Skip to content

L
lxc
Unverified Commit df9bf8ca by Christian Brauner
Options

caps: check uid and euid

When we are running inside of a user namespace getuid() will return a non-zero uid. So let's check euid as well to make sure we correctly drop capabilities Signed-off-by: 's avatarChristian Brauner <christian.brauner@ubuntu.com>
parent 42bd57bd
Showing with 2 additions and 4 deletions
src/lxc/caps.c
......@@ -136,8 +136,7 @@ int lxc_ambient_caps_up(void)
int last_cap = CAP_LAST_CAP;
char *cap_names = NULL;
/* When we are root, we don't want to play with capabilities. */
if (!getuid())
if (!getuid() || geteuid())
return 0;
caps = cap_get_proc();
......@@ -204,8 +203,7 @@ int lxc_ambient_caps_down(void)
cap_t caps;
cap_value_t cap;
/* When we are root, we don't want to play with capabilities. */
if (!getuid())
if (!getuid() || geteuid())
return 0;
ret = prctl(PR_CAP_AMBIENT, prctl_arg(PR_CAP_AMBIENT_CLEAR_ALL),
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment