diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-08-08 00:43:19 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-08-08 00:43:19 +0900 |
| commit | f1a53d611604482db975b312f4eeb6a81ea95ce5 (patch) | |
| tree | d8544ee795879a2e0829729bff3f756ec308c62c | |
| parent | b353c3deeaee900761d9ccccc82672402d5529e3 (diff) | |
container: raise CAP_DAC_OVERRIDE
This is required for upperdir and workdir checks in overlayfs.
Signed-off-by: Ophestra <cat@gensokyo.uk>
| -rw-r--r-- | container/capability.go | 5 | ||||
| -rw-r--r-- | container/container.go | 2 |
2 files changed, 4 insertions, 3 deletions
diff --git a/container/capability.go b/container/capability.go index 7c36ce9e..fda2fb2a 100644 --- a/container/capability.go +++ b/container/capability.go @@ -12,8 +12,9 @@ const ( PR_CAP_AMBIENT_RAISE = 0x2 PR_CAP_AMBIENT_CLEAR_ALL = 0x4 - CAP_SYS_ADMIN = 0x15 - CAP_SETPCAP = 0x8 + CAP_SYS_ADMIN = 0x15 + CAP_SETPCAP = 0x8 + CAP_DAC_OVERRIDE = 0x1 ) type ( diff --git a/container/container.go b/container/container.go index 5a7858f1..a0e1c2d5 100644 --- a/container/container.go +++ b/container/container.go @@ -146,7 +146,7 @@ func (p *Container) Start() error { CLONE_NEWIPC | CLONE_NEWUTS | CLONE_NEWCGROUP, // remain privileged for setup - AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP}, + AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP, CAP_DAC_OVERRIDE}, UseCgroupFD: p.Cgroup != nil, } |