From 43d8393a3bd4562e23556b6d041fbd0d656b6a27 Mon Sep 17 00:00:00 2001 From: Fs00 Date: Sat, 25 Apr 2026 18:46:48 +0200 Subject: [PATCH 1/4] Handle cap_drop from container definitions Signed-off-by: Fs00 --- php/src/Container/Container.php | 2 ++ php/src/ContainerDefinitionFetcher.php | 6 ++++++ php/src/Docker/DockerActionManager.php | 6 +++--- 3 files changed, 11 insertions(+), 3 deletions(-) diff --git a/php/src/Container/Container.php b/php/src/Container/Container.php index 6b6c5af9..5a357783 100644 --- a/php/src/Container/Container.php +++ b/php/src/Container/Container.php @@ -27,6 +27,8 @@ readonly class Container { public bool $enableNvidiaGpu, /** @var string[] */ public array $capAdd, + /** @var string[] */ + public array $capDrop, public int $shmSize, public bool $apparmorUnconfined, /** @var string[] */ diff --git a/php/src/ContainerDefinitionFetcher.php b/php/src/ContainerDefinitionFetcher.php index e4625a24..4f581235 100644 --- a/php/src/ContainerDefinitionFetcher.php +++ b/php/src/ContainerDefinitionFetcher.php @@ -298,6 +298,11 @@ readonly class ContainerDefinitionFetcher { $capAdd = $entry['cap_add']; } + $capDrop = []; + if (isset($entry['cap_drop'])) { + $capDrop = $entry['cap_drop']; + } + $shmSize = -1; if (isset($entry['shm_size'])) { $shmSize = $entry['shm_size']; @@ -360,6 +365,7 @@ readonly class ContainerDefinitionFetcher { $devices, $enableNvidiaGpu, $capAdd, + $capDrop, $shmSize, $apparmorUnconfined, $backupVolumes, diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php index 940814fe..40747725 100644 --- a/php/src/Docker/DockerActionManager.php +++ b/php/src/Docker/DockerActionManager.php @@ -378,9 +378,9 @@ readonly class DockerActionManager { $requestBody['HostConfig']['CapAdd'] = $capAdds; } - // Disable arp spoofing - if (!in_array('NET_RAW', $capAdds, true)) { - $requestBody['HostConfig']['CapDrop'] = ['NET_RAW']; + $capDrops = $container->capDrop; + if (count($capDrops) > 0) { + $requestBody['HostConfig']['CapDrop'] = $capDrops; } // Disable SELinux for AIO containers so that it does not break them From d0d58df0fc4a8629fdc47032bf8cb0795f9cbee7 Mon Sep 17 00:00:00 2001 From: Fs00 Date: Sat, 25 Apr 2026 18:46:48 +0200 Subject: [PATCH 2/4] Set Collabora cap_drop to ALL in containers.json Signed-off-by: Fs00 --- php/containers.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/php/containers.json b/php/containers.json index dcf3bed7..13730769 100644 --- a/php/containers.json +++ b/php/containers.json @@ -406,7 +406,7 @@ "CHOWN" ], "cap_drop": [ - "NET_RAW" + "ALL" ] }, { From 61eab04d0e77ebe9c77122ddd04a3f6d10b91233 Mon Sep 17 00:00:00 2001 From: Fs00 Date: Sat, 25 Apr 2026 18:46:48 +0200 Subject: [PATCH 3/4] Drop any extra caps for collabora when seccomp profile is enabled Signed-off-by: Fs00 --- php/src/Docker/DockerActionManager.php | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php index 40747725..f528c389 100644 --- a/php/src/Docker/DockerActionManager.php +++ b/php/src/Docker/DockerActionManager.php @@ -440,9 +440,11 @@ readonly class DockerActionManager { // Special things for the collabora container which should not be exposed in the containers.json } elseif ($container->identifier === 'nextcloud-aio-collabora') { if (!$this->configurationManager->collaboraSeccompDisabled) { - // Load reference seccomp profile for collabora + // Load reference seccomp profile for collabora... $seccompProfile = (string)file_get_contents(DataConst::GetCollaboraSeccompProfilePath()); $requestBody['HostConfig']['SecurityOpt'] = ["label:disable", "seccomp=$seccompProfile"]; + // ...which allows the collabora container to run without any capabilities + $requestBody['HostConfig']['CapAdd'] = []; } // Additional Collabora options From 5dbc64253032b38c861048e255e754954394803f Mon Sep 17 00:00:00 2001 From: Fs00 Date: Tue, 28 Apr 2026 18:05:30 +0200 Subject: [PATCH 4/4] Drop NET_RAW cap by default when no caps are explicitly dropped Signed-off-by: Fs00 --- php/src/Docker/DockerActionManager.php | 3 +++ 1 file changed, 3 insertions(+) diff --git a/php/src/Docker/DockerActionManager.php b/php/src/Docker/DockerActionManager.php index f528c389..bca4207e 100644 --- a/php/src/Docker/DockerActionManager.php +++ b/php/src/Docker/DockerActionManager.php @@ -381,6 +381,9 @@ readonly class DockerActionManager { $capDrops = $container->capDrop; if (count($capDrops) > 0) { $requestBody['HostConfig']['CapDrop'] = $capDrops; + } else if (!in_array('NET_RAW', $capAdds, true)) { + // Prevent ARP spoofing by default + $requestBody['HostConfig']['CapDrop'] = ['NET_RAW']; } // Disable SELinux for AIO containers so that it does not break them