Revision - 4f4e8e9 - envoy: Drop privileges - origin: https://github.com/cilium/cilium

visit type:

https://github.com/cilium/cilium

12 July 2024, 03:14:21 UTC

Revision 4f4e8e9155a6d2639ab02b7de39590bc95ae0c53 authored by Tam Mach on 05 March 2024, 08:34:35 UTC, committed by Julian Wiedmann on 02 April 2024, 17:03:53 UTC

envoy: Drop privileges

[upstream commit 3166f95]

Use cilium-envoy image that drops privileges from the Envoy process
before it starts.

Envoy now needs to be started as `cilium-envoy-starter`, which drops all
privileges before executing `cilium-envoy`.

If `cilium-envoy` is executed directly with any privileges, it will
terminate with the following error message when any Cilium filters are
first configured:

  "[assert failure: get_capabilities(CAP_EFFECTIVE) == 0 &&
   get_capabilities(CAP_PERMITTED) == 0. Details: cilium-envoy
   running with privileges, exiting"

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>
Signed-off-by: Tam Mach <tam.mach@cilium.io>

1 parent 63859d3

Files
Changes

Permalinks

Tip revision: 4f4e8e9155a6d2639ab02b7de39590bc95ae0c53 authored by Tam Mach on 05 March 2024, 08:34:35 UTC
envoy: Drop privileges

Tip revision: 4f4e8e9

File	Mode	Size
.github
.nvim
.vscode
Documentation
api
bpf
bugtool
cilium
cilium-health
clustermesh-apiserver
contrib
daemon
envoy
examples
hack
hubble-relay
images
install
jenkinsfiles
operator
pkg
plugins
test
tools
vendor
.authors.aux	-rw-r--r--	416 bytes
.clomonitor.yml	-rw-r--r--	984 bytes
.gitattributes	-rw-r--r--	689 bytes
.gitignore	-rw-r--r--	1.7 KB
.golangci.yaml	-rw-r--r--	3.1 KB
.mailmap	-rw-r--r--	5.9 KB
AUTHORS	-rw-r--r--	38.5 KB
CHANGELOG.md	-rw-r--r--	208.5 KB
CODEOWNERS	-rw-r--r--	11.6 KB
CODE_OF_CONDUCT.md	-rw-r--r--	2.2 KB
CONTRIBUTING.md	-rw-r--r--	473 bytes
FURTHER_READINGS.rst	-rw-r--r--	6.4 KB
LICENSE	-rw-r--r--	11.1 KB
MAINTAINERS.md	-rw-r--r--	4.3 KB
Makefile	-rw-r--r--	28.2 KB
Makefile.defs	-rw-r--r--	6.5 KB
Makefile.docker	-rw-r--r--	6.9 KB
Makefile.quiet	-rw-r--r--	818 bytes
README.rst	-rw-r--r--	17.4 KB
SECURITY.md	-rw-r--r--	629 bytes
USERS.md	-rw-r--r--	24.5 KB
VERSION	-rw-r--r--	8 bytes
Vagrantfile	-rw-r--r--	14.7 KB
go.mod	-rw-r--r--	12.0 KB
go.sum	-rw-r--r--	155.4 KB
netlify.toml	-rw-r--r--	92 bytes
vagrant_box_defaults.rb	-rw-r--r--	394 bytes

Showing with 0 additions and 0 deletions (0 / 0 diffs computed)

Computing file changes ...

https://github.com/cilium/cilium

envoy: Drop privileges

README.rst