Daniel J Walsh 9ebde6e03a Containers should not get inheritable caps by default ...

When I launch a container with --userns=keep-id the rootless processes
should have no caps by default even if I launch the container with
--privileged.  It should only get the caps if I specify by hand the
caps I want leaked to the process.

Currently we turn off capeff and capamb, but not capinh.  This patch
treats capinh the same way as capeff and capamb.

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>

2021-01-07 05:53:07 -05:00

8.1 KiB

Raw Blame History

View Raw