(pspec *specs.Process)
| 23 | ) |
| 24 | |
| 25 | func setExecCapabilities(pspec *specs.Process) error { |
| 26 | if pspec.Capabilities == nil { |
| 27 | pspec.Capabilities = &specs.LinuxCapabilities{} |
| 28 | } |
| 29 | allCaps, err := cap.Current() |
| 30 | if err != nil { |
| 31 | return err |
| 32 | } |
| 33 | pspec.Capabilities.Bounding = allCaps |
| 34 | pspec.Capabilities.Permitted = pspec.Capabilities.Bounding |
| 35 | pspec.Capabilities.Inheritable = pspec.Capabilities.Bounding |
| 36 | pspec.Capabilities.Effective = pspec.Capabilities.Bounding |
| 37 | |
| 38 | // https://github.com/moby/moby/pull/36466/files |
| 39 | // > `docker exec --privileged` does not currently disable AppArmor |
| 40 | // > profiles. Privileged configuration of the container is inherited |
| 41 | return nil |
| 42 | } |
no outgoing calls
no test coverage detected
searching dependent graphs…