I'm trying to test
docker capabilities usage. So, for this I'm trying to run a container with the
--cap-add=SYS_TIME capability, which should allow a process to set the system time, however this is the output I receive:
$ sudo docker run --cap-add=SYS_TIME --rm -it ubuntu bash root@617c9eb44965:/# date -s '+2 hours' date: cannot set date: Operation not permitted Tue Mar 6 10:17:46 UTC 2018 root@617c9eb44965:/#
If I replace
--cap-drop nothing changes in the output:
$ sudo docker run --cap-drop=SYS_TIME --rm -it ubuntu bash root@46dbb20ad793:/# date -s '+2 hours' date: cannot set date: Operation not permitted Tue Mar 6 10:19:03 UTC 2018
It puzzles me that the
date command still outputs the date increased by 2 hours, instead of simply dying with an error (the exit code is
The only thing that I can think of is that seccomp/selinux are coming into play, but I have no idea how to check for that.
Can somebody explain me how can I ensure what is causing the operation not permitted error even when the capability is explicitly set and how to fix that?
$ uname -a Linux ws77 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux $ sudo lsb_release -a No LSB modules are available. Distributor ID: Ubuntu Description: Ubuntu 16.04.4 LTS Release: 16.04 Codename: xenial $ docker -v Docker version 1.13.1, build 092cba3
Please, do not mention
--privileged. It's broken and I want to do it in the proper way using capabilities/seccomp/selinux etc.