clearlinux/docker
2
0
Fork 0
mirror of https://github.com/clearlinux/docker.git synced 2026-10-03 15:28:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

drop CAP_SYSLOG capability

Browse Source 
Kernel capabilities for privileged syslog operations are currently splitted into
CAP_SYS_ADMIN and CAP_SYSLOG since the following commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce6ada35bdf710d16582cc4869c26722547e6f11

This patch drops CAP_SYSLOG to prevent containers from messing with
host's syslog (e.g. `dmesg -c` clears up host's printk ring buffer).

Closes #5491

Docker-DCO-1.1-Signed-off-by: Eiichi Tsukata <devel@etsukata.com> (github: Etsukata)
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Eiichi Tsukata
2014-05-01 11:43:55 -07:00
committed by Michael Crosby
parent fe4a25546a
commit cac0cea03f
4 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
daemon/execdriver/native/template/default_template.go
+1
View File
@@ -25,6 +25,7 @@ func New() *libcontainer.Container {
libcontainer.GetCapability("MAC_ADMIN"),
libcontainer.GetCapability("NET_ADMIN"),
libcontainer.GetCapability("MKNOD"),
libcontainer.GetCapability("SYSLOG"),
},
Namespaces: libcontainer.Namespaces{
libcontainer.GetNamespace("NEWNS"),