diff options
| author | Ophestra <cat@gensokyo.uk> | 2025-03-27 19:40:19 +0900 |
|---|---|---|
| committer | Ophestra <cat@gensokyo.uk> | 2025-03-27 19:40:19 +0900 |
| commit | 184e9db2b2ee960e7c7b2014aec72a28d9110bcc (patch) | |
| tree | 180c6a67f09d5b3c9c2cd0600c30113435a3428c /sandbox/syscall.go | |
| parent | 605d018be266a9e0d5c8256d647e3a61fa6df79a (diff) | |
sandbox: support privileged container
Signed-off-by: Ophestra <cat@gensokyo.uk>
Diffstat (limited to 'sandbox/syscall.go')
| -rw-r--r-- | sandbox/syscall.go | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/sandbox/syscall.go b/sandbox/syscall.go index 7ddb5137..9e46bafc 100644 --- a/sandbox/syscall.go +++ b/sandbox/syscall.go @@ -11,6 +11,7 @@ const ( PR_SET_NO_NEW_PRIVS = 0x26 CAP_SYS_ADMIN = 0x15 + CAP_SETPCAP = 0x8 ) const ( @@ -30,10 +31,9 @@ func SetDumpable(dumpable uintptr) error { const ( _LINUX_CAPABILITY_VERSION_3 = 0x20080522 - PR_CAP_AMBIENT = 47 - PR_CAP_AMBIENT_CLEAR_ALL = 4 - - CAP_SETPCAP = 8 + PR_CAP_AMBIENT = 0x2f + PR_CAP_AMBIENT_RAISE = 0x2 + PR_CAP_AMBIENT_CLEAR_ALL = 0x4 ) type ( @@ -49,6 +49,12 @@ type ( } ) +// See CAP_TO_INDEX in linux/capability.h: +func capToIndex(cap uintptr) uintptr { return cap >> 5 } + +// See CAP_TO_MASK in linux/capability.h: +func capToMask(cap uintptr) uint32 { return 1 << uint(cap&31) } + func capset(hdrp *capHeader, datap *[2]capData) error { if _, _, errno := syscall.Syscall(syscall.SYS_CAPSET, uintptr(unsafe.Pointer(hdrp)), |