mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
7321067176
This changes the way the exec drivers work by not specifing a -driver flag on reexec. For each of the exec drivers they register their own functions that will be matched aginst the argv 0 on exec and called if they match. This also allows any functionality to be added to docker so that the binary can be reexec'd and any type of function can be called. I moved the flag parsing on docker exec to the specific initializers so that the implementations do not bleed into one another. This also allows for more flexability within reexec initializers to specify their own flags and options. Signed-off-by: Michael Crosby <michael@docker.com>
78 lines
1.8 KiB
Go
78 lines
1.8 KiB
Go
package lxc
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
"syscall"
|
|
|
|
"github.com/docker/docker/daemon/execdriver"
|
|
"github.com/docker/docker/daemon/execdriver/native/template"
|
|
"github.com/docker/libcontainer/namespaces"
|
|
"github.com/docker/libcontainer/security/capabilities"
|
|
"github.com/docker/libcontainer/system"
|
|
"github.com/docker/libcontainer/utils"
|
|
)
|
|
|
|
func setHostname(hostname string) error {
|
|
return syscall.Sethostname([]byte(hostname))
|
|
}
|
|
|
|
func finalizeNamespace(args *InitArgs) error {
|
|
if err := utils.CloseExecFrom(3); err != nil {
|
|
return err
|
|
}
|
|
|
|
// We use the native drivers default template so that things like caps are consistent
|
|
// across both drivers
|
|
container := template.New()
|
|
|
|
if !args.Privileged {
|
|
// drop capabilities in bounding set before changing user
|
|
if err := capabilities.DropBoundingSet(container.Capabilities); err != nil {
|
|
return fmt.Errorf("drop bounding set %s", err)
|
|
}
|
|
|
|
// preserve existing capabilities while we change users
|
|
if err := system.SetKeepCaps(); err != nil {
|
|
return fmt.Errorf("set keep caps %s", err)
|
|
}
|
|
}
|
|
|
|
if err := namespaces.SetupUser(args.User); err != nil {
|
|
return fmt.Errorf("setup user %s", err)
|
|
}
|
|
|
|
if !args.Privileged {
|
|
if err := system.ClearKeepCaps(); err != nil {
|
|
return fmt.Errorf("clear keep caps %s", err)
|
|
}
|
|
|
|
var (
|
|
adds []string
|
|
drops []string
|
|
)
|
|
|
|
if args.CapAdd != "" {
|
|
adds = strings.Split(args.CapAdd, ":")
|
|
}
|
|
if args.CapDrop != "" {
|
|
drops = strings.Split(args.CapDrop, ":")
|
|
}
|
|
|
|
caps, err := execdriver.TweakCapabilities(container.Capabilities, adds, drops)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
// drop all other capabilities
|
|
if err := capabilities.DropCapabilities(caps); err != nil {
|
|
return fmt.Errorf("drop capabilities %s", err)
|
|
}
|
|
}
|
|
|
|
if err := setupWorkingDirectory(args); err != nil {
|
|
return err
|
|
}
|
|
|
|
return nil
|
|
}
|