From 52fcc48ac141147324c3baac0e87ea49e8c2ca09 Mon Sep 17 00:00:00 2001 From: Ophestra Date: Wed, 26 Mar 2025 06:28:32 +0900 Subject: sandbox/init: drop capabilities During development the syscall filter caused me to make an incorrect assumption about SysProcAttr. Signed-off-by: Ophestra --- sandbox/container.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'sandbox/container.go') diff --git a/sandbox/container.go b/sandbox/container.go index 70929bb1..f2595c38 100644 --- a/sandbox/container.go +++ b/sandbox/container.go @@ -165,7 +165,7 @@ func (p *Container) Start() error { syscall.CLONE_NEWNS, // remain privileged for setup - AmbientCaps: []uintptr{CAP_SYS_ADMIN}, + AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP}, UseCgroupFD: p.Cgroup != nil, } -- cgit v1.3.1