30 17:31:03 +01:00

namespaces.go

daemon: ensure OCI options play nicely together

2023-06-06 13:10:05 -04:00

oci_test.go

Fix daemon panic when starting container with invalid device cgroup rule

2021-01-22 16:02:19 +01:00

oci.go

Do not drop effective&permitted set

2023-07-06 13:23:30 -06:00

seccomp_test.go

remove pre-go1.17 build-tags

2023-05-19 20:38:51 +02:00