diff options
| -rw-r--r-- | sandbox/init.go | 11 | ||||
| -rw-r--r-- | test/test.py | 2 |
2 files changed, 11 insertions, 2 deletions
diff --git a/sandbox/init.go b/sandbox/init.go index 437eb7aa..0d14e5f8 100644 --- a/sandbox/init.go +++ b/sandbox/init.go @@ -217,7 +217,7 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) { } /* - load seccomp filter + caps/securebits and seccomp filter */ if _, _, errno := syscall.Syscall(PR_SET_NO_NEW_PRIVS, 1, 0, 0); errno != 0 { @@ -228,9 +228,16 @@ func Init(prepare func(prefix string), setVerbose func(verbose bool)) { } for i := uintptr(0); i <= LastCap(); i++ { if _, _, errno := syscall.Syscall(syscall.SYS_PRCTL, syscall.PR_CAPBSET_DROP, i, 0); errno != 0 { - log.Fatalf("cannot drop capability: %v", errno) + log.Fatalf("cannot drop capability from bonding set: %v", errno) } } + if err := capset( + &capHeader{_LINUX_CAPABILITY_VERSION_3, 0}, + &[2]capData{{0, 0, 0}, {0, 0, 0}}, + ); err != nil { + log.Fatalf("cannot capset: %v", err) + } + if err := seccomp.Load(params.Flags.seccomp(params.Seccomp)); err != nil { log.Fatalf("cannot load syscall filter: %v", err) } diff --git a/test/test.py b/test/test.py index 9288bb87..f0137183 100644 --- a/test/test.py +++ b/test/test.py @@ -100,9 +100,11 @@ print(denyOutputVerbose) print(machine.fail("sudo -u alice -i fsu")) # Verify capabilities/securebits in user namespace: +print(machine.succeed("sudo -u alice -i fortify run capsh --print")) print(machine.succeed("sudo -u alice -i fortify run capsh --has-no-new-privs")) print(machine.fail("sudo -u alice -i fortify run capsh --has-a=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run capsh --has-b=CAP_SYS_ADMIN")) +print(machine.fail("sudo -u alice -i fortify run capsh --has-i=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run capsh --has-p=CAP_SYS_ADMIN")) print(machine.fail("sudo -u alice -i fortify run umount -R /dev")) |