Skip to content

Commit b61c1db

Browse files
fix: allow CAP_CHOWN in Ambient set
1 parent 77bbf4c commit b61c1db

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

internal/pkg/agent/cmd/container_init_linux.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -120,7 +120,7 @@ func getAmbientCapabilitiesFromEffectiveSet() ([]cap.Value, error) {
120120
for capVal := cap.Value(0); capVal < cap.MaxBits(); capVal++ {
121121

122122
switch capVal {
123-
case cap.CHOWN, cap.SETPCAP, cap.SETFCAP:
123+
case cap.SETPCAP, cap.SETFCAP:
124124
// don't set these as they shouldn't be required by any exec'ed child process
125125
continue
126126
default:

internal/pkg/agent/cmd/container_init_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -173,13 +173,13 @@ func Test_getAmbientCapabilitiesFromEffectiveSet(t *testing.T) {
173173
}{
174174
{
175175
name: "no ambient caps",
176-
procCaps: []cap.Value{cap.CHOWN, cap.SETPCAP, cap.SETFCAP},
176+
procCaps: []cap.Value{cap.SETPCAP, cap.SETFCAP},
177177
expectedCaps: []cap.Value(nil),
178178
},
179179
{
180180
name: "no ambient caps",
181181
procCaps: []cap.Value{cap.CHOWN, cap.SETPCAP, cap.SETFCAP, cap.BPF},
182-
expectedCaps: []cap.Value{cap.BPF},
182+
expectedCaps: []cap.Value{cap.CHOWN, cap.BPF},
183183
},
184184
}
185185

0 commit comments

Comments
 (0)