3 Commits

Author	SHA1	Message	Date
Thomas Woerner	0e748d372a	infra/image/shdefaults: Add capability SYS_ADMIN for systemd 258 ... Fedora 43 and 44 switched to systemd 258 rc4. The dbus-broker service of systemd 258 does not start any more without enabling the capability SYS_ADMIN. The capabilities AUDIT_WRITE, SETUID and SETGID should be enough, but they are not sufficient to be able to start the service. With final systemd 258 it should be tested if the capability can be removed again.	2025-09-18 14:54:18 +02:00
Thomas Woerner	432376524c	infra/image/shdefaults: Add SYS_PTRACE to CAP_DEFAULTS ... Debugging is now enabled by default in the containers that are generated with container_create. "+SYS_PTRACE" has been added to CAP_DEFAULTS in shdefaults for this.	2025-04-17 15:00:39 +02:00
Rafael Guterres Jeffman	2d3da2d72c	test container: Add DAC_READ_SEARCH capability ... SSSD 2.10+ runs under non-privileged user 'sssd' and relies on system capabilities to get access to certain resources like /etc/krb5.keytab. Not having these capabilities result in SSSD not starting. Podman has reduced the capabilities granted to containers, and to be able to start SSSD it is needed to add DAC_READ_SEARCH back. This patch adds file infra/images/shdefaults to store the defaults used by ansible-freeipa shell utilities in a contral location. See: https://github.com/containers/podman/discussions/24904#discussioncomment-11718823 Signed-off-by: Rafael Guterres Jeffman <rjeffman@redhat.com>	2025-04-17 09:44:01 -03:00