Setting the host time from a docker container gives permission error even with CAP_SYS_TIME
Clash Royale CLAN TAG#URR8PPP up vote
0
down vote
favorite
I'm trying to test docker capabilities usage. So, for this I'm trying to run a container with the --cap-add=SYS_TIME capability, which should allow a process to set the system time, however this is the output I receive:
$ sudo docker run --cap-add=SYS_TIME --rm -it ubuntu bash
root@617c9eb44965:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:17:46 UTC 2018
root@617c9eb44965:/#
If I replace --cap-add with --cap-drop nothing changes in the output:
$ sudo docker run --cap-drop=SYS_TIME --rm -it ubuntu bash
root@46dbb20ad793:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:19:03 UTC 2018
It puzzles me that the date command still outputs the date increased by 2 hours, instead of simply dying with an error (the exit code is 1).
The only thing that I can think of is that seccomp/selinux are coming into play, but I have no idea how to check for that.
Can somebody explain me how can I ensure what is causing the operation not permitted error even when the capability is explicitly set and how to fix that?
System information:
$ uname -a
Linux ws77 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ sudo lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial
$ docker -v
Docker version 1.13.1, build 092cba3
Please, do not mention --privileged. It's broken and I want to do it in the proper way using capabilities/seccomp/selinux etc.
permissions time docker selinux
asked Mar 6 at 8:27
Giacomo Alzetta
1011
add a comment |Â
up vote
0
down vote
favorite
I'm trying to test docker capabilities usage. So, for this I'm trying to run a container with the --cap-add=SYS_TIME capability, which should allow a process to set the system time, however this is the output I receive:
$ sudo docker run --cap-add=SYS_TIME --rm -it ubuntu bash
root@617c9eb44965:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:17:46 UTC 2018
root@617c9eb44965:/#
If I replace --cap-add with --cap-drop nothing changes in the output:
$ sudo docker run --cap-drop=SYS_TIME --rm -it ubuntu bash
root@46dbb20ad793:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:19:03 UTC 2018
It puzzles me that the date command still outputs the date increased by 2 hours, instead of simply dying with an error (the exit code is 1).
The only thing that I can think of is that seccomp/selinux are coming into play, but I have no idea how to check for that.
Can somebody explain me how can I ensure what is causing the operation not permitted error even when the capability is explicitly set and how to fix that?
System information:
$ uname -a
Linux ws77 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ sudo lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial
$ docker -v
Docker version 1.13.1, build 092cba3
Please, do not mention --privileged. It's broken and I want to do it in the proper way using capabilities/seccomp/selinux etc.
permissions time docker selinux
asked Mar 6 at 8:27
Giacomo Alzetta
1011
github.com/moby/moby/issues/8460#issuecomment-258684710, github.com/moby/moby/issues/25622?
– muru
Mar 6 at 8:38
@muru AFAIK I don't use the userns feature., so those links are not relevant. There is no/etc/docker/daemon.jsonfile in my computer andps aux | grep usernsonly returns the grep command as output.
– Giacomo Alzetta
Mar 6 at 8:46
add a comment |Â
up vote
0
down vote
favorite
up vote
0
down vote
favorite
I'm trying to test docker capabilities usage. So, for this I'm trying to run a container with the --cap-add=SYS_TIME capability, which should allow a process to set the system time, however this is the output I receive:
$ sudo docker run --cap-add=SYS_TIME --rm -it ubuntu bash
root@617c9eb44965:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:17:46 UTC 2018
root@617c9eb44965:/#
If I replace --cap-add with --cap-drop nothing changes in the output:
$ sudo docker run --cap-drop=SYS_TIME --rm -it ubuntu bash
root@46dbb20ad793:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:19:03 UTC 2018
It puzzles me that the date command still outputs the date increased by 2 hours, instead of simply dying with an error (the exit code is 1).
The only thing that I can think of is that seccomp/selinux are coming into play, but I have no idea how to check for that.
Can somebody explain me how can I ensure what is causing the operation not permitted error even when the capability is explicitly set and how to fix that?
System information:
$ uname -a
Linux ws77 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ sudo lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial
$ docker -v
Docker version 1.13.1, build 092cba3
Please, do not mention --privileged. It's broken and I want to do it in the proper way using capabilities/seccomp/selinux etc.
permissions time docker selinux
asked Mar 6 at 8:27
Giacomo Alzetta
1011
I'm trying to test docker capabilities usage. So, for this I'm trying to run a container with the --cap-add=SYS_TIME capability, which should allow a process to set the system time, however this is the output I receive:
$ sudo docker run --cap-add=SYS_TIME --rm -it ubuntu bash
root@617c9eb44965:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:17:46 UTC 2018
root@617c9eb44965:/#
If I replace --cap-add with --cap-drop nothing changes in the output:
$ sudo docker run --cap-drop=SYS_TIME --rm -it ubuntu bash
root@46dbb20ad793:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar 6 10:19:03 UTC 2018
It puzzles me that the date command still outputs the date increased by 2 hours, instead of simply dying with an error (the exit code is 1).
The only thing that I can think of is that seccomp/selinux are coming into play, but I have no idea how to check for that.
Can somebody explain me how can I ensure what is causing the operation not permitted error even when the capability is explicitly set and how to fix that?
System information:
$ uname -a
Linux ws77 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ sudo lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.4 LTS
Release: 16.04
Codename: xenial
$ docker -v
Docker version 1.13.1, build 092cba3
Please, do not mention --privileged. It's broken and I want to do it in the proper way using capabilities/seccomp/selinux etc.
permissions time docker selinux
permissions time docker selinux
asked Mar 6 at 8:27
Giacomo Alzetta
1011
asked Mar 6 at 8:27
Giacomo Alzetta
1011
asked Mar 6 at 8:27
Giacomo Alzetta
1011
asked Mar 6 at 8:27
Giacomo Alzetta
1011
asked Mar 6 at 8:27
Giacomo Alzetta
1011
1011
github.com/moby/moby/issues/8460#issuecomment-258684710, github.com/moby/moby/issues/25622?
– muru
Mar 6 at 8:38
@muru AFAIK I don't use the userns feature., so those links are not relevant. There is no/etc/docker/daemon.jsonfile in my computer andps aux | grep usernsonly returns the grep command as output.
– Giacomo Alzetta
Mar 6 at 8:46
add a comment |Â
github.com/moby/moby/issues/8460#issuecomment-258684710, github.com/moby/moby/issues/25622?
– muru
Mar 6 at 8:38
@muru AFAIK I don't use the userns feature., so those links are not relevant. There is no/etc/docker/daemon.jsonfile in my computer andps aux | grep usernsonly returns the grep command as output.
– Giacomo Alzetta
Mar 6 at 8:46
github.com/moby/moby/issues/8460#issuecomment-258684710, github.com/moby/moby/issues/25622?
– muru
Mar 6 at 8:38
github.com/moby/moby/issues/8460#issuecomment-258684710, github.com/moby/moby/issues/25622?
– muru
Mar 6 at 8:38
@muru AFAIK I don't use the userns feature., so those links are not relevant. There is no
/etc/docker/daemon.json file in my computer and ps aux | grep userns only returns the grep command as output.– Giacomo Alzetta
Mar 6 at 8:46
@muru AFAIK I don't use the userns feature., so those links are not relevant. There is no
/etc/docker/daemon.json file in my computer and ps aux | grep userns only returns the grep command as output.– Giacomo Alzetta
Mar 6 at 8:46
add a comment |Â
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
active
oldest
votes
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2faskubuntu.com%2fquestions%2f1012335%2fsetting-the-host-time-from-a-docker-container-gives-permission-error-even-with-c%23new-answer', 'question_page');
);
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
var $window = $(window),
onScroll = function(e)
var $elem = $('.new-login-left'),
docViewTop = $window.scrollTop(),
docViewBottom = docViewTop + $window.height(),
elemTop = $elem.offset().top,
elemBottom = elemTop + $elem.height();
if ((docViewTop elemBottom))
StackExchange.using('gps', function() StackExchange.gps.track('embedded_signup_form.view', location: 'question_page' ); );
$window.unbind('scroll', onScroll);
;
$window.on('scroll', onScroll);
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
github.com/moby/moby/issues/8460#issuecomment-258684710, github.com/moby/moby/issues/25622?
– muru
Mar 6 at 8:38
@muru AFAIK I don't use the userns feature., so those links are not relevant. There is no
/etc/docker/daemon.jsonfile in my computer andps aux | grep usernsonly returns the grep command as output.– Giacomo Alzetta
Mar 6 at 8:46