Support --no-privs in --oci mode
#1477
Assignees
Comments
19 tasks
dtrudg
added a commit
to dtrudg/singularity
that referenced
this issue
Jun 21, 2023
When `--no-privs` is set on the command line: * The container process capability set should be empty. * NoNewPrivileges should be enabled for the container process. Fixes sylabs#1477
dtrudg
added a commit
to dtrudg/singularity
that referenced
this issue
Jun 21, 2023
When `--no-privs` is set on the command line: * The container process capability set should be empty. * NoNewPrivileges should be enabled for the container process. Fixes sylabs#1477
edytuk
pushed a commit
to vzokay/apptainer
that referenced
this issue
Jul 12, 2023
When `--no-privs` is set on the command line: * The container process capability set should be empty. * NoNewPrivileges should be enabled for the container process. Fixes sylabs/singularity#1477 Signed-off-by: Edita Kizinevic <[email protected]>
edytuk
pushed a commit
to vzokay/apptainer
that referenced
this issue
Jul 21, 2023
When `--no-privs` is set on the command line: * The container process capability set should be empty. * NoNewPrivileges should be enabled for the container process. Fixes sylabs/singularity#1477 Signed-off-by: Edita Kizinevic <[email protected]>
edytuk
pushed a commit
to vzokay/apptainer
that referenced
this issue
Jul 24, 2023
When `--no-privs` is set on the command line: * The container process capability set should be empty. * NoNewPrivileges should be enabled for the container process. Fixes sylabs/singularity#1477 Signed-off-by: Edita Kizinevic <[email protected]>
edytuk
pushed a commit
to vzokay/apptainer
that referenced
this issue
Jul 24, 2023
When `--no-privs` is set on the command line: * The container process capability set should be empty. * NoNewPrivileges should be enabled for the container process. Fixes sylabs/singularity#1477 Signed-off-by: Edita Kizinevic <[email protected]>
edytuk
pushed a commit
to vzokay/apptainer
that referenced
this issue
Jul 24, 2023
When `--no-privs` is set on the command line: * The container process capability set should be empty. * NoNewPrivileges should be enabled for the container process. Fixes sylabs/singularity#1477 Signed-off-by: Edita Kizinevic <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
If
--no-privsis specified on the command line, then the container process should have an empty capability set, and NoNewPrivs should be set.Since there are some capabilities set (bounding) on non-root users in
--ocimode, then this flag will apply to all cases... not just when run by root (as in native mode).The text was updated successfully, but these errors were encountered: