Add support for ambient capabilities by justincormack · Pull Request #26979 · moby/moby

justincormack · 2016-09-28T13:08:14Z

This change was reverted for docker 1.13 (see #27737)

Linux kernel 4.3 and later supports "ambient capabilities" which are the
only way to pass capabilities to containers running as a non root uid.

Previously there was no way to allow containers not running as root
capabilities in a useful way.

Fix #8460

Signed-off-by: Justin Cormack justin.cormack@docker.com

NOTE: actual runc update was included in #27160 so this is just a docs and tests change now.

NOTE: This will grant the default capabilities to containers that are run as a non root user. This might be surprising, for example we grant cap_chown by default, so with this PR docker run -u 1000 busybox chown 100 /tmp will just work. We could grant fewer capabilities to containers not running as root, by default, but this might break users who expect sudo chown ... to work. In general as running as non root is strictly better than running as root, I think it is best to leave this, as the default capabilities are mostly harmless, and I am planning other patches to allow reducing the default capability set globally. Open to discussion on this.

Chill Out with Ambient Capabilities

justincormack · 2016-09-28T13:09:02Z

cc @mrunalp @crosbymichael

cpuguy83 · 2016-09-28T14:13:11Z

ping @tianon too

thaJeztah · 2016-09-28T15:10:53Z

Should we have a failing test as well, to verify that it won't work without this?

justincormack · 2016-09-28T16:32:33Z

The test failures look like they are related to other changes in runc, I will look at them seperately.

mrunalp · 2016-09-28T17:23:15Z

I tested this and it works fine for me 👍

jeremyeder · 2016-09-29T11:40:30Z

@mrunalp Ambient Capabilities are available in RHEL7.3.

mrunalp · 2016-09-29T14:31:28Z

@jeremyeder Awesome. I had only tested on RHEL 7.2 and wasn't sure about status in 7.3

Found some issues when working on moby#26979 which looked unrelated to that PR but may be related to other changes. Signed-off-by: Justin Cormack <justin.cormack@docker.com>

thaJeztah · 2016-10-10T14:57:16Z

This now needs to be moved somewhere in the https://github.com/docker/docker.gihub.io repository (I'm ok with keeping it here as well, as that repository does not yet have docs for 1.13 it seems)

thaJeztah

LGTM

Linux kernel 4.3 and later supports "ambient capabilities" which are the only way to pass capabilities to containers running as a non root uid. Previously there was no way to allow containers not running as root capabilities in a useful way. Fix moby#8460 Signed-off-by: Justin Cormack <justin.cormack@docker.com>

crosbymichael · 2016-10-10T16:14:35Z

LGTM

thaJeztah · 2016-10-10T16:48:11Z

Given that there's no docs for 1.13 yet in the https://github.com/docker/docker.gihub.io repository, I'm moving this to "merge". There'll probably be a sync with that repository in the near future.

/cc @johndmulhausen @mstanleyjones

mdlinville · 2016-10-10T21:32:48Z

I got this into the vnext-engine branch on docker/docker.github.io repository, which is where new features for Engine should now be documented. That branch currently has all doc-related commits in docker/docker master up to SHA1 4331b62.

thaJeztah · 2016-11-15T21:07:04Z

@mstanleyjones I was about to open a pull request to revert the documentation changes in this PR, but I cannot find these changes in your sync of october 10th; https://github.com/docker/docker.github.io/blob/e4bce35ac2d2963e0f52414ca98742c60e8df510/engine/security/seccomp.md

Should we check if things got lost in that sync?

mdlinville · 2016-11-17T16:24:46Z

Merged #584 which addresses @thaJeztah comment above. Thanks!

Removes some test functions that were unused: - bridgeNfIP6tables - ambientCapabilities (added to support moby#26979, which was reverted in moby#27737) - overlay2Supported Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Removes some test functions that were unused: - bridgeNfIP6tables - ambientCapabilities (added to support moby#26979, which was reverted in moby#27737) - overlay2Supported Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit c887b09) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Removes some test functions that were unused: - bridgeNfIP6tables - ambientCapabilities (added to support moby#26979, which was reverted in moby#27737) - overlay2Supported Signed-off-by: Sebastiaan van Stijn <github@gone.nl> Signed-off-by: zach <Zachary.Joyner@linux.com>

Removes some test functions that were unused: - bridgeNfIP6tables - ambientCapabilities (added to support moby#26979, which was reverted in moby#27737) - overlay2Supported Signed-off-by: Sebastiaan van Stijn <github@gone.nl> (cherry picked from commit c887b09) Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

GordonTheTurtle added the status/0-triage label Sep 28, 2016

justincormack added area/security status/1-design-review and removed status/0-triage labels Sep 28, 2016

This was referenced Sep 28, 2016

Can't bind to privileged ports as non-root #8460

Closed

Set ambient capabilities where supported opencontainers/runc#1086

Merged

justincormack added the impact/changelog label Sep 28, 2016

justincormack force-pushed the ambient branch 2 times, most recently from f144a8e to 4f390fa Compare September 28, 2016 13:37

thaJeztah reviewed Sep 28, 2016

View reviewed changes

thaJeztah added the impact/documentation label Sep 28, 2016

justincormack mentioned this pull request Sep 28, 2016

Update runc #26987

Closed

justincormack added a commit to justincormack/docker that referenced this pull request Oct 5, 2016

Update runc

f42f48e

Found some issues when working on moby#26979 which looked unrelated to that PR but may be related to other changes. Signed-off-by: Justin Cormack <justin.cormack@docker.com>

justincormack force-pushed the ambient branch from 4f390fa to 47c322e Compare October 6, 2016 17:40

thaJeztah reviewed Oct 10, 2016

View reviewed changes

thaJeztah added status/2-code-review and removed status/1-design-review labels Oct 10, 2016

justincormack force-pushed the ambient branch from 47c322e to 729e0d5 Compare October 10, 2016 15:03

thaJeztah approved these changes Oct 10, 2016

View reviewed changes

justincormack force-pushed the ambient branch from 729e0d5 to 6acf353 Compare October 10, 2016 16:11

thaJeztah added this to the 1.13.0 milestone Oct 10, 2016

thaJeztah added status/4-merge and removed status/2-code-review labels Oct 10, 2016

justincormack merged commit 199e195 into moby:master Oct 10, 2016

justincormack deleted the ambient branch October 10, 2016 18:29

justincormack mentioned this pull request Jan 23, 2017

[WIP] Add ambient capabilities gated by no new privileges #30382

Closed

php-coder mentioned this pull request Jan 18, 2018

Kubernetes should configure the ambient capability set kubernetes/kubernetes#56374

Open

crosbymichael mentioned this pull request Aug 1, 2018

container using not root user can not bind 80 and 443 port containerd/containerd#2516

Closed

thaJeztah mentioned this pull request Jul 8, 2019

integration-cli: remove unused requirements utils #39470

Merged

mejedi mentioned this pull request Dec 6, 2025

runtime: provide a way to opt in to stack trace printing for process-terminating signals in secure-mode binaries on Unix OSes golang/go#69868

Open

Conversation

justincormack commented Sep 28, 2016 • edited by thaJeztah Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

This change was reverted for docker 1.13 (see #27737)

Uh oh!

justincormack commented Sep 28, 2016

Uh oh!

cpuguy83 commented Sep 28, 2016

Uh oh!

thaJeztah Sep 28, 2016

Choose a reason for hiding this comment

Uh oh!

justincormack Oct 10, 2016

Choose a reason for hiding this comment

Uh oh!

justincormack commented Sep 28, 2016

Uh oh!

mrunalp commented Sep 28, 2016

Uh oh!

jeremyeder commented Sep 29, 2016

Uh oh!

mrunalp commented Sep 29, 2016

Uh oh!

thaJeztah Oct 10, 2016

Choose a reason for hiding this comment

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

crosbymichael commented Oct 10, 2016

Uh oh!

thaJeztah commented Oct 10, 2016

Uh oh!

mdlinville commented Oct 10, 2016

Uh oh!

thaJeztah commented Nov 15, 2016

Uh oh!

mdlinville commented Nov 17, 2016

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

justincormack commented Sep 28, 2016 •

edited by thaJeztah

Loading