| Description: | runc is a CLI tool for spawning and running containers on Linux
according to the OCI specification. A bug was found in runc prior to
version 1.1.2 where `runc exec --cap` created processes with non-empty
inheritable Linux process capabilities, creating an atypical Linux
environment and enabling programs with inheritable file capabilities
to elevate those capabilities to the permitted set during execve(2).
This bug did not affect the container security sandbox as the
inheritable set never contained more capabilities than were included
in the container's bounding set. This bug has been fixed in runc
1.1.2. This fix changes `runc exec --cap` behavior such that the
additional capabilities granted to the process being executed (as
specified via `--cap` arguments) do not include inheritable
capabilities. In addition, `runc spec` is changed to not set any
inheritable capabilities in the created example OCI spec
(`config.json`) file.
|
