diff options
Diffstat (limited to 'sandbox/syscall.go')
| -rw-r--r-- | sandbox/syscall.go | 14 |
1 files changed, 10 insertions, 4 deletions
diff --git a/sandbox/syscall.go b/sandbox/syscall.go index 7ddb5137..9e46bafc 100644 --- a/sandbox/syscall.go +++ b/sandbox/syscall.go @@ -11,6 +11,7 @@ const ( PR_SET_NO_NEW_PRIVS = 0x26 CAP_SYS_ADMIN = 0x15 + CAP_SETPCAP = 0x8 ) const ( @@ -30,10 +31,9 @@ func SetDumpable(dumpable uintptr) error { const ( _LINUX_CAPABILITY_VERSION_3 = 0x20080522 - PR_CAP_AMBIENT = 47 - PR_CAP_AMBIENT_CLEAR_ALL = 4 - - CAP_SETPCAP = 8 + PR_CAP_AMBIENT = 0x2f + PR_CAP_AMBIENT_RAISE = 0x2 + PR_CAP_AMBIENT_CLEAR_ALL = 0x4 ) type ( @@ -49,6 +49,12 @@ type ( } ) +// See CAP_TO_INDEX in linux/capability.h: +func capToIndex(cap uintptr) uintptr { return cap >> 5 } + +// See CAP_TO_MASK in linux/capability.h: +func capToMask(cap uintptr) uint32 { return 1 << uint(cap&31) } + func capset(hdrp *capHeader, datap *[2]capData) error { if _, _, errno := syscall.Syscall(syscall.SYS_CAPSET, uintptr(unsafe.Pointer(hdrp)), |