capability: can't raise ambient and drop bounding caps for other process

capability/capability.go

@@ -8,6 +8,8 @@
 // Package capability provides utilities for manipulating POSIX capabilities.
 package capability
 
+import "errors"
+
 type Capabilities interface {
  // Get check whether a capability present in the given
  // capabilities set. The 'which' value should be one of EFFECTIVE,
@@ -61,6 +63,11 @@ type Capabilities interface {
  Apply(kind CapType) error
 }
 
+var (
+ errBoundingNotMine = errors.New("not support drop bounding cap of other process")
+ errAmbientNotMine = errors.New("not support modify ambient cap of other process")
+)
+
 // NewPid initializes a new [Capabilities] object for given pid when
 // it is nonzero, or for the current process if pid is 0.
 //

capability/capability_linux.go

@@ -334,6 +334,9 @@ func (c *capsV3) Apply(kind CapType) (err error) {
  }
  if kind&BOUNDS == BOUNDS {
  var data [2]capData
+ if c.hdr.pid != 0 {
+ return errBoundingNotMine
+ }
  err = capget(&c.hdr, &data[0])
  if err != nil {
  return
@@ -364,6 +367,9 @@ func (c *capsV3) Apply(kind CapType) (err error) {
  }
 
  if kind&AMBS == AMBS {
+ if c.hdr.pid != 0 {
+ return errAmbientNotMine
+ }
  err = prctl(pr_CAP_AMBIENT, pr_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0)
  if err != nil && err != syscall.EINVAL { //nolint:errorlint // Errors from syscall are bare.
  // Ignore EINVAL as not supported on kernels before 4.3

capability/capability_test.go

@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package capability_test
+package capability
 
 import (
+ "errors"
+ "os/exec"
  "runtime"
  "testing"
-
- . "github.com/moby/sys/capability"
 )
 
 // Based on the fact Go 1.18+ supports Linux >= 2.6.32, and
@@ -151,3 +151,40 @@ func TestAmbientCapSet(t *testing.T) {
  }
  }
 }
+
+func TestApplyCapsForOtherProcess(t *testing.T) {
+ if runtime.GOOS != "linux" {
+ return
+ }
+ requirePCapSet(t)
+
+ cmd := exec.Command("sleep", "sleep", "infinity")
+ if err := cmd.Start(); err != nil {
+ t.Fatal(err)
+ }
+ defer func() {
+ _ = cmd.Process.Kill()
+ _, _ = cmd.Process.Wait()
+ }()
+
+ pid, err := NewPid(cmd.Process.Pid)
+ if err != nil {
+ t.Fatal(err)
+ }
+
+ if err = pid.Load(); err != nil {
+ t.Fatal(err)
+ }
+ err = pid.Apply(BOUNDING)
+ if !errors.Is(err, errBoundingNotMine) {
+ t.Fatalf("expected not support error when drop bounding caps for other process, but got: %v", err)
+ }
+ err = pid.Apply(CAPS)
+ if err != nil {
+ t.Fatal(err)
+ }
+ err = pid.Apply(AMBIENT)
+ if !errors.Is(err, errAmbientNotMine) {
+ t.Fatalf("expected not support error when rasing ambient caps for other process, but got: %v", err)
+ }
+}