particle-os/debian-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pipeline: drop CAP_{NET_ADMIN,SYS_PTRACE} caps

Browse source 
Drop CAP_{NET_ADMIN,SYS_PTRACE} from the default capabilities which
are only needed to run bwrap from inside a stage which is done by
the `ostree.commit` and `ostree.preptree` stages, so retain them
directly there.
This commit is contained in:
Christian Kellner 2022-04-26 18:59:18 +02:00 • committed by Tom Gundersen
parent d14e5f3ee8
commit 0c8f5c7ef0
5 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
assemblers/org.osbuild.ostree.commit
View file

@ -29,6 +29,9 @@ from osbuild import api
from osbuild.util import ostree
CAPABILITIES = ["CAP_NET_ADMIN", "CAP_SYS_PTRACE"]
SCHEMA = """
"additionalProperties": false,
"required": ["ref"],

2
osbuild/pipeline.py
View file

@ -29,7 +29,6 @@ DEFAULT_CAPABILITIES = {
"CAP_MAC_ADMIN",
"CAP_MAC_OVERRIDE",
"CAP_MKNOD",
"CAP_NET_ADMIN", # bwrap
"CAP_NET_BIND_SERVICE",
"CAP_SETFCAP",
"CAP_SETGID",
@ -38,7 +37,6 @@ DEFAULT_CAPABILITIES = {
"CAP_SYS_ADMIN",
"CAP_SYS_CHROOT",
"CAP_SYS_NICE",
"CAP_SYS_PTRACE", # bwrap
"CAP_SYS_RESOURCE"
}

3
stages/org.osbuild.ostree.commit
View file

@ -24,6 +24,9 @@ from osbuild import api
from osbuild.util import ostree
CAPABILITIES = ["CAP_NET_ADMIN", "CAP_SYS_PTRACE"]
SCHEMA_2 = """
"options": {
"additionalProperties": false,

3
stages/org.osbuild.ostree.preptree
View file

@ -43,6 +43,9 @@ from osbuild import api
from osbuild.util import ostree
CAPABILITIES = ["CAP_NET_ADMIN", "CAP_SYS_PTRACE"]
SCHEMA = """
"additionalProperties": false,
"properties": {

3
stages/org.osbuild.rpm-ostree
View file

@ -39,6 +39,9 @@ import osbuild.api
from osbuild.util import ostree
CAPABILITIES = ["CAP_NET_ADMIN", "CAP_SYS_PTRACE"]
SCHEMA = """
"additionalProperties": false,
"properties": {