From 21cb5a8c7bcc90c42743ffd15cd11a55bf66993d Mon Sep 17 00:00:00 2001 From: Giuseppe Scrivano Date: Mon, 28 Feb 2022 11:06:50 +0100 Subject: [PATCH 2/2] exec: --cap do not set inheritable capabilities Closes: CVE-2022-27650 Signed-off-by: Giuseppe Scrivano (cherry picked from commit 1aeeed2e4fdeffb4875c0d0b439915894594c8c6) --- src/exec.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/exec.c b/src/exec.c index bf6c05f..8c9862d 100644 --- a/src/exec.c +++ b/src/exec.c @@ -250,8 +250,8 @@ crun_command_exec (struct crun_global_arguments *global_args, int argc, char **a capabilities->effective = exec_options.cap; capabilities->effective_len = exec_options.cap_size; - capabilities->inheritable = dup_array (exec_options.cap, exec_options.cap_size); - capabilities->inheritable_len = exec_options.cap_size; + capabilities->inheritable = NULL; + capabilities->inheritable_len = 0; capabilities->bounding = dup_array (exec_options.cap, exec_options.cap_size); capabilities->bounding_len = exec_options.cap_size; -- 2.35.1