summaryrefslogtreecommitdiffhomepage
path: root/runsc/dockerutil
diff options
context:
space:
mode:
authorFabricio Voznika <fvoznika@google.com>2019-10-01 11:48:24 -0700
committergVisor bot <gvisor-bot@google.com>2019-10-01 11:49:49 -0700
commit0b02c3d5e5bae87f5cdbf4ae20dad8344bef32c2 (patch)
treea5c60e3e55bbfc6807eabd8a219318d6446d9cd4 /runsc/dockerutil
parent53cc72da90f5b5a76b024b47fe4e38a81b495eb4 (diff)
Prevent CAP_NET_RAW from appearing in exec
'docker exec' was getting CAP_NET_RAW even when --net-raw=false because it was not filtered out from when copying container's capabilities. PiperOrigin-RevId: 272260451
Diffstat (limited to 'runsc/dockerutil')
-rw-r--r--runsc/dockerutil/dockerutil.go9
1 files changed, 8 insertions, 1 deletions
diff --git a/runsc/dockerutil/dockerutil.go b/runsc/dockerutil/dockerutil.go
index e37ec0ffd..57f6ae8de 100644
--- a/runsc/dockerutil/dockerutil.go
+++ b/runsc/dockerutil/dockerutil.go
@@ -282,7 +282,14 @@ func (d *Docker) Logs() (string, error) {
// Exec calls 'docker exec' with the arguments provided.
func (d *Docker) Exec(args ...string) (string, error) {
- a := []string{"exec", d.Name}
+ return d.ExecWithFlags(nil, args...)
+}
+
+// ExecWithFlags calls 'docker exec <flags> name <args>'.
+func (d *Docker) ExecWithFlags(flags []string, args ...string) (string, error) {
+ a := []string{"exec"}
+ a = append(a, flags...)
+ a = append(a, d.Name)
a = append(a, args...)
return do(a...)
}