containers
/
podman
mirror of https://github.com/containers/podman.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

quadlet: Change NoNewPrivileges default to false 

This matches the default of podman run.

Signed-off-by: Alexander Larsson <alexl@redhat.com>
This commit is contained in:
Alexander Larsson 2022-12-02 16:22:29 +01:00
parent 51deb324a3
commit d19ea6a60d
3 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
docs/source/markdown/podman-systemd.unit.5.md
View File

@ -109,7 +109,7 @@ which can be modified with `RemapUsers`, but if that is not specified, this uid
The (numeric) gid to run as inside the container. This does not need to match the gid on the host, The (numeric) gid to run as inside the container. This does not need to match the gid on the host,
which can be modified with `RemapUsers`, but if that is not specified, this gid is also used on the host. which can be modified with `RemapUsers`, but if that is not specified, this gid is also used on the host.
#### `NoNewPrivileges=` (defaults to `yes`) #### `NoNewPrivileges=` (defaults to `no`)
If enabled (which is the default), this disables the container processes from gaining additional privileges via things like If enabled (which is the default), this disables the container processes from gaining additional privileges via things like
setuid and file capabilities. setuid and file capabilities.

2
pkg/systemd/quadlet/quadlet.go
View File

@ -297,7 +297,7 @@ func ConvertContainer(container *parser.UnitFile, isUser bool) (*parser.UnitFile
} }
// Default to no higher level privileges or caps // Default to no higher level privileges or caps
noNewPrivileges := container.LookupBoolean(ContainerGroup, KeyNoNewPrivileges, true) noNewPrivileges := container.LookupBoolean(ContainerGroup, KeyNoNewPrivileges, false)
if noNewPrivileges { if noNewPrivileges {
podman.add("--security-opt=no-new-privileges") podman.add("--security-opt=no-new-privileges")
} }

1
test/e2e/quadlet/basic.container
View File

@ -10,7 +10,6 @@
## assert-podman-args "--runtime" "/usr/bin/crun" ## assert-podman-args "--runtime" "/usr/bin/crun"
## assert-podman-args "--cgroups=split" ## assert-podman-args "--cgroups=split"
## assert-podman-args "--sdnotify=conmon" ## assert-podman-args "--sdnotify=conmon"
## assert-podman-args "--security-opt=no-new-privileges"
## assert-podman-args "--cap-drop=all" ## assert-podman-args "--cap-drop=all"
## assert-podman-args "--read-only" ## assert-podman-args "--read-only"
## !assert-podman-args "--read-only-tmpfs=false" ## !assert-podman-args "--read-only-tmpfs=false"