CAP_CHOWN 可利用性研究

package caps // import "github.com/docker/docker/oci/caps"

// DefaultCapabilities returns a Linux kernel default capabilities
func DefaultCapabilities() []string {
    return []string{
        "CAP_CHOWN",
        ...
    }
}

{    
    ...
    "syscalls": [
        ...
        {
            "names": [
                ...
                "chown",
                "chown32",
                ...
                "fchown",
                "fchown32",
                "fchownat",
                ...
                "lchown",
                "lchown32",
                ...
            ],
            "action": "SCMP_ACT_ALLOW"
        },
        ...
    ]
}