1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Commit graph

6 commits

Author SHA1 Message Date
Michael Crosby
9e3da87a3a Cleanup some statements from exec driver work
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-02-14 17:28:50 -08:00
Michael Crosby
3c215ba410 Merge pull request #4059 from alexlarsson/no-netadmin-caps
lxc: Drop NET_ADMIN capability in non-privileged containers
2014-02-11 14:20:34 -05:00
Alexander Larsson
02fddffd51 lxc: Drop NET_ADMIN capability in non-privileged containers
With this capability set the container can e.g. change the ip address
of his devices to that of another container on the docker0 bridge. In
a quick test I was able to listen to a port on a different ip than the
one docker assigned me, but was not able to hijack an open port
redirection that another container had open. Maybe its possible with
some more knowledge of networking though.

Anyway, network setup is meant to be handled by docker, not the apps,
so I believe denying this is generally in the spirit of docker, and
it closes down potential security issues.

Docker-DCO-1.1-Signed-off-by: Alexander Larsson <alexl@redhat.com> (github: alexlarsson)
2014-02-11 11:17:34 +01:00
Tianon Gravi
ee93f6185b Move UserLookup functionality into a separate pkg/user submodule that implements proper parsing of /etc/passwd and /etc/group, and use that to add support for "docker run -u user:group" and for getting supplementary groups (if ":group" is not specified)
Docker-DCO-1.1-Signed-off-by: Andrew Page <admwiggin@gmail.com> (github: tianon)
2014-01-31 20:15:24 -07:00
Michael Crosby
ca8dd73fbf Small fixes to type names
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00
Guillaume J. Charmes
f7684ea7f6 Move docker init into drivers functions
Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: crosbymichael)
2014-01-17 17:42:22 -08:00