diff --git a/libcontainer/capabilities_linux.go b/libcontainer/capabilities_linux.go index 6b8b465c..13932db8 100644 --- a/libcontainer/capabilities_linux.go +++ b/libcontainer/capabilities_linux.go @@ -12,44 +12,44 @@ import ( const allCapabilityTypes = capability.CAPS | capability.BOUNDS var capabilityList = map[string]capability.Cap{ - "SETPCAP": capability.CAP_SETPCAP, - "SYS_MODULE": capability.CAP_SYS_MODULE, - "SYS_RAWIO": capability.CAP_SYS_RAWIO, - "SYS_PACCT": capability.CAP_SYS_PACCT, - "SYS_ADMIN": capability.CAP_SYS_ADMIN, - "SYS_NICE": capability.CAP_SYS_NICE, - "SYS_RESOURCE": capability.CAP_SYS_RESOURCE, - "SYS_TIME": capability.CAP_SYS_TIME, - "SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG, - "MKNOD": capability.CAP_MKNOD, - "AUDIT_WRITE": capability.CAP_AUDIT_WRITE, - "AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL, - "MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE, - "MAC_ADMIN": capability.CAP_MAC_ADMIN, - "NET_ADMIN": capability.CAP_NET_ADMIN, - "SYSLOG": capability.CAP_SYSLOG, - "CHOWN": capability.CAP_CHOWN, - "NET_RAW": capability.CAP_NET_RAW, - "DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE, - "FOWNER": capability.CAP_FOWNER, - "DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH, - "FSETID": capability.CAP_FSETID, - "KILL": capability.CAP_KILL, - "SETGID": capability.CAP_SETGID, - "SETUID": capability.CAP_SETUID, - "LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE, - "NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE, - "NET_BROADCAST": capability.CAP_NET_BROADCAST, - "IPC_LOCK": capability.CAP_IPC_LOCK, - "IPC_OWNER": capability.CAP_IPC_OWNER, - "SYS_CHROOT": capability.CAP_SYS_CHROOT, - "SYS_PTRACE": capability.CAP_SYS_PTRACE, - "SYS_BOOT": capability.CAP_SYS_BOOT, - "LEASE": capability.CAP_LEASE, - "SETFCAP": capability.CAP_SETFCAP, - "WAKE_ALARM": capability.CAP_WAKE_ALARM, - "BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND, - "AUDIT_READ": capability.CAP_AUDIT_READ, + "CAP_SETPCAP": capability.CAP_SETPCAP, + "CAP_SYS_MODULE": capability.CAP_SYS_MODULE, + "CAP_SYS_RAWIO": capability.CAP_SYS_RAWIO, + "CAP_SYS_PACCT": capability.CAP_SYS_PACCT, + "CAP_SYS_ADMIN": capability.CAP_SYS_ADMIN, + "CAP_SYS_NICE": capability.CAP_SYS_NICE, + "CAP_SYS_RESOURCE": capability.CAP_SYS_RESOURCE, + "CAP_SYS_TIME": capability.CAP_SYS_TIME, + "CAP_SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG, + "CAP_MKNOD": capability.CAP_MKNOD, + "CAP_AUDIT_WRITE": capability.CAP_AUDIT_WRITE, + "CAP_AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL, + "CAP_MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE, + "CAP_MAC_ADMIN": capability.CAP_MAC_ADMIN, + "CAP_NET_ADMIN": capability.CAP_NET_ADMIN, + "CAP_SYSLOG": capability.CAP_SYSLOG, + "CAP_CHOWN": capability.CAP_CHOWN, + "CAP_NET_RAW": capability.CAP_NET_RAW, + "CAP_DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE, + "CAP_FOWNER": capability.CAP_FOWNER, + "CAP_DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH, + "CAP_FSETID": capability.CAP_FSETID, + "CAP_KILL": capability.CAP_KILL, + "CAP_SETGID": capability.CAP_SETGID, + "CAP_SETUID": capability.CAP_SETUID, + "CAP_LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE, + "CAP_NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE, + "CAP_NET_BROADCAST": capability.CAP_NET_BROADCAST, + "CAP_IPC_LOCK": capability.CAP_IPC_LOCK, + "CAP_IPC_OWNER": capability.CAP_IPC_OWNER, + "CAP_SYS_CHROOT": capability.CAP_SYS_CHROOT, + "CAP_SYS_PTRACE": capability.CAP_SYS_PTRACE, + "CAP_SYS_BOOT": capability.CAP_SYS_BOOT, + "CAP_LEASE": capability.CAP_LEASE, + "CAP_SETFCAP": capability.CAP_SETFCAP, + "CAP_WAKE_ALARM": capability.CAP_WAKE_ALARM, + "CAP_BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND, + "CAP_AUDIT_READ": capability.CAP_AUDIT_READ, } func newCapWhitelist(caps []string) (*whitelist, error) { diff --git a/libcontainer/integration/exec_test.go b/libcontainer/integration/exec_test.go index bbd1037f..582d6bb3 100644 --- a/libcontainer/integration/exec_test.go +++ b/libcontainer/integration/exec_test.go @@ -336,7 +336,7 @@ func TestProcessCaps(t *testing.T) { ok(t, err) defer container.Destroy() - processCaps := append(config.Capabilities, "NET_ADMIN") + processCaps := append(config.Capabilities, "CAP_NET_ADMIN") var stdout bytes.Buffer pconfig := libcontainer.Process{ diff --git a/libcontainer/integration/template_test.go b/libcontainer/integration/template_test.go index 7b2ff4c7..cbc9df70 100644 --- a/libcontainer/integration/template_test.go +++ b/libcontainer/integration/template_test.go @@ -23,20 +23,20 @@ func newTemplateConfig(rootfs string) *configs.Config { return &configs.Config{ Rootfs: rootfs, Capabilities: []string{ - "CHOWN", - "DAC_OVERRIDE", - "FSETID", - "FOWNER", - "MKNOD", - "NET_RAW", - "SETGID", - "SETUID", - "SETFCAP", - "SETPCAP", - "NET_BIND_SERVICE", - "SYS_CHROOT", - "KILL", - "AUDIT_WRITE", + "CAP_CHOWN", + "CAP_DAC_OVERRIDE", + "CAP_FSETID", + "CAP_FOWNER", + "CAP_MKNOD", + "CAP_NET_RAW", + "CAP_SETGID", + "CAP_SETUID", + "CAP_SETFCAP", + "CAP_SETPCAP", + "CAP_NET_BIND_SERVICE", + "CAP_SYS_CHROOT", + "CAP_KILL", + "CAP_AUDIT_WRITE", }, Namespaces: configs.Namespaces([]configs.Namespace{ {Type: configs.NEWNS}, diff --git a/spec.go b/spec.go index 5a5184a3..a27df3ca 100644 --- a/spec.go +++ b/spec.go @@ -84,9 +84,9 @@ var specCommand = cli.Command{ }, Linux: specs.Linux{ Capabilities: []string{ - "AUDIT_WRITE", - "KILL", - "NET_BIND_SERVICE", + "CAP_AUDIT_WRITE", + "CAP_KILL", + "CAP_NET_BIND_SERVICE", }, }, }