{"action":"opened","number":36587,"pull_request":{"url":"https://api.github.com/repos/moby/moby/pulls/36587","id":174904705,"html_url":"https://github.com/moby/moby/pull/36587","diff_url":"https://github.com/moby/moby/pull/36587.diff","patch_url":"https://github.com/moby/moby/pull/36587.patch","issue_url":"https://api.github.com/repos/moby/moby/issues/36587","number":36587,"state":"open","locked":false,"title":"If container will run as non root user, drop permitted, effective caps early","user":{"login":"justincormack","id":482364,"avatar_url":"https://avatars0.githubusercontent.com/u/482364?v=4","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"body":"As soon as the initial executable in the container is executed as a non root user,\r\npermitted and effective capabilities are dropped. Drop them earlier than this, so\r\nthat they are dropped before executing the file. The main effect of this is that\r\nif `CAP_DAC_OVERRIDE` is set (the default) the user will not be able to execute\r\nfiles they do not have permission to execute, which previously they could.\r\n\r\nThe old behaviour was somewhat surprising and the new one is definitely correct,\r\nbut it is not in any meaningful way exploitable, and I do not think it is\r\nnecessary to backport this fix. It is unlikely to have any negative effects as\r\nalmost all executables have world execute permission anyway.\r\n\r\nUse the bounding set not the effective set as the canonical set of capabilities, as\r\neffective will now vary.\r\n\r\nSigned-off-by: Justin Cormack <justin.cormack@docker.com>\r\n\r\n![owl surprise](https://user-images.githubusercontent.com/482364/37395679-b4c016cc-276e-11e8-9ce7-b4831e006679.jpg)\r\n","created_at":"2018-03-14T10:02:56Z","updated_at":"2018-03-14T10:02:56Z","closed_at":null,"merged_at":null,"merge_commit_sha":null,"assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/moby/moby/pulls/36587/commits","review_comments_url":"https://api.github.com/repos/moby/moby/pulls/36587/comments","review_comment_url":"https://api.github.com/repos/moby/moby/pulls/comments{/number}","comments_url":"https://api.github.com/repos/moby/moby/issues/36587/comments","statuses_url":"https://api.github.com/repos/moby/moby/statuses/5a2cdb1f99f4cb8264b448c4189f53ea210cbbc1","head":{"label":"justincormack:unpriv-caps","ref":"unpriv-caps","sha":"5a2cdb1f99f4cb8264b448c4189f53ea210cbbc1","user":{"login":"justincormack","id":482364,"avatar_url":"https://avatars0.githubusercontent.com/u/482364?v=4","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"repo":{"id":45676328,"name":"docker","full_name":"justincormack/docker","owner":{"login":"justincormack","id":482364,"avatar_url":"https://avatars0.githubusercontent.com/u/482364?v=4","gravatar_id":"","url":"https://api.github.com/users/justincormack","html_url":"https://github.com/justincormack","followers_url":"https://api.github.com/users/justincormack/followers","following_url":"https://api.github.com/users/justincormack/following{/other_user}","gists_url":"https://api.github.com/users/justincormack/gists{/gist_id}","starred_url":"https://api.github.com/users/justincormack/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/justincormack/subscriptions","organizations_url":"https://api.github.com/users/justincormack/orgs","repos_url":"https://api.github.com/users/justincormack/repos","events_url":"https://api.github.com/users/justincormack/events{/privacy}","received_events_url":"https://api.github.com/users/justincormack/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/justincormack/docker","description":"Docker - the open-source application container engine","fork":true,"url":"https://api.github.com/repos/justincormack/docker","forks_url":"https://api.github.com/repos/justincormack/docker/forks","keys_url":"https://api.github.com/repos/justincormack/docker/keys{/key_id}","collaborators_url":"https://api.github.com/repos/justincormack/docker/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/justincormack/docker/teams","hooks_url":"https://api.github.com/repos/justincormack/docker/hooks","issue_events_url":"https://api.github.com/repos/justincormack/docker/issues/events{/number}","events_url":"https://api.github.com/repos/justincormack/docker/events","assignees_url":"https://api.github.com/repos/justincormack/docker/assignees{/user}","branches_url":"https://api.github.com/repos/justincormack/docker/branches{/branch}","tags_url":"https://api.github.com/repos/justincormack/docker/tags","blobs_url":"https://api.github.com/repos/justincormack/docker/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/justincormack/docker/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/justincormack/docker/git/refs{/sha}","trees_url":"https://api.github.com/repos/justincormack/docker/git/trees{/sha}","statuses_url":"https://api.github.com/repos/justincormack/docker/statuses/{sha}","languages_url":"https://api.github.com/repos/justincormack/docker/languages","stargazers_url":"https://api.github.com/repos/justincormack/docker/stargazers","contributors_url":"https://api.github.com/repos/justincormack/docker/contributors","subscribers_url":"https://api.github.com/repos/justincormack/docker/subscribers","subscription_url":"https://api.github.com/repos/justincormack/docker/subscription","commits_url":"https://api.github.com/repos/justincormack/docker/commits{/sha}","git_commits_url":"https://api.github.com/repos/justincormack/docker/git/commits{/sha}","comments_url":"https://api.github.com/repos/justincormack/docker/comments{/number}","issue_comment_url":"https://api.github.com/repos/justincormack/docker/issues/comments{/number}","contents_url":"https://api.github.com/repos/justincormack/docker/contents/{+path}","compare_url":"https://api.github.com/repos/justincormack/docker/compare/{base}...{head}","merges_url":"https://api.github.com/repos/justincormack/docker/merges","archive_url":"https://api.github.com/repos/justincormack/docker/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/justincormack/docker/downloads","issues_url":"https://api.github.com/repos/justincormack/docker/issues{/number}","pulls_url":"https://api.github.com/repos/justincormack/docker/pulls{/number}","milestones_url":"https://api.github.com/repos/justincormack/docker/milestones{/number}","notifications_url":"https://api.github.com/repos/justincormack/docker/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/justincormack/docker/labels{/name}","releases_url":"https://api.github.com/repos/justincormack/docker/releases{/id}","deployments_url":"https://api.github.com/repos/justincormack/docker/deployments","created_at":"2015-11-06T10:44:38Z","updated_at":"2016-01-12T10:12:10Z","pushed_at":"2018-03-14T10:02:56Z","git_url":"git://github.com/justincormack/docker.git","ssh_url":"git@github.com:justincormack/docker.git","clone_url":"https://github.com/justincormack/docker.git","svn_url":"https://github.com/justincormack/docker","homepage":"http://www.docker.com","size":130846,"stargazers_count":0,"watchers_count":0,"language":"Go","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"moby:master","ref":"master","sha":"9e1c4f9906176ee120398d1568e8ff395382d675","user":{"login":"moby","id":27259197,"avatar_url":"https://avatars1.githubusercontent.com/u/27259197?v=4","gravatar_id":"","url":"https://api.github.com/users/moby","html_url":"https://github.com/moby","followers_url":"https://api.github.com/users/moby/followers","following_url":"https://api.github.com/users/moby/following{/other_user}","gists_url":"https://api.github.com/users/moby/gists{/gist_id}","starred_url":"https://api.github.com/users/moby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moby/subscriptions","organizations_url":"https://api.github.com/users/moby/orgs","repos_url":"https://api.github.com/users/moby/repos","events_url":"https://api.github.com/users/moby/events{/privacy}","received_events_url":"https://api.github.com/users/moby/received_events","type":"Organization","site_admin":false},"repo":{"id":7691631,"name":"moby","full_name":"moby/moby","owner":{"login":"moby","id":27259197,"avatar_url":"https://avatars1.githubusercontent.com/u/27259197?v=4","gravatar_id":"","url":"https://api.github.com/users/moby","html_url":"https://github.com/moby","followers_url":"https://api.github.com/users/moby/followers","following_url":"https://api.github.com/users/moby/following{/other_user}","gists_url":"https://api.github.com/users/moby/gists{/gist_id}","starred_url":"https://api.github.com/users/moby/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moby/subscriptions","organizations_url":"https://api.github.com/users/moby/orgs","repos_url":"https://api.github.com/users/moby/repos","events_url":"https://api.github.com/users/moby/events{/privacy}","received_events_url":"https://api.github.com/users/moby/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/moby/moby","description":"Moby Project - a collaborative project for the container ecosystem to assemble container-based systems","fork":false,"url":"https://api.github.com/repos/moby/moby","forks_url":"https://api.github.com/repos/moby/moby/forks","keys_url":"https://api.github.com/repos/moby/moby/keys{/key_id}","collaborators_url":"https://api.github.com/repos/moby/moby/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/moby/moby/teams","hooks_url":"https://api.github.com/repos/moby/moby/hooks","issue_events_url":"https://api.github.com/repos/moby/moby/issues/events{/number}","events_url":"https://api.github.com/repos/moby/moby/events","assignees_url":"https://api.github.com/repos/moby/moby/assignees{/user}","branches_url":"https://api.github.com/repos/moby/moby/branches{/branch}","tags_url":"https://api.github.com/repos/moby/moby/tags","blobs_url":"https://api.github.com/repos/moby/moby/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/moby/moby/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/moby/moby/git/refs{/sha}","trees_url":"https://api.github.com/repos/moby/moby/git/trees{/sha}","statuses_url":"https://api.github.com/repos/moby/moby/statuses/{sha}","languages_url":"https://api.github.com/repos/moby/moby/languages","stargazers_url":"https://api.github.com/repos/moby/moby/stargazers","contributors_url":"https://api.github.com/repos/moby/moby/contributors","subscribers_url":"https://api.github.com/repos/moby/moby/subscribers","subscription_url":"https://api.github.com/repos/moby/moby/subscription","commits_url":"https://api.github.com/repos/moby/moby/commits{/sha}","git_commits_url":"https://api.github.com/repos/moby/moby/git/commits{/sha}","comments_url":"https://api.github.com/repos/moby/moby/comments{/number}","issue_comment_url":"https://api.github.com/repos/moby/moby/issues/comments{/number}","contents_url":"https://api.github.com/repos/moby/moby/contents/{+path}","compare_url":"https://api.github.com/repos/moby/moby/compare/{base}...{head}","merges_url":"https://api.github.com/repos/moby/moby/merges","archive_url":"https://api.github.com/repos/moby/moby/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/moby/moby/downloads","issues_url":"https://api.github.com/repos/moby/moby/issues{/number}","pulls_url":"https://api.github.com/repos/moby/moby/pulls{/number}","milestones_url":"https://api.github.com/repos/moby/moby/milestones{/number}","notifications_url":"https://api.github.com/repos/moby/moby/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/moby/moby/labels{/name}","releases_url":"https://api.github.com/repos/moby/moby/releases{/id}","deployments_url":"https://api.github.com/repos/moby/moby/deployments","created_at":"2013-01-18T18:10:57Z","updated_at":"2018-03-14T09:55:42Z","pushed_at":"2018-03-14T08:27:28Z","git_url":"git://github.com/moby/moby.git","ssh_url":"git@github.com:moby/moby.git","clone_url":"https://github.com/moby/moby.git","svn_url":"https://github.com/moby/moby","homepage":"https://mobyproject.org/","size":131997,"stargazers_count":48010,"watchers_count":48010,"language":"Go","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":14158,"mirror_url":null,"archived":false,"open_issues_count":3104,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":14158,"open_issues":3104,"watchers":48010,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/moby/moby/pulls/36587"},"html":{"href":"https://github.com/moby/moby/pull/36587"},"issue":{"href":"https://api.github.com/repos/moby/moby/issues/36587"},"comments":{"href":"https://api.github.com/repos/moby/moby/issues/36587/comments"},"review_comments":{"href":"https://api.github.com/repos/moby/moby/pulls/36587/comments"},"review_comment":{"href":"https://api.github.com/repos/moby/moby/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/moby/moby/pulls/36587/commits"},"statuses":{"href":"https://api.github.com/repos/moby/moby/statuses/5a2cdb1f99f4cb8264b448c4189f53ea210cbbc1"}},"author_association":"CONTRIBUTOR","merged":false,"mergeable":null,"rebaseable":null,"mergeable_state":"unknown","merged_by":null,"comments":0,"review_comments":0,"maintainer_can_modify":true,"commits":1,"additions":9,"deletions":3,"changed_files":2}}
{"actor":{"display_login":"justincormack"}}