Dashboard › opencode › Distillation
6de98fe3-8523-4a5a-a7b8-875b921c24c4["lore_tm_v1_0TSvx28uOiGosD81lkIb0ZaynnjMwwXUr6W3CI7LGMA","lore_tm_v1_TpNnrolEZxq8plv-aKxQq4ITTgPm2QD3RHd_H4ppYKw","lore_tm_v1_1G_9MJoAov0KjbUTKnJPHA6poAlb_xR6m8R-p771IQI","lore_tm_v1_yMg2A6oaDGWWsHkXsVO2Zo7zg5REgVoeaTlc97FbrUI","lore_tm_v1_sfCGS1EkkutZqOuS7wpMeEmJivBhJlixNybujFNhBvY"]
Date: Sep 8, 2026
/home/byk/.local/share/opencode/tool-output/tool_07f30912e001OL7Ji933fqZRJs lines 4872-4905 showed capability handling: saves bset, adds CAP_SYS_ADMIN and CAP_SETPCAP, calls capability_bounding_set_drop(bset, /* right_now= */ false), and sets *exit_status = EXIT_CAPABILITIES on failure; when !needs_ambient_hack, it applies capability_ambient_set_apply(capability_ambient_set, /* also_inherit= */ true) before the UID change.apply_root_directory(...) runs before privileges are lost; if needs_setuid and uid_is_valid(uid), enforce_user(context, uid, capability_ambient_set) changes UID and maps failure to EXIT_USER; with keep_seccomp_privileges, it conditionally drops CAP_SETUID and retains CAP_SYS_ADMIN and CAP_SETPCAP; afterward, when !needs_ambient_hack && capability_ambient_set != 0, it reapplies ambient capabilities with also_inherit=false, mapping failure to EXIT_CAPABILITIES.apply_working_directory(context, params, runtime, home, exit_status) occurs after the user change because the working directory may be on NFS and accessible only to the service user.HAVE_SELINUX, setexeccon(exec_context) uses mac_selinux_context_net ?: context->selinux_context, maps non-ignored failure to EXIT_SELINUX_CONTEXT, and logs ignored failures when context->selinux_context_ignore is set.sysctl command was unavailable, with exact error /usr/bin/bash: line 1: sysctl: command not found./proc/sys/kernel/yama/ptrace_scope value was 1./proc/sys/kernel/unprivileged_userns_clone value was 1./sys/fs/cgroup/system.slice/opencode.service had uid=0 gid=0 mode=755, while /sys/fs/cgroup/system.slice/opencode.service/cgroup.procs had uid=0 gid=0 mode=644.c4705705dbbf40568cca3ff867754f46.