kotovalexarian-likes-github/moby--moby
1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Code Releases Activity

Change libcontainer to drop all capabilities by default. Only keeps

Browse source 
those that were specified in the config. This commit also explicitly
adds a set of capabilities that we were silently not dropping and were
assumed by the tests.

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)
This commit is contained in:
Victor Marmol 2014-05-14 18:29:08 +00:00
parent b561f0398a
commit 9d6875d19d
3 changed files with 30 additions and 18 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
daemon/execdriver/native/template/default_template.go
View file

@ -26,6 +26,11 @@ func New() *libcontainer.Container {
"NET_ADMIN": false, "NET_ADMIN": false,
"MKNOD": true, "MKNOD": true,
"SYSLOG": false, "SYSLOG": false,
"SETUID": true,
"SETGID": true,
"CHOWN": true,
"NET_RAW": true,
"DAC_OVERRIDE": true,
}, },
Namespaces: map[string]bool{ Namespaces: map[string]bool{
"NEWNS": true, "NEWNS": true,

38
pkg/libcontainer/security/capabilities/capabilities.go
View file

@ -7,32 +7,34 @@ import (
"github.com/syndtr/gocapability/capability" "github.com/syndtr/gocapability/capability"
) )
// DropCapabilities drops capabilities for the current process based const allCapabilityTypes = capability.CAPS | capability.BOUNDS
// on the container's configuration.
func DropCapabilities(container *libcontainer.Container) error {
if drop := getCapabilitiesMask(container); len(drop) > 0 {
c, err := capability.NewPid(os.Getpid())
if err != nil {
return err
}
c.Unset(capability.CAPS|capability.BOUNDS, drop...)
if err := c.Apply(capability.CAPS | capability.BOUNDS); err != nil { // DropCapabilities drops all capabilities for the current process expect those specified in the container configuration.
return err func DropCapabilities(container *libcontainer.Container) error {
} c, err := capability.NewPid(os.Getpid())
if err != nil {
return err
}
keep := getEnabledCapabilities(container)
c.Clear(allCapabilityTypes)
c.Set(allCapabilityTypes, keep...)
if err := c.Apply(allCapabilityTypes); err != nil {
return err
} }
return nil return nil
} }
// getCapabilitiesMask returns the specific cap mask values for the libcontainer types // getCapabilitiesMask returns the capabilities that should not be dropped by the container.
func getCapabilitiesMask(container *libcontainer.Container) []capability.Cap { func getEnabledCapabilities(container *libcontainer.Container) []capability.Cap {
drop := []capability.Cap{} keep := []capability.Cap{}
for key, enabled := range container.CapabilitiesMask { for key, enabled := range container.CapabilitiesMask {
if !enabled { if enabled {
if c := libcontainer.GetCapability(key); c != nil { if c := libcontainer.GetCapability(key); c != nil {
drop = append(drop, c.Value) keep = append(keep, c.Value)
} }
} }
} }
return drop return keep
} }

5
pkg/libcontainer/types.go
View file

@ -55,6 +55,11 @@ var (
{Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN}, {Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN},
{Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN}, {Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN},
{Key: "SYSLOG", Value: capability.CAP_SYSLOG}, {Key: "SYSLOG", Value: capability.CAP_SYSLOG},
{Key: "SETUID", Value: capability.CAP_SETUID},
{Key: "SETGID", Value: capability.CAP_SETGID},
{Key: "CHOWN", Value: capability.CAP_CHOWN},
{Key: "NET_RAW", Value: capability.CAP_NET_RAW},
{Key: "DAC_OVERRIDE", Value: capability.CAP_DAC_OVERRIDE},
} }
) )