diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-26 06:28:32 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-26 06:32:08 +0900 |
| commit | 52fcc48ac141147324c3baac0e87ea49e8c2ca09 (patch) | |
| tree | a3b2cc75d7d7266427580258cfdd11dc307cb92f /sandbox/container.go | |
| parent | 8b69bcd2154fdc7903aceca662e9694588c982f2 (diff) | |
sandbox/init: drop capabilities
During development the syscall filter caused me to make an incorrect assumption about SysProcAttr.
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'sandbox/container.go')
| -rw-r--r-- | sandbox/container.go | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sandbox/container.go b/sandbox/container.go index 70929bb1..f2595c38 100644 --- a/sandbox/container.go +++ b/sandbox/container.go @@ -165,7 +165,7 @@ func (p *Container) Start() error { syscall.CLONE_NEWNS, // remain privileged for setup - AmbientCaps: []uintptr{CAP_SYS_ADMIN}, + AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP}, UseCgroupFD: p.Cgroup != nil, } |