From 184e9db2b2ee960e7c7b2014aec72a28d9110bcc Mon Sep 17 00:00:00 2001 From: Ophestra Date: Thu, 27 Mar 2025 19:40:19 +0900 Subject: sandbox: support privileged container Signed-off-by: Ophestra --- sandbox/syscall.go | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) (limited to 'sandbox/syscall.go') diff --git a/sandbox/syscall.go b/sandbox/syscall.go index 7ddb5137..9e46bafc 100644 --- a/sandbox/syscall.go +++ b/sandbox/syscall.go @@ -11,6 +11,7 @@ const ( PR_SET_NO_NEW_PRIVS = 0x26 CAP_SYS_ADMIN = 0x15 + CAP_SETPCAP = 0x8 ) const ( @@ -30,10 +31,9 @@ func SetDumpable(dumpable uintptr) error { const ( _LINUX_CAPABILITY_VERSION_3 = 0x20080522 - PR_CAP_AMBIENT = 47 - PR_CAP_AMBIENT_CLEAR_ALL = 4 - - CAP_SETPCAP = 8 + PR_CAP_AMBIENT = 0x2f + PR_CAP_AMBIENT_RAISE = 0x2 + PR_CAP_AMBIENT_CLEAR_ALL = 0x4 ) type ( @@ -49,6 +49,12 @@ type ( } ) +// See CAP_TO_INDEX in linux/capability.h: +func capToIndex(cap uintptr) uintptr { return cap >> 5 } + +// See CAP_TO_MASK in linux/capability.h: +func capToMask(cap uintptr) uint32 { return 1 << uint(cap&31) } + func capset(hdrp *capHeader, datap *[2]capData) error { if _, _, errno := syscall.Syscall(syscall.SYS_CAPSET, uintptr(unsafe.Pointer(hdrp)), -- cgit v1.3.1