capability: we should only raise ambient cap for our own process

Signed-off-by: lifubang <lifubang@acmcoder.com>
moby · Oct 9, 2024 · 3ce9f85 · 3ce9f85
1 parent fc58436
commit 3ce9f85
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/capability/capability_linux.go b/capability/capability_linux.go
@@ -367,6 +367,9 @@ func (c *capsV3) Apply(kind CapType) error {
 	}
 
 	if kind&AMBS == AMBS {
+		if c.hdr.pid != 0 {
+			return errors.New("not support to raise ambient cap for other process")
+		}
 		// Ignore EINVAL as not supported on kernels before 4.3
 		err = ignoreEINVAL(ambientClearAll())
 		if err != nil {