Allow actors to opt in/out of Linux capabilities

[Noureldin (nmn3m)]

Fixes #744

• Tests pass
• Appropriate changes to documentation are included in the PR

[Benjamin Elder (BenTheElder)]

can we add an e2e test for this, for both uVM and gvisor? plumbing it is one thing, making sure it is effective is another, atelet doesn't actually spawn the containers

[Benjamin Elder (BenTheElder)]

maybe we should expand this to run the whole default suite instead?

[Benjamin Elder (BenTheElder)]

Feel free to drop me a ping in the slack for follow-up when these are fixed / PR is rebased and I'll try to come back to this faster, thanks!

[Benjamin Elder (BenTheElder)]

🤖 should-fix 🟡 – Leave Inheritable empty. It was harmless when this was three fixed, innocuous capabilities; now a template can put SYS_ADMIN, DAC_OVERRIDE, or SETUID there.

Inheritable grants the process itself nothing. It only takes effect on execve, ANDed with the file's own inheritable set — which is why containerd dropped it in the fix for CVE-2022-24769, and why CRI-O and Docker set it empty too. The exposure is a container that starts as root and then drops to an unprivileged uid (su, gosu, a setuid binary) before exec'ing something with file capabilities.

Removing it costs nothing here. The spec pins User{UID: 0, GID: 0}, and for a real-uid-0 process exec'ing a file with no file capabilities the kernel treats F(permitted) and F(inheritable) as all-ones, so P'(permitted) = P(bounding). Propagation to children rides on Bounding, not Inheritable.

The capabilities e2e already asserts only bounding, effective, permitted and an empty ambient, so it would not need to change — TestBuildActorOCISpecCapabilities in oci_test.go would.

[Benjamin Elder (BenTheElder)]

🤖 nit 🟢 – Worth naming the default set here. A reader writing add needs to know what they already have, and one writing drop needs it even more — right now the only way to find out is to read defaultCapabilities in cmd/atelet/oci.go. It is three entries: AUDIT_WRITE, KILL, NET_BIND_SERVICE.

[Benjamin Elder (BenTheElder)]

And sorry for the delay, the incoming PR volume is high 😅

[Noureldin (nmn3m)]

Benjamin Elder (@BenTheElder) TestActorCapabilities passed on gVisor (24.75s, both subtests), but the overall run failed on two tests. I’m not sure how to interpret the failures. Could you take a look and share your feedback?

I also ran make test locally, and it passed, so I’m not sure what’s causing the difference.

[Benjamin Elder (BenTheElder)]

You can search the logs for --- fail (go test output format) in github to find the actual failures, also rebasing on main picks up fixes (we might do #1029)

TestMakeCert failed in unit tests and a couple tests failed in gvisor, they look unrelated, I'm rerunning

[Benjamin Elder (BenTheElder)]

LGTM, needs a rebase (couldn't merge before due to flaking tests it seems, rebase on main should help with that as well)