diff --git a/capability/capability_linux.go b/capability/capability_linux.go index 7fc5c9d..fa0c456 100644 --- a/capability/capability_linux.go +++ b/capability/capability_linux.go @@ -367,6 +367,9 @@ func (c *capsV3) Apply(kind CapType) error { } if kind&AMBS == AMBS { + if c.hdr.pid != 0 { + return errors.New("not support to raise ambient cap for other process") + } // Ignore EINVAL as not supported on kernels before 4.3 err = ignoreEINVAL(ambientClearAll()) if err != nil {