1. docker
  2. Commit cac0cea03f85191b3d92cdaeae827fdd93fb1b29
Browse code

drop CAP_SYSLOG capability

Kernel capabilities for privileged syslog operations are currently splitted into
CAP_SYS_ADMIN and CAP_SYSLOG since the following commit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce6ada35bdf710d16582cc4869c26722547e6f11

This patch drops CAP_SYSLOG to prevent containers from messing with
host's syslog (e.g. `dmesg -c` clears up host's printk ring buffer).

Closes #5491

Docker-DCO-1.1-Signed-off-by: Eiichi Tsukata <devel@etsukata.com> (github: Etsukata)
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)

Eiichi Tsukata authored on 2014/04/30 15:20:22
Showing 4 changed files
daemon/execdriver/lxc/init.go
History View file @ cac0cea
... ... 
@@ -149,6 +149,7 @@ func setupCapabilities(args *execdriver.InitArgs) error {
149 149 
 		capability.CAP_MAC_OVERRIDE,
150 150 
 		capability.CAP_MAC_ADMIN,
151 151 
 		capability.CAP_NET_ADMIN,
152 
+		capability.CAP_SYSLOG,
152 153 
 	}
153 154
154 155 
 	c, err := capability.NewPid(os.Getpid())
daemon/execdriver/native/template/default_template.go
History View file @ cac0cea
... ... 
@@ -25,6 +25,7 @@ func New() *libcontainer.Container {
25 25 
 			libcontainer.GetCapability("MAC_ADMIN"),
26 26 
 			libcontainer.GetCapability("NET_ADMIN"),
27 27 
 			libcontainer.GetCapability("MKNOD"),
28 
+			libcontainer.GetCapability("SYSLOG"),
28 29 
 		},
29 30 
 		Namespaces: libcontainer.Namespaces{
30 31 
 			libcontainer.GetNamespace("NEWNS"),
pkg/libcontainer/container.json
History View file @ cac0cea
... ... 
@@ -91,6 +91,11 @@
91 91 
          "value" : 27,
92 92 
          "key" : "MKNOD",
93 93 
          "enabled" : true
94 
+      },
95 
+      {
96 
+         "value" : 34,
97 
+         "key" : "SYSLOG",
98 
+         "enabled" : false
94 99 
       }
95 100 
    ],
96 101 
    "networks" : [
pkg/libcontainer/types.go
History View file @ cac0cea
... ... 
@@ -53,6 +53,7 @@ var (
53 53 
 		{Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE, Enabled: false},
54 54 
 		{Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN, Enabled: false},
55 55 
 		{Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN, Enabled: false},
56 
+		{Key: "SYSLOG", Value: capability.CAP_SYSLOG, Enabled: false},
56 57 
 	}
57 58 
 )
58 59