{"id":16297,"date":"2024-03-06T16:26:56","date_gmt":"2024-03-06T08:26:56","guid":{"rendered":"https:\/\/blog.ywdevops.cn\/?p=16297"},"modified":"2025-10-28T10:37:35","modified_gmt":"2025-10-28T02:37:35","slug":"docker-13","status":"publish","type":"post","link":"https:\/\/blog.ywdevops.cn\/index.php\/2024\/03\/06\/docker-13\/","title":{"rendered":"Docker\u5bb9\u5668\u5b89\u5168"},"content":{"rendered":"\n

Linux\u5185\u6838\u4e2d\u7684Capabilities\u7279\u6027\u7528\u4e8e\u5212\u5206\u7279\u6743\u96c6\uff0c\u4ee5\u4fbf\u8fdb\u7a0b\u53ef\u4ee5\u53ea\u5206\u914d\u201c\u6267\u884c\u7279\u5b9a\u529f\u80fd\u201d\u7684\u7279\u6743<\/p>\n\n\n\n

\u5728\u5f15\u5165\u6b64\u7279\u6027\u524d\uff0c\u5982\u679c\u8fdb\u7a0b\u9700\u8981\u4f7f\u7528\u7f51\u7edc\uff0c\u5219\u5fc5\u987b\u4f7f\u7528root\u6765\u8fd0\u884c\uff0c\u901a\u5e38\u662fsudo\u6216\u8005\u6dfb\u52a0suid\uff0c\u90a3\u4e48\u666e\u901a\u7528\u6237\u5728\u4f7f\u7528ping\u65f6\uff0cping\u5c31\u53ef\u4ee5\u8fd0\u884c\u4efb\u4f55\u7279\u6743\u3002\u5f15\u5165Capabilities\u7279\u6027\u540e\uff0c\u53ef\u4ee5\u901a\u8fc7\u7ed9ping\u5e94\u7528\u6dfb\u52a0NET_RAW\u7279\u6743\u96c6\uff0c\u4f7f\u5176\u5177\u6709\u4f7f\u7528\u7f51\u7edc\u7684\u7279\u6743\u96c6\uff0c\u800c\u4e0d\u5177\u5907\u5176\u4ed6\u7279\u6743\u96c6\u3002\u7f3a\u7701ping\u5177\u6709cap_net_admin\u548ccap_net_raw\u7279\u6743\u96c6\uff0c\u901a\u8fc7getcat\u547d\u4ee4\u67e5\u770b\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u53ef\u901a\u8fc7\u67e5\u770b\u8fdb\u7a0b\u72b6\u6001\uff0c\u6765\u83b7\u53d6\u5f53\u524d\u8fdb\u7a0b\u7684\u7279\u6743\u96c6\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u901a\u8fc7capsh\u6765\u89e3\u7801\u5f97\u5230\u5177\u4f53\u7684\u7279\u6743\u96c6\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n

[root@db ~]# capsh --decode=00000000a80425fb\n0x00000000a80425fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap<\/code><\/pre>\n\n\n\n
Docker\u4e5f\u662f\u652f\u6301capabilities\u7684\uff0c\u5728\u8fd0\u884c\u5bb9\u5668\u7684\u65f6\u5019\u5982\u679c\u6307\u5b9a\u4e86–privileged\u53c2\u6570\u5c06\u4f1a\u5f00\u542f\u5bb9\u5668\u7684\u6240\u6709CAP\uff0c\u5982\u679c\u4e0d\u4f7f\u7528–privileged<\/mark><\/strong>\uff0c\u90a3\u4e48\u53ef\u4ee5\u901a\u8fc7–cap-add<\/mark><\/strong>\u548c–cap-drop<\/mark><\/strong>\u8fd9\u4e24\u4e2a\u53c2\u6570\u6765\u8c03\u6574\uff0c\u5e38\u7528\u7279\u6743\u96c6\u5982\u4e0b\uff1a<\/p>\n\n\n\n
\u7279\u6743\u96c6<\/td>\u6743\u9650<\/td><\/tr>
chown<\/td>\u4fee\u6539\u6587\u4ef6\u6240\u6709\u8005\u6743\u9650<\/td><\/tr>
dac_override<\/td>\u5ffd\u7565\u6587\u4ef6\u7684DAC\u8bbf\u95ee\u9650\u5236<\/td><\/tr>
dac_read_search<\/td>\u5ffd\u7565\u6587\u4ef6\u8bfb\u53ca\u76ee\u5f55\u641c\u7d22\u7684DAC\u8bbf\u95ee\u9650\u5236<\/td><\/tr>
fowner<\/td>\u5ffd\u7565\u6587\u4ef6\u5c5e\u4e3bID\u5fc5\u987b\u548c\u8fdb\u7a0b\u7528\u6237ID\u5339\u914d\u7684\u9650\u5236<\/td><\/tr>
fsetid<\/td>\u5141\u8bb8\u8bbe\u7f6e\u6587\u4ef6\u7684setuid<\/td><\/tr>
kill<\/td>\u5141\u8bb8\u5bf9\u4e0d\u5c5e\u4e8e\u81ea\u5df1\u7684\u8fdb\u7a0b\u53d1\u9001\u4fe1\u53f7<\/td><\/tr>
setgid<\/td>\u5141\u8bb8\u6539\u53d8\u8fdb\u7a0b\u7684GID<\/td><\/tr>
setuid<\/td>\u5141\u8bb8\u6539\u53d8\u8fdb\u7a0b\u7684UID<\/td><\/tr>
linux_immutable<\/td>\u5141\u8bb8\u4fee\u6539\u6587\u4ef6\u7684immutable\u548cappend\u9f20\u6807\u6807\u5fd7<\/td><\/tr>
net_bind_service<\/td>\u5141\u8bb8\u7ed1\u5b9a\u5230\u5c0f\u4e8e1024\u7684\u7aef\u53e3<\/td><\/tr>
net_broadcast<\/td>\u5141\u8bb8\u7f51\u7edc\u5e7f\u64ad\u548c\u591a\u64ad\u8bbf\u95ee<\/td><\/tr>
net_admin<\/td>\u5141\u8bb8\u6267\u884c\u7f51\u7edc\u7ba1\u7406\u4efb\u52a1<\/td><\/tr>
net_raw<\/td>\u5141\u8bb8\u7f51\u7edc\u5e7f\u64ad\u548c\u591a\u64ad\u8bbf\u95ee\uff0c\u6bd4\u5982ping\u547d\u4ee4<\/td><\/tr>
ipc_lock<\/td>\u5141\u8bb8\u9501\u5b9a\u5171\u4eab\u5185\u5b58\u7247\u6bb5<\/td><\/tr>
ipc_owner<\/td>\u5ffd\u7565IPC\u6240\u6709\u6743\u68c0\u67e5<\/td><\/tr>
sys_module<\/td>\u5141\u8bb8\u63d2\u5165\u548c\u5220\u9664\u5185\u6838\u6a21\u5757<\/td><\/tr>
sys_rawio<\/td>\u5141\u8bb8\u76f4\u63a5\u8bbf\u95ee\/devport\u3001\/dev\/mem\u3001\/dev\/kmem\u53ca\u539f\u59cb\u5757\u8bbe\u5907<\/td><\/tr>
sys_chroot<\/td>\u5141\u8bb8\u4f7f\u7528chroot()\u7cfb\u7edf\u8c03\u7528<\/td><\/tr>
sys_ptrace<\/td>\u5141\u8bb8\u8ddf\u8e2a\u4efb\u4f55\u8fdb\u7a0b<\/td><\/tr>
sys_pacct<\/td>\u5141\u8bb8\u6267\u884c\u8fdb\u7a0b\u7684BSD\u5ba1\u8ba1<\/td><\/tr>
sys_admin<\/td>\u5141\u8bb8\u6267\u884c\u7cfb\u7edf\u7ba1\u7406\u4efb\u52a1\uff0c\u5982\u52a0\u8f7d\u5378\u8f7d\u6587\u4ef6\u7cfb\u7edf\u8bbe\u7f6e\u78c1\u76d8\u914d\u989d<\/td><\/tr>
sys_boot<\/td>\u5141\u8bb8\u91cd\u542f\u7cfb\u7edf<\/td><\/tr>
sys_nice<\/td>\u5141\u8bb8\u63d0\u5347\u4f18\u5148\u7ea7\u53ca\u8bbe\u7f6e\u5176\u4ed6\u8fdb\u7a0b\u4f18\u5148\u7ea7<\/td><\/tr>
sys_resource<\/td>\u5ffd\u7565\u8d44\u6e90\u9650\u5236<\/td><\/tr>
sys_time<\/td>\u5141\u8bb8\u6539\u53d8\u7cfb\u7edf\u65f6\u949f<\/td><\/tr>
sys_tty_config<\/td>\u5141\u8bb8\u914d\u7f6eTTY\u8bbe\u5907<\/td><\/tr>
mknod<\/td>\u5141\u8bb8\u4f7f\u7528mknod()\u7cfb\u7edf\u8c03\u7528<\/td><\/tr>
lease<\/td>\u5141\u8bb8\u4fee\u6539\u6587\u4ef6\u9501\u7684FL_LEASE\u6807\u5fd7<\/td><\/tr>
audit_write<\/td>\u5c06\u8bb0\u5f55\u5199\u5165\u5185\u6838\u5ba1\u8ba1\u65e5\u5fd7<\/td><\/tr>
audit_control<\/td>\u542f\u7528\/\u7981\u7528\u5185\u6838\u5ba1\u8ba1\uff0c\u6539\u53d8\/\u68c0\u7d22\u5ba1\u8ba1\u72b6\u6001\uff0c\u8fc7\u6ee4\u89c4\u5219<\/td><\/tr>
setfcap<\/td>\u5141\u8bb8\u4e3a\u6587\u4ef6\u8bbe\u7f6e\u4efb\u610f\u7684capabilities<\/td><\/tr>
mac_override<\/td>\u8986\u76d6MAC(Mandatory Access Control)<\/td><\/tr>
mac_admin<\/td>\u5141\u8bb8MAC\u914d\u7f6e\u6216\u72b6\u6001\u66f4\u6539<\/td><\/tr>
syslog<\/td>\u5141\u8bb8\u4f7f\u7528syslog()\u7cfb\u7edf\u8c03\u7528<\/td><\/tr>
wake_alarm<\/td>\u5141\u8bb8\u89e6\u53d1\u80fd\u5524\u9192\u7cfb\u7edf\u7684\u4e1c\u897f(\u5982CLOCK_BOOTTIME_ALARM\u8ba1\u65f6\u5668)<\/td><\/tr>
block_suspendcap_audit_read<\/td>\u4f7f\u7528\u53ef\u4ee5\u963b\u6b62\u7cfb\u7edf\u6302\u8d77\u7684\u7279\u6027<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u6f14\u793a<\/mark><\/strong><\/p>\n\n\n\n
\u9996\u5148\u8fd0\u884c\u4e00\u4e2abusybox\u5bb9\u5668\uff0c\u7136\u540e\u67e5\u770b\u5176\u7279\u6743\u96c6\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u901a\u8fc7capsh\u6765\u89e3\u7801\uff0c\u53ef\u4ee5\u5f97\u5230\u9ed8\u8ba4\u768414\u4e2a\u7279\u6743\u96c6\uff0c\u5982\u4e0b\uff1a<\/p>\n\n\n\n
[root@localhost ~]# capsh --decode=00000000a80425fb\n0x00000000a80425fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_mknod,cap_audit_write,cap_setfcap<\/code><\/pre>\n\n\n\n
1\u3001\u8fdb\u5165\u5bb9\u5668\u4e2d\uff0c\u6267\u884cping\u547d\u4ee4\uff0c\u770b\u662f\u5426\u53ef\u4ee5\u6267\u884c\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4ece\u4e0a\u56fe\u770b\u51fa\uff0c\u9ed8\u8ba4\u60c5\u51b5\u4e0b\u5bb9\u5668\u4e2d\u53ef\u4ee5\u6267\u884cping\u547d\u4ee4\u7684<\/p>\n\n\n\n
2\u3001\u91cd\u65b0\u521b\u5efa\u5bb9\u5668\uff0c\u5c06\u8fdb\u7a0b\u53ef\u6267\u884cping\u7684capabilities\u53d6\u6d88\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4ece\u4e0a\u56fe\u770b\u51fa\uff0c\u901a\u8fc7–cat-drop=net_raw\u547d\u4ee4\u5373\u53ef\u53d6\u6d88ping\u6743\u9650<\/p>\n\n\n\n
3\u3001\u4e0b\u9762\u7ed9busybox\u5bb9\u5668\u4e2d\u8fdb\u7a0b\u6dfb\u52a0\u4e00\u4e2a\u53ef\u4fee\u6539\u7cfb\u7edf\u65f6\u95f4\u7684capabilities\uff0c\u9996\u5148\u8fd0\u884c\u5bb9\u5668\uff0c\u7136\u540e\u8fdb\u5165\u5bb9\u5668\u4e2d\u4fee\u6539\u65f6\u95f4\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4ece\u4e0a\u56fe\u770b\u51fa\uff0c\u4fee\u6539\u65f6\u95f4\u63d0\u793a\u6ca1\u6709\u6743\u9650\uff0c\u63a5\u4e0b\u6765\u91cd\u65b0\u521b\u5efa\u5bb9\u5668\u5e76\u6dfb\u52a0capabilities\uff0c\u5982\u56fe\uff1a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
4\u3001\u521b\u5efa\u5bb9\u5668\u603b\u63d0\u793a\u6ca1\u6743\u9650\uff0c\u8981\u4f7f\u7528–privileged\u624d\u884c\uff0c\u6b64\u65f6\u53ef\u4ee5\u901a\u8fc7\u5982\u4e0b\u53c2\u6570\u89e3\u51b3\uff1a<\/p>\n\n\n\n
docker run -itd --name abcd --cap-add=SYS_ADMIN   #--cap-add=SYS_ADMIN\u53c2\u6570<\/code><\/pre>\n\n\n\n
\u6ce8\uff1a--cap-add=SYS_ADMIN<\/code>\u4ecd\u7136\u6bd4\u00a0--privileged<\/code>\u66f4\u5b89\u5168\uff0c\u56e0\u4e3a\u5b83\u53ea\u6388\u4e88\u7279\u5b9a\u7684\u6743\u9650\uff0c\u800c\u4e0d\u662f\u6240\u6709 root \u6743\u9650<\/p>\n","protected":false},"excerpt":{"rendered":"
Linux\u5185\u6838\u4e2d\u7684Capabilities\u7279\u6027\u7528\u4e8e\u5212\u5206\u7279\u6743\u96c6\uff0c\u4ee5\u4fbf\u8fdb\u7a0b\u53ef\u4ee5\u53ea\u5206\u914d\u201c\u6267\u884c\u7279\u5b9a\u529f\u80fd\u201d\u7684\u7279\u6743 \u5728\u5f15\u5165 […]<\/p>\n","protected":false},"author":3,"featured_media":16298,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[39,23],"tags":[],"class_list":["post-16297","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-docker","category-rong"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":8}},"_links":{"self":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/16297","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/comments?post=16297"}],"version-history":[{"count":24,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/16297\/revisions"}],"predecessor-version":[{"id":19152,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/posts\/16297\/revisions\/19152"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media\/16298"}],"wp:attachment":[{"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/media?parent=16297"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/categories?post=16297"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ywdevops.cn\/index.php\/wp-json\/wp\/v2\/tags?post=16297"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}