1
0
Fork 0
mirror of https://github.com/moby/moby.git synced 2022-11-09 12:21:53 -05:00
Commit graph

15 commits

Author SHA1 Message Date
Sebastiaan van Stijn
485cf38d48
oci/caps: limit available capabilities to current environment
In situations where docker runs in an environment where capabilities are limited,
sucn as docker-in-docker in a container created by older versions of docker, or
in a container where some capabilities have been disabled, starting a privileged
container may fail, because even though the _kernel_ supports a capability, the
capability is not available.

This patch attempts to address this problem by limiting the list of "known" capa-
bilities on the set of effective capabilties for the current process. This code
is based on the code in containerd's "caps" package.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-10-15 16:12:26 +02:00
Sebastiaan van Stijn
58c4c120a8
oci/caps: simplify, and remove types that were not needed
The `CapabilityMapping` and `Capabilities` types appeared to be only
used locally, and added unneeded complexity.

This patch removes those types, and simplifies the logic to use a
map that maps names to `capability.Cap`s

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-04 11:25:55 +02:00
Sebastiaan van Stijn
fc3f98848a
oci/caps: improve error message for unsupported capabilities
A capability can either be invalid, or not supported by the kernel
on which we're running. This patch changes the error message produced
to reflect if the capability is invalid/unknown, or a known capability,
but not supported by the kernel version.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-04 11:25:53 +02:00
Sebastiaan van Stijn
72b1fb59fe
oci/caps: use map for capabilities to simplify lookup
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-04 11:25:51 +02:00
Sebastiaan van Stijn
d786a52364
oci/caps: generate list of all capabilities on "init"
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-04 11:25:48 +02:00
Sebastiaan van Stijn
0ec6f7ea23
oci/caps: minor optimization in init
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-04 11:25:44 +02:00
Sebastiaan van Stijn
b00b21b93c
oci/caps: rename some vars that conflicted with imports / built-ins
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-04 11:24:40 +02:00
Sebastiaan van Stijn
94334153b5
oci/caps: remove hack for RHEL6 kernels
We no longer support these kernels, so we can remove the workaround

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-04 11:23:56 +02:00
Sebastiaan van Stijn
c1c973e81b
Revert "Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE"
Now that runc v1.0.0-rc93 is used, we can revert this temporary workaround

This reverts commit a38b96b8cd.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-03 16:12:31 +02:00
Sebastiaan van Stijn
a40197328e
oci/caps: remove unused GetCapability() and ValidateCapabilities()
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-05-06 15:59:26 +02:00
Sebastiaan van Stijn
a38b96b8cd
Temporarily disable CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE
This prevents docker from setting CAP_PERFMON, CAP_BPF, and CAP_CHECKPOINT_RESTORE
capabilities on privileged (or CAP_ALL) containers on Kernel 5.8 and up.

While these kernels support these capabilities, the current release of
runc ships with an older version of /gocapability/capability, and does
not know about them, causing an error to be produced.

We can remove this restriction once 6dfbe9b807
is included in a runc release and once we stop supporting containerd 1.3.x
(which ships with runc v1.0.0-rc92).

Thanks to Anca Iordache for reporting.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-10-16 17:52:27 +02:00
Brian Goff
24f173a003 Replace service "Capabilities" w/ add/drop API
After dicussing with maintainers, it was decided putting the burden of
providing the full cap list on the client is not a good design.
Instead we decided to follow along with the container API and use cap
add/drop.

This brings in the changes already merged into swarmkit.

Signed-off-by: Brian Goff <cpuguy83@gmail.com>
2020-07-27 10:09:42 -07:00
Olli Janatuinen
1308a3a99f Move DefaultCapabilities() to caps package
Signed-off-by: Olli Janatuinen <olli.janatuinen@gmail.com>
2019-11-14 21:13:16 +02:00
Olli Janatuinen
80d7bfd54d Capabilities refactor
- Add support for exact list of capabilities, support only OCI model
- Support OCI model on CapAdd and CapDrop but remain backward compatibility
- Create variable locally instead of declaring it at the top
- Use const for magic "ALL" value
- Rename `cap` variable as it overlaps with `cap()` built-in
- Normalize and validate capabilities before use
- Move validation for conflicting options to validateHostConfig()
- TweakCapabilities: simplify logic to calculate capabilities

Signed-off-by: Olli Janatuinen <olli.janatuinen@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-01-22 21:50:41 +02:00
Michael Crosby
b940cc5cff Move caps and device spec utils to oci pkg
Signed-off-by: Michael Crosby <crosbymichael@gmail.com>
2018-12-11 10:20:25 -05:00