Skip to content

Reject sandbox modes != namespace when uid != 0

German Maglione requested to merge ghm-virtio-fs/virtiofsd:libcapng_failed into main

Inside drop_child_capabilities() there is a call to capng:apply() that clears the bounding set. It causes libcap-ng to fail when calling virtiofsd-rs with '--sandbox none' by an unprivileged user, because it doesn't have the CAP_SETPCAP capability.

Edited by Sergio Lopez

Merge request reports