Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

*: remove RHEL6 hack and loosen capability validation #359

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
+10 −27
Open

*: remove RHEL6 hack and loosen capability validation #359

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion generate/generate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1023,7 +1023,7 @@ func (g *Generator) SetupPrivileged(privileged bool) {
if privileged { // Add all capabilities in privileged mode.
var finalCapList []string
for _, cap := range capability.List() {
if g.HostSpecific && cap > validate.LastCap() {
if g.HostSpecific && cap > capability.CAP_LAST_CAP {
continue
}
finalCapList = append(finalCapList, fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())))
Expand Down
13 changes: 9 additions & 4 deletions validate/validate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -687,23 +687,28 @@ func (v *Validator) CheckAnnotations() (errs error) {
return
}

// CapValid checks whether a capability is valid
// CapValid checks whether a capability is valid. This only really checks
// anything with hostSpecific, otherwise we just ignore everything (because
// capabilities are now free-form strings).
func CapValid(c string, hostSpecific bool) error {
isValid := false
// Cannot speak to whether the capability makes sense.
if !hostSpecific {
return nil
}

isValid := false
if !strings.HasPrefix(c, "CAP_") {
return fmt.Errorf("capability %s must start with CAP_", c)
}
for _, cap := range capability.List() {
if c == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
if hostSpecific && cap > LastCap() {
if cap > capability.CAP_LAST_CAP {
return fmt.Errorf("%s is not supported on the current host", c)
}
isValid = true
break
}
}

if !isValid {
return fmt.Errorf("invalid capability: %s", c)
}
Expand Down
13 changes: 0 additions & 13 deletions validate/validate_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,26 +10,13 @@ import (
"strings"
"syscall"

"github.com/syndtr/gocapability/capability"

multierror "github.com/hashicorp/go-multierror"
rspec "github.com/opencontainers/runtime-spec/specs-go"
osFilepath "github.com/opencontainers/runtime-tools/filepath"
"github.com/opencontainers/runtime-tools/specerror"
"github.com/sirupsen/logrus"
)

// LastCap return last cap of system
func LastCap() capability.Cap {
last := capability.CAP_LAST_CAP
// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
if last == capability.Cap(63) {
last = capability.CAP_BLOCK_SUSPEND
}

return last
}

func deviceValid(d rspec.LinuxDevice) bool {
switch d.Type {
case "b", "c", "u":
Expand Down
9 changes: 0 additions & 9 deletions validate/validate_unsupported.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,15 +2,6 @@

package validate

import (
"github.com/syndtr/gocapability/capability"
)

// LastCap return last cap of system
func LastCap() capability.Cap {
return capability.Cap(-1)
}

// CheckLinux is a noop on this platform
func (v *Validator) CheckLinux() (errs error) {
return nil
Expand Down