mirror of
https://github.com/opencontainers/runc.git
synced 2026-07-11 14:13:58 +08:00
Kir Kolyshkin
d8da00355e
Go 1.17 introduce this new (and better) way to specify build tags. For more info, see https://golang.org/design/draft-gobuild. As a way to seamlessly switch from old to new build tags, gofmt (and gopls) from go 1.17 adds the new tags along with the old ones. Later, when go < 1.17 is no longer supported, the old build tags can be removed. Now, as I started to use latest gopls (v0.7.1), it adds these tags while I edit. Rather than to randomly add new build tags, I guess it is better to do it once for all files. Mind that previous commits removed some tags that were useless, so this one only touches packages that can at least be built on non-linux. Brought to you by go1.17 fmt ./... Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
113 lines
3.0 KiB
Go
113 lines
3.0 KiB
Go
//go:build linux
|
|
// +build linux
|
|
|
|
package capabilities
|
|
|
|
import (
|
|
"sort"
|
|
"strings"
|
|
|
|
"github.com/opencontainers/runc/libcontainer/configs"
|
|
"github.com/sirupsen/logrus"
|
|
"github.com/syndtr/gocapability/capability"
|
|
)
|
|
|
|
const allCapabilityTypes = capability.CAPS | capability.BOUNDING | capability.AMBIENT
|
|
|
|
var (
|
|
capabilityMap map[string]capability.Cap
|
|
capTypes = []capability.CapType{
|
|
capability.BOUNDING,
|
|
capability.PERMITTED,
|
|
capability.INHERITABLE,
|
|
capability.EFFECTIVE,
|
|
capability.AMBIENT,
|
|
}
|
|
)
|
|
|
|
func init() {
|
|
capabilityMap = make(map[string]capability.Cap, capability.CAP_LAST_CAP+1)
|
|
for _, c := range capability.List() {
|
|
if c > capability.CAP_LAST_CAP {
|
|
continue
|
|
}
|
|
capabilityMap["CAP_"+strings.ToUpper(c.String())] = c
|
|
}
|
|
}
|
|
|
|
// New creates a new Caps from the given Capabilities config. Unknown Capabilities
|
|
// or Capabilities that are unavailable in the current environment are ignored,
|
|
// printing a warning instead.
|
|
func New(capConfig *configs.Capabilities) (*Caps, error) {
|
|
var (
|
|
err error
|
|
c Caps
|
|
)
|
|
|
|
unknownCaps := make(map[string]struct{})
|
|
c.caps = map[capability.CapType][]capability.Cap{
|
|
capability.BOUNDING: capSlice(capConfig.Bounding, unknownCaps),
|
|
capability.EFFECTIVE: capSlice(capConfig.Effective, unknownCaps),
|
|
capability.INHERITABLE: capSlice(capConfig.Inheritable, unknownCaps),
|
|
capability.PERMITTED: capSlice(capConfig.Permitted, unknownCaps),
|
|
capability.AMBIENT: capSlice(capConfig.Ambient, unknownCaps),
|
|
}
|
|
if c.pid, err = capability.NewPid2(0); err != nil {
|
|
return nil, err
|
|
}
|
|
if err = c.pid.Load(); err != nil {
|
|
return nil, err
|
|
}
|
|
if len(unknownCaps) > 0 {
|
|
logrus.Warn("ignoring unknown or unavailable capabilities: ", mapKeys(unknownCaps))
|
|
}
|
|
return &c, nil
|
|
}
|
|
|
|
// capSlice converts the slice of capability names in caps, to their numeric
|
|
// equivalent, and returns them as a slice. Unknown or unavailable capabilities
|
|
// are not returned, but appended to unknownCaps.
|
|
func capSlice(caps []string, unknownCaps map[string]struct{}) []capability.Cap {
|
|
var out []capability.Cap
|
|
for _, c := range caps {
|
|
if v, ok := capabilityMap[c]; !ok {
|
|
unknownCaps[c] = struct{}{}
|
|
} else {
|
|
out = append(out, v)
|
|
}
|
|
}
|
|
return out
|
|
}
|
|
|
|
// mapKeys returns the keys of input in sorted order
|
|
func mapKeys(input map[string]struct{}) []string {
|
|
var keys []string
|
|
for c := range input {
|
|
keys = append(keys, c)
|
|
}
|
|
sort.Strings(keys)
|
|
return keys
|
|
}
|
|
|
|
// Caps holds the capabilities for a container.
|
|
type Caps struct {
|
|
pid capability.Capabilities
|
|
caps map[capability.CapType][]capability.Cap
|
|
}
|
|
|
|
// ApplyBoundingSet sets the capability bounding set to those specified in the whitelist.
|
|
func (c *Caps) ApplyBoundingSet() error {
|
|
c.pid.Clear(capability.BOUNDING)
|
|
c.pid.Set(capability.BOUNDING, c.caps[capability.BOUNDING]...)
|
|
return c.pid.Apply(capability.BOUNDING)
|
|
}
|
|
|
|
// Apply sets all the capabilities for the current process in the config.
|
|
func (c *Caps) ApplyCaps() error {
|
|
c.pid.Clear(allCapabilityTypes)
|
|
for _, g := range capTypes {
|
|
c.pid.Set(g, c.caps[g]...)
|
|
}
|
|
return c.pid.Apply(allCapabilityTypes)
|
|
}
|