I ended up using `strace --failed` to find out that iptables needs CAP_NET_RAW: podman run --rm -it --cap-add NET_ADMIN,SYS_PTRACE --uidmap 0:60000:1000 --gidmap 0:60000:1000 alpine:3.12 \ sh -c 'apk add iptables strace ; strace --failed iptables -t raw -A PREROUTING -j DROP' This gives: socket(AF_INET, SOCK_RAW, IPPROTO_RAW) = -1 EPERM (Operation not permitted) BPF was another avenue I tried but it wasn't as fruitful as good old strace; bcc-tools includes a tool `capable` which traces all capability checks, but doesn't (yet) show the outcome of the check, also bpftrace has an example called `capable.bt` that does the same thing using bpftrace. I'm pretty sure that this is the way to go but it's something of a learning curve for me at least. Links: https://github.com/iovisor/bcc/blob/master/tools/capable.py https://github.com/iovisor/bpftrace/blob/master/tools/capable.bt Greetings, Joost Molenaar ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐ On Thursday, January 7, 2021 9:43 AM, Valentin Rothberg <rothberg@redhat.com> wrote:
Hi Jorge,
Thanks for reaching out!
There is a cool tool that can do that: https://github.com/clustership/inspektor-gadget/
Note that inspektor gadget is designed to run in Kubernetes, so it may not be as straight forward as running a Podman command. We have another tool to easily generate custom seccomp profiles (https://github.com/containers/oci-seccomp-bpf-hook) and have ideas to extend it to also cover capabilities, but we haven't found time to tackle that yet.
Kind regards, Valentin
On Wed, Jan 6, 2021 at 9:56 PM Jorge Fábregas <jorge.fabregas@gmail.com> wrote:
Hi,
Is there an easy way to figure out which capabilities are needed for a container other than playing out with the cap-drop & cap-add options?
Thanks.
-- Jorge _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io