Evidence · DiggingBeagle record
Kata Containers PR 13615: rustjail capability bound and namespace correctness
Kata Containers PR 13615: rustjail capability bound and namespace correctness
- Source role
- primary disclosure
Evidence record
Kata Containers PR 13615: rustjail capability bound and namespace correctness
Claim-level citations (2)
- supportsKata Containers jail could trust a spoofed procfs value when dropping capabilities: The Kata Containers rustjail change obtains the capability ceiling through PR_CAPBSET_READ rather than trusting a namespace-influenced procfs file and tightens checks around namespace entry.
Kata Containers pull request 13615, agent: harden capability and namespace handling
- supportsKata Containers jail could trust a spoofed procfs value when dropping capabilities: Kata Containers maintainers describe a rustjail trust issue where a process could obtain an incorrect capability ceiling from namespace-influenced /proc data, and a fix using PR_CAPBSET_READ with namespace handling.
PR description: /proc/sys/kernel/cap_last_cap, capability bounding set and corrective tests