{"action":"created","issue":{"url":"https://api.github.com/repos/coreos/rkt/issues/2648","repository_url":"https://api.github.com/repos/coreos/rkt","labels_url":"https://api.github.com/repos/coreos/rkt/issues/2648/labels{/name}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/2648/comments","events_url":"https://api.github.com/repos/coreos/rkt/issues/2648/events","html_url":"https://github.com/coreos/rkt/issues/2648","id":155271719,"number":2648,"title":"docs: security: capabilities should be documented","user":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/coreos/rkt/labels/area/security","name":"area/security","color":"bfe5bf"},{"url":"https://api.github.com/repos/coreos/rkt/labels/kind/documentation","name":"kind/documentation","color":"c7def8"},{"url":"https://api.github.com/repos/coreos/rkt/labels/priority/P1","name":"priority/P1","color":"eb6420"}],"state":"open","locked":false,"assignee":{"login":"lucab","id":98086,"avatar_url":"https://avatars.githubusercontent.com/u/98086?v=3","gravatar_id":"","url":"https://api.github.com/users/lucab","html_url":"https://github.com/lucab","followers_url":"https://api.github.com/users/lucab/followers","following_url":"https://api.github.com/users/lucab/following{/other_user}","gists_url":"https://api.github.com/users/lucab/gists{/gist_id}","starred_url":"https://api.github.com/users/lucab/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucab/subscriptions","organizations_url":"https://api.github.com/users/lucab/orgs","repos_url":"https://api.github.com/users/lucab/repos","events_url":"https://api.github.com/users/lucab/events{/privacy}","received_events_url":"https://api.github.com/users/lucab/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/coreos/rkt/milestones/38","html_url":"https://github.com/coreos/rkt/milestones/v1.7.0","labels_url":"https://api.github.com/repos/coreos/rkt/milestones/38/labels","id":1722993,"number":38,"title":"v1.7.0","description":"","creator":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"open_issues":30,"closed_issues":32,"state":"open","created_at":"2016-04-21T15:03:03Z","updated_at":"2016-05-24T14:39:31Z","due_on":"2016-05-25T22:00:00Z","closed_at":null},"comments":1,"created_at":"2016-05-17T14:19:43Z","updated_at":"2016-05-24T15:12:21Z","closed_at":null,"body":"Since rkt 1.6.0, the way rkt handles per-app capabilities is better defined. See:\r\n- https://github.com/coreos/rkt/pull/2589\r\n- https://github.com/appc/spec/pull/600\r\n\r\nHowever, this is not [documented](https://github.com/coreos/rkt/tree/master/Documentation). This should be documented:\r\n- the mechanism, how it is implemented\r\n- how to use them in ACIs. As an example of scenarios that needs caps, there is:\r\n - rkt in rkt #2158\r\n - flannel: [build-aci.sh#L21](https://github.com/coreos/flannel/blob/master/dist/build-aci.sh#L21) (it should probably be updated to use acbuild instead of actool btw)\r\n- best practices"},"comment":{"url":"https://api.github.com/repos/coreos/rkt/issues/comments/221303148","html_url":"https://github.com/coreos/rkt/issues/2648#issuecomment-221303148","issue_url":"https://api.github.com/repos/coreos/rkt/issues/2648","id":221303148,"user":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"created_at":"2016-05-24T15:12:21Z","updated_at":"2016-05-24T15:12:21Z","body":"@lucab About capabilities, it should also be documented that if the process has CAP_SYS_PTRACE, then it can read /proc/1/root, and then the app can escape the isolation between stage1 and stage2 (#2483) and reach protected files in /proc and /sys (#2484)."}}
{"actor":{"display_login":"alban"}}