Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

openstack: check and set CAP_SYS_ADMIN before using a config-drive #96

Open
lucab opened this issue Jul 3, 2018 · 1 comment
Open

openstack: check and set CAP_SYS_ADMIN before using a config-drive #96

lucab opened this issue Jul 3, 2018 · 1 comment
Labels
area/security kind/cleanup kind/enhancement platform/openstack

Comments

@lucab
Copy link
Contributor

lucab commented Jul 3, 2018

Mounting a config-drive requires CAP_SYS_ADMIN in the thread invoking the mount syscall. This is typically true when running coreos-metadata as the root user, but it would be better to make this explicit and only requiring the specific capabilities it needs.
@lucab lucab mentioned this issue Jul 3, 2018
Closed
@lucab
Copy link
Contributor Author

lucab commented Jul 30, 2020

Nowadays, this also applies to other providers handling a config-drive (e.g. the IBM ones). Library to use here would be https://docs.rs/caps.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
area/security kind/cleanup kind/enhancement platform/openstack
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lucab @prestist