Affected by GO-2022-0452 and 4 other vulnerabilities

GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

GO-2022-0914: mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

GO-2023-1682: rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc in github.com/opencontainers/runc

GO-2023-1683: runc AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

GO-2024-3110: runc can be confused to create empty files/directories on the host in github.com/opencontainers/runc

capabilities

package

v1.0.0-rc93 Latest Latest Go to latest Published: Feb 3, 2021 License: Apache-2.0 Imports: 4 Imported by: 2

Details

Rendered for

This section is empty.

This section is empty.

This section is empty.

type Caps struct {
	// contains filtered or unexported fields
}

Caps holds the capabilities for a container.

func New(capConfig *configs.Capabilities) (*Caps, error)

New creates a new Caps from the given Capabilities config.

func (c *Caps) ApplyBoundingSet() error

ApplyBoundingSet sets the capability bounding set to those specified in the whitelist.

func (c *Caps) ApplyCaps() error

Apply sets all the capabilities for the current process in the config.