Justin Cormack 15ff09395c If container will run as non root user, drop permitted, effective caps early ... As soon as the initial executable in the container is executed as a non root user, permitted and effective capabilities are dropped. Drop them earlier than this, so that they are dropped before executing the file. The main effect of this is that if `CAP_DAC_OVERRIDE` is set (the default) the user will not be able to execute files they do not have permission to execute, which previously they could. The old behaviour was somewhat surprising and the new one is definitely correct, but it is not in any meaningful way exploitable, and I do not think it is necessary to backport this fix. It is unlikely to have any negative effects as almost all executables have world execute permission anyway. Use the bounding set not the effective set as the canonical set of capabilities, as effective will now vary. Signed-off-by: Justin Cormack <justin.cormack@docker.com>		2018-03-19 14:45:27 -07:00
..
fixtures
default.json	Whitelist statx syscall for libseccomp-2.3.3 onward	2018-03-06 08:42:12 +01:00
generate.go	New seccomp format	2016-09-01 11:53:07 +02:00
seccomp.go	If container will run as non root user, drop permitted, effective caps early	2018-03-19 14:45:27 -07:00
seccomp_default.go	Whitelist statx syscall for libseccomp-2.3.3 onward	2018-03-06 08:42:12 +01:00
seccomp_test.go	Add canonical import comment	2018-02-05 16:51:57 -05:00
seccomp_unsupported.go	Add canonical import comment	2018-02-05 16:51:57 -05:00