colin/nix-files
1
0
Fork 1
Code Issues Pull Requests Projects Releases Wiki Activity

bunpen/seatd: remove CAP_NET_ADMIN: creating a net namespace does NOT require that, rather it was a quirk in bwrap

Browse Source
This commit is contained in:
Colin
2024-09-07 18:32:29 +00:00
parent 9b8bdfaf5e
commit 30060e4bb1
2 changed files with 6 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
hosts/common/programs/seatd.nix
View File

@@ -67,7 +67,7 @@ lib.mkMerge [
# ];
serviceConfig.CapabilityBoundingSet = [
"CAP_DAC_OVERRIDE" #< needed, to access /dev/tty
"CAP_NET_ADMIN" #< needed by bwrap/bunpen to unshare net namespace (undocumented requirement?)
# "CAP_NET_ADMIN" #< only needed by bwrap
"CAP_SETPCAP" #< TODO: this is a limitation of bunpen, which wants to add caps from bounding to inheritable, and drop from ambient
"CAP_SYS_ADMIN" #< needed by bwrap/bunpen
"CAP_SYS_TTY_CONFIG"

16
pkgs/additional/bunpen/restrict/namespace.ha
View File

@@ -43,19 +43,13 @@ export fn namespace_restrict(what: *resources) void = {
let unshare_keep_users = what_to_unshare & ~rt::ext::clone_flag::NEWUSER;
if (try_unshare(unshare_keep_users)) {
what_to_unshare = 0;
} else {
log::println("[namespace] failed to unshare w/o user namespace. raising caps and trying again");
} else if ((what_to_unshare & rt::ext::clone_flag::NEWNS) != 0) {
log::println("[namespace] failed to unshare w/o user namespace. raising CAP_SYS_ADMIN and trying again");
let raise_caps = rt::ext::CAPS_NONE;
if ((what_to_unshare & rt::ext::clone_flag::NEWNS) != 0) {
caps_add(&raise_caps, rt::ext::cap::SYS_ADMIN);
// i can't find documentation that unsharing the netns requires CAP_NET_ADMIN,
// but empirically, it does (? e.g. remove this and seatd fails)
if ((what_to_unshare & rt::ext::clone_flag::NEWNET) != 0)
caps_add(&raise_caps, rt::ext::cap::NET_ADMIN);
};
if (try_unshare_with(unshare_keep_users, raise_caps)) {
caps_add(&raise_caps, rt::ext::cap::SYS_ADMIN);
if (try_unshare_with(unshare_keep_users, raise_caps))
what_to_unshare = 0;
};
};
};