Fix capability allow rules when capabilities are specified in JSON file

Podman provides capabilities in inspected JSON file, this patch fixin the issue.
containers · Jan 23, 2019 · 45f51a4 · 45f51a4
1 parent e5e1ec1
commit 45f51a4
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 6 deletions.
diff --git a/udica/__main__.py b/udica/__main__.py
@@ -84,17 +84,17 @@ def main():
         except:
             exit(2)
 
+    container_inspect = parse_inspect(container_inspect_data)
+    container_mounts = container_inspect[0]['Mounts']
+    container_ports = container_inspect[0]['NetworkSettings']['Ports']
+
     if opts['Caps']:
         if opts['Caps'] == 'None':
             container_caps = []
         else:
             container_caps = opts['Caps'].split(',')
     else:
-            container_caps = []
-
-    container_inspect = parse_inspect(container_inspect_data)
-    container_mounts = container_inspect[0]['Mounts']
-    container_ports = container_inspect[0]['NetworkSettings']['Ports']
+        container_caps = container_inspect[0]['EffectiveCaps']
 
     create_policy(opts, container_caps, container_mounts, container_ports)
 

diff --git a/udica/policy.py b/udica/policy.py
@@ -103,7 +103,11 @@ def create_policy(opts,capabilities,mounts,ports):
     if capabilities:
         caps=''
         for item in capabilities:
-            caps = caps + perms.cap[item]
+            # Capabilities parsed from podman inspection JSON file have prefix "CAP_", this should be removed
+            if "CAP_" in item:
+                caps = caps + perms.cap[item[4:]]
+            else:
+                 caps = caps + perms.cap[item]
 
         policy.write('    (allow process process ( capability ( ' + caps  + '))) \n')
         policy.write('\n')