capability: can't raise ambient and drop bounding caps for other process

capability/capability.go

@@ -8,6 +8,8 @@
 // Package capability provides utilities for manipulating POSIX capabilities.
 package capability
 
+import "errors"
+
 type Capabilities interface {
 	// Get check whether a capability present in the given
 	// capabilities set. The 'which' value should be one of EFFECTIVE,
@@ -61,6 +63,11 @@ type Capabilities interface {
 	Apply(kind CapType) error
 }
 
+var (
+	errBoundingNotMine = errors.New("not support drop bounding cap of other process")
+	errAmbientNotMine  = errors.New("not support modify ambient cap of other process")
+)
+
 // NewPid initializes a new [Capabilities] object for given pid when
 // it is nonzero, or for the current process if pid is 0.
 //

capability/capability_linux.go

@@ -334,6 +334,9 @@ func (c *capsV3) Apply(kind CapType) (err error) {
 	}
 	if kind&BOUNDS == BOUNDS {
 		var data [2]capData
+		if c.hdr.pid != 0 {
+			return errBoundingNotMine
+		}
 		err = capget(&c.hdr, &data[0])
 		if err != nil {
 			return
@@ -364,6 +367,9 @@ func (c *capsV3) Apply(kind CapType) (err error) {
 	}
 
 	if kind&AMBS == AMBS {
+		if c.hdr.pid != 0 {
+			return errAmbientNotMine
+		}
 		err = prctl(pr_CAP_AMBIENT, pr_CAP_AMBIENT_CLEAR_ALL, 0, 0, 0)
 		if err != nil && err != syscall.EINVAL { //nolint:errorlint // Errors from syscall are bare.
 			// Ignore EINVAL as not supported on kernels before 4.3

capability/capability_test.go

@@ -2,13 +2,13 @@
 // Use of this source code is governed by a BSD-style
 // license that can be found in the LICENSE file.
 
-package capability_test
+package capability
 
 import (
+	"errors"
+	"os/exec"
 	"runtime"
 	"testing"
-
-	. "github.com/moby/sys/capability"
 )
 
 // Based on the fact Go 1.18+ supports Linux >= 2.6.32, and
@@ -151,3 +151,40 @@ func TestAmbientCapSet(t *testing.T) {
 		}
 	}
 }
+
+func TestApplyCapsForOtherProcess(t *testing.T) {
+	if runtime.GOOS != "linux" {
+		return
+	}
+	requirePCapSet(t)
+
+	cmd := exec.Command("sleep", "sleep", "infinity")
+	if err := cmd.Start(); err != nil {
+		t.Fatal(err)
+	}
+	defer func() {
+		_ = cmd.Process.Kill()
+		_, _ = cmd.Process.Wait()
+	}()
+
+	pid, err := NewPid(cmd.Process.Pid)
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	if err = pid.Load(); err != nil {
+		t.Fatal(err)
+	}
+	err = pid.Apply(BOUNDING)
+	if !errors.Is(err, errBoundingNotMine) {
+		t.Fatalf("expected not support error when drop bounding caps for other process, but got: %v", err)
+	}
+	err = pid.Apply(CAPS)
+	if err != nil {
+		t.Fatal(err)
+	}
+	err = pid.Apply(AMBIENT)
+	if !errors.Is(err, errAmbientNotMine) {
+		t.Fatalf("expected not support error when rasing ambient caps for other process, but got: %v", err)
+	}
+}