sandbox/init: drop capabilities

During development the syscall filter caused me to make an incorrect assumption about SysProcAttr. Signed-off-by: Ophestra <cat@gensokyo.uk>
2025-03-26 06:28:32 +09:00
parent 8b69bcd215
commit 52fcc48ac1
4 changed files with 30 additions and 8 deletions
--- a/sandbox/container.go
+++ b/sandbox/container.go
@@ -165,7 +165,7 @@ func (p *Container) Start() error {
 			syscall.CLONE_NEWNS,

 		// remain privileged for setup
-		AmbientCaps: []uintptr{CAP_SYS_ADMIN},
+		AmbientCaps: []uintptr{CAP_SYS_ADMIN, CAP_SETPCAP},

 		UseCgroupFD: p.Cgroup != nil,
 	}