I'm trying to test docker capabilities usage. So, for this I'm trying to run a container with the --cap-add=SYS_TIME capability, which should allow a process to set the system time, however this is the output I receive:

$ sudo docker run --cap-add=SYS_TIME --rm -it ubuntu bash
root@617c9eb44965:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar  6 10:17:46 UTC 2018

If I replace --cap-add with --cap-drop nothing changes in the output:

$ sudo docker run --cap-drop=SYS_TIME --rm -it ubuntu bash
root@46dbb20ad793:/# date -s '+2 hours'
date: cannot set date: Operation not permitted
Tue Mar  6 10:19:03 UTC 2018

It puzzles me that the date command still outputs the date increased by 2 hours, instead of simply dying with an error (the exit code is 1).

The only thing that I can think of is that seccomp/selinux are coming into play, but I have no idea how to check for that.

Can somebody explain me how can I ensure what is causing the operation not permitted error even when the capability is explicitly set and how to fix that?

System information:

$ uname -a
Linux ws77 4.4.0-116-generic #140-Ubuntu SMP Mon Feb 12 21:23:04 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
$ sudo lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.4 LTS
Release:    16.04
Codename:   xenial
$ docker -v
Docker version 1.13.1, build 092cba3

Please, do not mention --privileged. It's broken and I want to do it in the proper way using capabilities/seccomp/selinux etc.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.