lxc/0032-Drop-all-caps-when-cap.keep-ISULAD_KEEP_NONE.patch

From 9a8aa1961330227da81a6081db7254441afb3031 Mon Sep 17 00:00:00 2001
From: LiFeng <lifeng68@huawei.com>
Date: Tue, 15 Jan 2019 05:39:39 -0500
Subject: [PATCH 032/140] Drop all caps when cap.keep=ISULAD_KEEP_NONE

Signed-off-by: LiFeng <lifeng68@huawei.com>
---
 src/lxc/conf.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/src/lxc/conf.c b/src/lxc/conf.c
index 88763ee..54b967b 100644
--- a/src/lxc/conf.c
+++ b/src/lxc/conf.c
@@ -2805,6 +2805,15 @@ static int dropcaps_except(struct lxc_list *caps)
 	lxc_list_for_each (iterator, caps) {
 		keep_entry = iterator->elem;
 
+		/* isulad: Do not keep any cap*/
+		if (strcmp(keep_entry, "ISULAD_KEEP_NONE") == 0) {
+			DEBUG("Do not keep any capability");
+			for(i = 0; i < numcaps; i++) {
+				caplist[i] = 0;
+			}
+			break;
+		}
+
 		capid = parse_cap(keep_entry);
 		if (capid == -2)
 			continue;
-- 
1.8.3.1