32 lines
1.2 KiB
Diff
32 lines
1.2 KiB
Diff
|
From 21cb5a8c7bcc90c42743ffd15cd11a55bf66993d Mon Sep 17 00:00:00 2001
|
||
|
|
From: Giuseppe Scrivano <gscrivan@redhat.com>
|
||
|
|
Date: Mon, 28 Feb 2022 11:06:50 +0100
|
||
|
|
Subject: [PATCH 2/2] exec: --cap do not set inheritable capabilities
|
||
|
|
|
||
|
|
Closes: CVE-2022-27650
|
||
|
|
|
||
|
|
Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
|
||
|
|
(cherry picked from commit 1aeeed2e4fdeffb4875c0d0b439915894594c8c6)
|
||
|
|
---
|
||
|
|
src/exec.c | 4 ++--
|
||
|
|
1 file changed, 2 insertions(+), 2 deletions(-)
|
||
|
|
|
||
|
|
diff --git a/src/exec.c b/src/exec.c
|
||
|
|
index bf6c05f..8c9862d 100644
|
||
|
|
--- a/src/exec.c
|
||
|
|
+++ b/src/exec.c
|
||
|
|
@@ -250,8 +250,8 @@ crun_command_exec (struct crun_global_arguments *global_args, int argc, char **a
|
||
|
|
capabilities->effective = exec_options.cap;
|
||
|
|
capabilities->effective_len = exec_options.cap_size;
|
||
|
|
|
||
|
|
- capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size);
|
||
|
|
- capabilities->inheritable_len = exec_options.cap_size;
|
||
|
|
+ capabilities->inheritable = NULL;
|
||
|
|
+ capabilities->inheritable_len = 0;
|
||
|
|
|
||
|
|
capabilities->bounding = dup_array (exec_options.cap, exec_options.cap_size);
|
||
|
|
capabilities->bounding_len = exec_options.cap_size;
|
||
|
|
--
|
||
|
|
2.35.1
|
||
|
|
|