dotcloud/docker — pull request #6083 by bernerdschaefer (2014-05-28 15:02:33+00:00)
Title: SETUID/SETGID not required for changing user

With this changeset, providing a user in container configuration does not require that you also grant SETUID and SETGID capabilities to the contained process.

It accomplishes this by:

- dropping the bounding set while still fully privileged
- calling prctl(PR_SET_KEEPCAPS, 1), to preserve capabilities while changing users
- changing user (unchanged)
- calling prctl(PR_SET_KEEPCAPS, 0) to clear the setting
- dropping capabilities (unchanged)

---

### before

```
> grep capabilities container.json
"capabilities": ["SETUID", "SETGID"],
> sudo nsinit exec /bin/grep Cap /proc/self/status
CapInh:	00000000000000c0
CapPrm:	0000000000000000
CapEff:	0000000000000000
CapBnd:	00000000000000c0

> grep capabilities container.json
"capabilities": [],
> sudo nsinit exec /bin/grep Cap /proc/self/status
2014/05/28 15:00:43 unable to initialize for container: finalize namespace setup user setgroups operation not permitted
```

### after

```
> grep capabilities container.json
"capabilities": ["SETUID", "SETGID"],
> sudo nsinit exec /bin/grep Cap /proc/self/status
CapInh:	00000000000000c0
CapPrm:	0000000000000000
CapEff:	0000000000000000
CapBnd:	00000000000000c0

> grep capabilities container.json
"capabilities": [],

> sudo nsinit exec /bin/grep Cap /proc/self/status
CapInh:	0000000000000000
CapPrm:	0000000000000000
CapEff:	0000000000000000
CapBnd:	0000000000000000
```