seccomp: allow fanotify_init without CAP_SYS_ADMIN #2412
Conversation
Closes: containers#2411 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
|
LGTM |
| "fadvise64", | ||
| "fadvise64_64", | ||
| "fallocate", | ||
| "fanotify_init", |
There was a problem hiding this comment.
This places no restrictions on the arguments. Will this allow a container running as root to make the kernel go OOM by using FAN_UNLIMITED_MARKS?
In other words do the restrictions described here need to be reflected in the policy?
The limitations imposed on an event listener created by a user without the CAP_SYS_ADMIN capability are as follows:
https://www.man7.org/linux/man-pages/man2/fanotify_init.2.html
There was a problem hiding this comment.
that requires CAP_SYS_ADMIN, we don't grant CAP_SYS_ADMIN by default, even for root
There was a problem hiding this comment.
Ok. I assume then there's no underlying reason it was required to be in the list in the first place. Basically just duplication of the checks done by the kernel any way.
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: giuseppe, Luap99 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
4 participants
Closes: #2411