Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove CAP_CHOWN #3480

Merged
merged 2 commits into from
Nov 10, 2022
Merged

Remove CAP_CHOWN #3480

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
375605a
Revert "Add the CAP_CHOWN capability to support running rootless"
Realmonia Nov 10, 2022
63125e5
Add comment to not include in capacity string
Realmonia Nov 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 14 additions & 15 deletions ecs-init/docker/docker.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,21 +69,6 @@ const (
// maxRetries specifies the maximum number of retries for ping to return
// a successful response from the docker socket
maxRetries = 5
// CapNetAdmin to start agent with NET_ADMIN capability
// For more information on capabilities, please read this manpage:
// http://man7.org/linux/man-pages/man7/capabilities.7.html
CapNetAdmin = "NET_ADMIN"
// CapSysAdmin to start agent with SYS_ADMIN capability
// This is needed for the ECS Agent to invoke the setns call when
// configuring the network namespace of the pause container
// For more information on setns, please read this manpage:
// http://man7.org/linux/man-pages/man2/setns.2.html
CapSysAdmin = "SYS_ADMIN"
// CapChown to start agent with CAP_CHOWN capability
Realmonia marked this conversation as resolved.
Show resolved Hide resolved
// This is needed for the ECS Agent to invoke the chown call when
// configuring the files for configuration or administration.
// http://man7.org/linux/man-pages/man2/chown.2.html
CapChown = "CAP_CHOWN"
// DefaultCgroupMountpoint is the default mount point for the cgroup subsystem
DefaultCgroupMountpoint = "/sys/fs/cgroup"
// pluginSocketFilesDir specifies the location of UNIX domain socket files of
Expand Down Expand Up @@ -127,6 +112,20 @@ const (
execAgentLogRelativePath = "/exec"
)

// Do NOT include "CAP_" in capability string
const (
// CapNetAdmin to start agent with NET_ADMIN capability
// For more information on capabilities, please read this manpage:
// http://man7.org/linux/man-pages/man7/capabilities.7.html
CapNetAdmin = "NET_ADMIN"
// CapSysAdmin to start agent with SYS_ADMIN capability
// This is needed for the ECS Agent to invoke the setns call when
// configuring the network namespace of the pause container
// For more information on setns, please read this manpage:
// http://man7.org/linux/man-pages/man2/setns.2.html
CapSysAdmin = "SYS_ADMIN"
)

var pluginDirs = []string{
pluginSocketFilesDir,
pluginSpecFilesEtcDir,
Expand Down
2 changes: 1 addition & 1 deletion ecs-init/docker/docker_config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ func createHostConfig(binds []string) *godocker.HostConfig {
// CapNetAdmin and CapSysAdmin are needed for running task in awsvpc network mode.
// This network mode is (at least currently) not supported in external environment,
// hence not adding them in that case.
caps = []string{CapNetAdmin, CapSysAdmin, CapChown}
caps = []string{CapNetAdmin, CapSysAdmin}
}

hostConfig := &godocker.HostConfig{
Expand Down
2 changes: 1 addition & 1 deletion ecs-init/docker/docker_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -292,7 +292,7 @@ func validateCommonCreateContainerOptions(opts godocker.CreateContainerOptions,
t.Errorf("Expected network mode to be %s, got %s", networkMode, hostCfg.NetworkMode)
}

if len(hostCfg.CapAdd) != 3 {
if len(hostCfg.CapAdd) != 2 {
t.Error("Mismatch detected in added host config capabilities")
}

Expand Down