Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Capabilities checking not working in kubernetes pod with shareProcessNamespace enabled #43

Open
mxmdt3 opened this issue Nov 6, 2024 · 3 comments

Comments

@mxmdt3
Copy link

mxmdt3 commented Nov 6, 2024

In entrypoint /docker-entrypoint.sh, capabilities are checked on process with PID 1 with 'getpcaps 1'. However when running in a kubernetespod with shareProcessNamespace enabled (for log rotating purposes), the running process does not hold PID 1.
Could you check against current PID instead of PID 1?
Thanks

@jasonish
Copy link
Owner

jasonish commented Nov 6, 2024

It looks like chaning getpcaps 1 to getpcaps 0 is enough, as that uses the current process. Sound OK to you?

@mxmdt3
Copy link
Author

mxmdt3 commented Nov 6, 2024

It sounds good to me

@jasonish
Copy link
Owner

jasonish commented Nov 6, 2024

I've pushed new images with this change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants