From b45a7165f3219017e95faebb8a3c260ba12d76e3 Mon Sep 17 00:00:00 2001 From: Yuxiang Zhu Date: Sat, 20 Jun 2026 18:53:22 +0800 Subject: [PATCH] unshare: add CAP_NET_ADMIN helper Signed-off-by: Yuxiang Zhu --- pkg/unshare/unshare_linux.go | 20 ++++++++++++++++++++ pkg/unshare/unshare_unsupported.go | 5 +++++ 2 files changed, 25 insertions(+) diff --git a/pkg/unshare/unshare_linux.go b/pkg/unshare/unshare_linux.go index 9e0e562d20..df93d7d8d4 100644 --- a/pkg/unshare/unshare_linux.go +++ b/pkg/unshare/unshare_linux.go @@ -411,6 +411,9 @@ var ( hasCapSysAdminOnce sync.Once hasCapSysAdminRet bool hasCapSysAdminErr error + hasCapNetAdminOnce sync.Once + hasCapNetAdminRet bool + hasCapNetAdminErr error ) // IsRootless tells us if we are running in rootless mode @@ -753,3 +756,20 @@ func HasCapSysAdmin() (bool, error) { }) return hasCapSysAdminRet, hasCapSysAdminErr } + +// HasCapNetAdmin returns whether the current process has CAP_NET_ADMIN. +func HasCapNetAdmin() (bool, error) { + hasCapNetAdminOnce.Do(func() { + currentCaps, err := capability.NewPid2(0) + if err != nil { + hasCapNetAdminErr = err + return + } + if err = currentCaps.Load(); err != nil { + hasCapNetAdminErr = err + return + } + hasCapNetAdminRet = currentCaps.Get(capability.EFFECTIVE, capability.CAP_NET_ADMIN) + }) + return hasCapNetAdminRet, hasCapNetAdminErr +} diff --git a/pkg/unshare/unshare_unsupported.go b/pkg/unshare/unshare_unsupported.go index 05706b8fe6..bab54fc9fc 100644 --- a/pkg/unshare/unshare_unsupported.go +++ b/pkg/unshare/unshare_unsupported.go @@ -53,3 +53,8 @@ func ParseIDMappings(uidmap, gidmap []string) ([]idtools.IDMap, []idtools.IDMap, func HasCapSysAdmin() (bool, error) { return os.Geteuid() == 0, nil } + +// HasCapNetAdmin returns whether the current process has CAP_NET_ADMIN. +func HasCapNetAdmin() (bool, error) { + return os.Geteuid() == 0, nil +}