particle-os/debian-forge
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

pipeline: drop CAP_{NET_ADMIN,SYS_PTRACE} caps

Browse source 
Drop CAP_{NET_ADMIN,SYS_PTRACE} from the default capabilities which
are only needed to run bwrap from inside a stage which is done by
the `ostree.commit` and `ostree.preptree` stages, so retain them
directly there.
This commit is contained in:
Christian Kellner 2022-04-26 18:59:18 +02:00 • committed by Tom Gundersen
parent d14e5f3ee8
commit 0c8f5c7ef0
5 changed files with 12 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

3
stages/org.osbuild.ostree.commit
View file

@ -24,6 +24,9 @@ from osbuild import api
from osbuild.util import ostree
CAPABILITIES = ["CAP_NET_ADMIN", "CAP_SYS_PTRACE"]
SCHEMA_2 = """
"options": {
"additionalProperties": false,

3
stages/org.osbuild.ostree.preptree
View file

@ -43,6 +43,9 @@ from osbuild import api
from osbuild.util import ostree
CAPABILITIES = ["CAP_NET_ADMIN", "CAP_SYS_PTRACE"]
SCHEMA = """
"additionalProperties": false,
"properties": {

3
stages/org.osbuild.rpm-ostree
View file

@ -39,6 +39,9 @@ import osbuild.api
from osbuild.util import ostree
CAPABILITIES = ["CAP_NET_ADMIN", "CAP_SYS_PTRACE"]
SCHEMA = """
"additionalProperties": false,
"properties": {