OSSInnovation
/
runc
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Merge pull request #257 from mrunalp/cap_prefix 

Add CAP prefix for capabilities
This commit is contained in:
Alexander Morozov 2015-09-16 11:39:39 -07:00
parent abb40ac3c7 ec37110957
commit dae4560ec2
6 changed files with 73 additions and 73 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
README.md
View File

@ -141,9 +141,9 @@ user with uid and gid of `0` defined within that file-system.
], ],
"linux": { "linux": {
"capabilities": [ "capabilities": [
"AUDIT_WRITE", "CAP_AUDIT_WRITE",
"KILL", "CAP_KILL",
"NET_BIND_SERVICE" "CAP_NET_BIND_SERVICE"
], ],
"rootfsPropagation": "" "rootfsPropagation": ""
} }

28
libcontainer/README.md
View File

@ -32,20 +32,20 @@ struct describing how the container is to be created. A sample would look simil
config := &configs.Config{ config := &configs.Config{
Rootfs: rootfs, Rootfs: rootfs,
Capabilities: []string{ Capabilities: []string{
"CHOWN", "CAP_CHOWN",
"DAC_OVERRIDE", "CAP_DAC_OVERRIDE",
"FSETID", "CAP_FSETID",
"FOWNER", "CAP_FOWNER",
"MKNOD", "CAP_MKNOD",
"NET_RAW", "CAP_NET_RAW",
"SETGID", "CAP_SETGID",
"SETUID", "CAP_SETUID",
"SETFCAP", "CAP_SETFCAP",
"SETPCAP", "CAP_SETPCAP",
"NET_BIND_SERVICE", "CAP_NET_BIND_SERVICE",
"SYS_CHROOT", "CAP_SYS_CHROOT",
"KILL", "CAP_KILL",
"AUDIT_WRITE", "CAP_AUDIT_WRITE",
}, },
Namespaces: configs.Namespaces([]configs.Namespace{ Namespaces: configs.Namespaces([]configs.Namespace{
{Type: configs.NEWNS}, {Type: configs.NEWNS},

76
libcontainer/capabilities_linux.go
View File

@ -12,44 +12,44 @@ import (
const allCapabilityTypes = capability.CAPS | capability.BOUNDS const allCapabilityTypes = capability.CAPS | capability.BOUNDS
var capabilityList = map[string]capability.Cap{ var capabilityList = map[string]capability.Cap{
"SETPCAP": capability.CAP_SETPCAP, "CAP_SETPCAP": capability.CAP_SETPCAP,
"SYS_MODULE": capability.CAP_SYS_MODULE, "CAP_SYS_MODULE": capability.CAP_SYS_MODULE,
"SYS_RAWIO": capability.CAP_SYS_RAWIO, "CAP_SYS_RAWIO": capability.CAP_SYS_RAWIO,
"SYS_PACCT": capability.CAP_SYS_PACCT, "CAP_SYS_PACCT": capability.CAP_SYS_PACCT,
"SYS_ADMIN": capability.CAP_SYS_ADMIN, "CAP_SYS_ADMIN": capability.CAP_SYS_ADMIN,
"SYS_NICE": capability.CAP_SYS_NICE, "CAP_SYS_NICE": capability.CAP_SYS_NICE,
"SYS_RESOURCE": capability.CAP_SYS_RESOURCE, "CAP_SYS_RESOURCE": capability.CAP_SYS_RESOURCE,
"SYS_TIME": capability.CAP_SYS_TIME, "CAP_SYS_TIME": capability.CAP_SYS_TIME,
"SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG, "CAP_SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG,
"MKNOD": capability.CAP_MKNOD, "CAP_MKNOD": capability.CAP_MKNOD,
"AUDIT_WRITE": capability.CAP_AUDIT_WRITE, "CAP_AUDIT_WRITE": capability.CAP_AUDIT_WRITE,
"AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL, "CAP_AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL,
"MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE, "CAP_MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE,
"MAC_ADMIN": capability.CAP_MAC_ADMIN, "CAP_MAC_ADMIN": capability.CAP_MAC_ADMIN,
"NET_ADMIN": capability.CAP_NET_ADMIN, "CAP_NET_ADMIN": capability.CAP_NET_ADMIN,
"SYSLOG": capability.CAP_SYSLOG, "CAP_SYSLOG": capability.CAP_SYSLOG,
"CHOWN": capability.CAP_CHOWN, "CAP_CHOWN": capability.CAP_CHOWN,
"NET_RAW": capability.CAP_NET_RAW, "CAP_NET_RAW": capability.CAP_NET_RAW,
"DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE, "CAP_DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE,
"FOWNER": capability.CAP_FOWNER, "CAP_FOWNER": capability.CAP_FOWNER,
"DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH, "CAP_DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH,
"FSETID": capability.CAP_FSETID, "CAP_FSETID": capability.CAP_FSETID,
"KILL": capability.CAP_KILL, "CAP_KILL": capability.CAP_KILL,
"SETGID": capability.CAP_SETGID, "CAP_SETGID": capability.CAP_SETGID,
"SETUID": capability.CAP_SETUID, "CAP_SETUID": capability.CAP_SETUID,
"LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE, "CAP_LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE,
"NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE, "CAP_NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE,
"NET_BROADCAST": capability.CAP_NET_BROADCAST, "CAP_NET_BROADCAST": capability.CAP_NET_BROADCAST,
"IPC_LOCK": capability.CAP_IPC_LOCK, "CAP_IPC_LOCK": capability.CAP_IPC_LOCK,
"IPC_OWNER": capability.CAP_IPC_OWNER, "CAP_IPC_OWNER": capability.CAP_IPC_OWNER,
"SYS_CHROOT": capability.CAP_SYS_CHROOT, "CAP_SYS_CHROOT": capability.CAP_SYS_CHROOT,
"SYS_PTRACE": capability.CAP_SYS_PTRACE, "CAP_SYS_PTRACE": capability.CAP_SYS_PTRACE,
"SYS_BOOT": capability.CAP_SYS_BOOT, "CAP_SYS_BOOT": capability.CAP_SYS_BOOT,
"LEASE": capability.CAP_LEASE, "CAP_LEASE": capability.CAP_LEASE,
"SETFCAP": capability.CAP_SETFCAP, "CAP_SETFCAP": capability.CAP_SETFCAP,
"WAKE_ALARM": capability.CAP_WAKE_ALARM, "CAP_WAKE_ALARM": capability.CAP_WAKE_ALARM,
"BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND, "CAP_BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND,
"AUDIT_READ": capability.CAP_AUDIT_READ, "CAP_AUDIT_READ": capability.CAP_AUDIT_READ,
} }
func newCapWhitelist(caps []string) (*whitelist, error) { func newCapWhitelist(caps []string) (*whitelist, error) {

2
libcontainer/integration/exec_test.go
View File

@ -336,7 +336,7 @@ func TestProcessCaps(t *testing.T) {
ok(t, err) ok(t, err)
defer container.Destroy() defer container.Destroy()
processCaps := append(config.Capabilities, "NET_ADMIN") processCaps := append(config.Capabilities, "CAP_NET_ADMIN")
var stdout bytes.Buffer var stdout bytes.Buffer
pconfig := libcontainer.Process{ pconfig := libcontainer.Process{

28
libcontainer/integration/template_test.go
View File

@ -23,20 +23,20 @@ func newTemplateConfig(rootfs string) *configs.Config {
return &configs.Config{ return &configs.Config{
Rootfs: rootfs, Rootfs: rootfs,
Capabilities: []string{ Capabilities: []string{
"CHOWN", "CAP_CHOWN",
"DAC_OVERRIDE", "CAP_DAC_OVERRIDE",
"FSETID", "CAP_FSETID",
"FOWNER", "CAP_FOWNER",
"MKNOD", "CAP_MKNOD",
"NET_RAW", "CAP_NET_RAW",
"SETGID", "CAP_SETGID",
"SETUID", "CAP_SETUID",
"SETFCAP", "CAP_SETFCAP",
"SETPCAP", "CAP_SETPCAP",
"NET_BIND_SERVICE", "CAP_NET_BIND_SERVICE",
"SYS_CHROOT", "CAP_SYS_CHROOT",
"KILL", "CAP_KILL",
"AUDIT_WRITE", "CAP_AUDIT_WRITE",
}, },
Namespaces: configs.Namespaces([]configs.Namespace{ Namespaces: configs.Namespaces([]configs.Namespace{
{Type: configs.NEWNS}, {Type: configs.NEWNS},

6
spec.go
View File

@ -84,9 +84,9 @@ var specCommand = cli.Command{
}, },
Linux: specs.Linux{ Linux: specs.Linux{
Capabilities: []string{ Capabilities: []string{
"AUDIT_WRITE", "CAP_AUDIT_WRITE",
"KILL", "CAP_KILL",
"NET_BIND_SERVICE", "CAP_NET_BIND_SERVICE",
}, },
}, },
} }