From b5ba4b04cef13cbe2d9a0ee9d4781a359fc20f5e Mon Sep 17 00:00:00 2001
From: bwzhang <zhangbowei@kylinos.cn>
Date: Mon, 11 Mar 2024 16:12:02 +0800
Subject: [PATCH] fix CVE-2022-27652

---
 server/container_create.go | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/server/container_create.go b/server/container_create.go
index 520efc7..7de2676 100644
--- a/server/container_create.go
+++ b/server/container_create.go
@@ -292,6 +292,9 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
 	// and pods expect that switching to a non-root user results in the capabilities being
 	// dropped. This should be revisited in the future.
 	specgen.Config.Process.Capabilities.Ambient = []string{}
+	// Also remove all inheritable capabilities in accordance with CVE-2022-27652,
+	// as it's not idiomatic for a manager of processes to set them.
+	specgen.Config.Process.Capabilities.Inheritable = []string{}
 
 	if caps == nil {
 		return nil
@@ -329,9 +332,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
 			if err := specgen.AddProcessCapabilityEffective(c); err != nil {
 				return err
 			}
-			if err := specgen.AddProcessCapabilityInheritable(c); err != nil {
-				return err
-			}
 			if err := specgen.AddProcessCapabilityPermitted(c); err != nil {
 				return err
 			}
@@ -345,9 +345,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
 			if err := specgen.DropProcessCapabilityEffective(c); err != nil {
 				return err
 			}
-			if err := specgen.DropProcessCapabilityInheritable(c); err != nil {
-				return err
-			}
 			if err := specgen.DropProcessCapabilityPermitted(c); err != nil {
 				return err
 			}
@@ -369,9 +366,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
 		if err := specgen.AddProcessCapabilityEffective(capPrefixed); err != nil {
 			return err
 		}
-		if err := specgen.AddProcessCapabilityInheritable(capPrefixed); err != nil {
-			return err
-		}
 		if err := specgen.AddProcessCapabilityPermitted(capPrefixed); err != nil {
 			return err
 		}
@@ -388,9 +382,6 @@ func setupCapabilities(specgen *generate.Generator, caps *types.Capability, defa
 		if err := specgen.DropProcessCapabilityEffective(capPrefixed); err != nil {
 			return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err)
 		}
-		if err := specgen.DropProcessCapabilityInheritable(capPrefixed); err != nil {
-			return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err)
-		}
 		if err := specgen.DropProcessCapabilityPermitted(capPrefixed); err != nil {
 			return fmt.Errorf("failed to drop cap %s %v", capPrefixed, err)
 		}
-- 
2.20.1

