capability: Apply: deny for another process #174
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Current version of
capsV3.Apply
has a major problem: if you do something like this:then the ambient capability will be applied to the current process, rather than the process identified by pid. Same issue for
BOUNDS
.For
CAPS
the situation is slightly different:capset(2)
man page says:Here kernels supporting VFS capabilities means most kernels >= v2.6.24, and all kernels >= v2.6.33. Since Go 1.18+ only supports Linux >= v2.6.32, this pretty much means "all kernels".
Meaning,
Apply(CAPS)
with non-zero pid will trycapset(2)
and returnEPERM
.Let's return an error early if pid is set in Apply, and add a test case.
Fixes: #168
Closes: #171