particle-os/debian-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pipeline: drop CAP_{NET_ADMIN,SYS_PTRACE} caps

Browse source 
Drop CAP_{NET_ADMIN,SYS_PTRACE} from the default capabilities which
are only needed to run bwrap from inside a stage which is done by
the `ostree.commit` and `ostree.preptree` stages, so retain them
directly there.
This commit is contained in:
Christian Kellner 2022-04-26 18:59:18 +02:00 • committed by Tom Gundersen
parent d14e5f3ee8
commit 0c8f5c7ef0
5 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

2
osbuild/pipeline.py
View file

@ -29,7 +29,6 @@ DEFAULT_CAPABILITIES = {
"CAP_MAC_ADMIN",
"CAP_MAC_OVERRIDE",
"CAP_MKNOD",
"CAP_NET_ADMIN", # bwrap
"CAP_NET_BIND_SERVICE",
"CAP_SETFCAP",
"CAP_SETGID",
@ -38,7 +37,6 @@ DEFAULT_CAPABILITIES = {
"CAP_SYS_ADMIN",
"CAP_SYS_CHROOT",
"CAP_SYS_NICE",
"CAP_SYS_PTRACE", # bwrap
"CAP_SYS_RESOURCE"
}