Skip to content

Commit 01205bc

Browse files
liangchenyeliangchenye
authored
Merge pull request #358 from q384566678/cap-specific
Specific cap-add and cap-drop command
2 parents b00ed51 + 4f756fd commit 01205bc

File tree

4 files changed

+242
-42
lines changed

4 files changed

+242
-42
lines changed

‎cmd/oci-runtime-tool/generate.go

+92-12
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,17 @@ var generateFlags = []cli.Flag{
8282
cli.StringFlag{Name: "mount-cgroups", Value: "no", Usage: "mount cgroups (rw,ro,no)"},
8383
cli.StringFlag{Name: "output", Usage: "output file (defaults to stdout)"},
8484
cli.BoolFlag{Name: "privileged", Usage: "enable privileged container settings"},
85-
cli.StringSliceFlag{Name: "process-cap-add", Usage: "add Linux capabilities"},
86-
cli.StringSliceFlag{Name: "process-cap-drop", Usage: "drop Linux capabilities"},
85+
cli.StringSliceFlag{Name: "process-cap-add-ambient", Usage: "add Linux ambient capabilities"},
86+
cli.StringSliceFlag{Name: "process-cap-add-bounding", Usage: "add Linux bounding capabilities"},
87+
cli.StringSliceFlag{Name: "process-cap-add-effective", Usage: "add Linux effective capabilities"},
88+
cli.StringSliceFlag{Name: "process-cap-add-inheritable", Usage: "add Linux inheritable capabilities"},
89+
cli.StringSliceFlag{Name: "process-cap-add-permitted", Usage: "add Linux permitted capabilities"},
8790
cli.BoolFlag{Name: "process-cap-drop-all", Usage: "drop all Linux capabilities"},
91+
cli.StringSliceFlag{Name: "process-cap-drop-ambient", Usage: "drop Linux ambient capabilities"},
92+
cli.StringSliceFlag{Name: "process-cap-drop-bounding", Usage: "drop Linux bounding capabilities"},
93+
cli.StringSliceFlag{Name: "process-cap-drop-effective", Usage: "drop Linux effective capabilities"},
94+
cli.StringSliceFlag{Name: "process-cap-drop-inheritable", Usage: "drop Linux inheritable capabilities"},
95+
cli.StringSliceFlag{Name: "process-cap-drop-permitted", Usage: "drop Linux permitted capabilities"},
8896
cli.StringFlag{Name: "process-consolesize", Usage: "specifies the console size in characters (width:height)"},
8997
cli.StringFlag{Name: "process-cwd", Value: "/", Usage: "current working directory for the process"},
9098
cli.IntFlag{Name: "process-gid", Usage: "gid for the process"},
@@ -265,19 +273,95 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
265273

266274
g.SetupPrivileged(context.Bool("privileged"))
267275

268-
if context.IsSet("process-cap-add") {
269-
addCaps := context.StringSlice("process-cap-add")
276+
if context.IsSet("process-cap-add-ambient") {
277+
addCaps := context.StringSlice("process-cap-add-ambient")
270278
for _, cap := range addCaps {
271-
if err := g.AddProcessCapability(cap); err != nil {
279+
if err := g.AddProcessCapabilityAmbient(cap); err != nil {
272280
return err
273281
}
274282
}
275283
}
276284

277-
if context.IsSet("process-cap-drop") {
278-
dropCaps := context.StringSlice("process-cap-drop")
285+
if context.IsSet("process-cap-add-bounding") {
286+
addCaps := context.StringSlice("process-cap-add-bounding")
287+
for _, cap := range addCaps {
288+
if err := g.AddProcessCapabilityBounding(cap); err != nil {
289+
return err
290+
}
291+
}
292+
}
293+
294+
if context.IsSet("process-cap-add-effective") {
295+
addCaps := context.StringSlice("process-cap-add-effective")
296+
for _, cap := range addCaps {
297+
if err := g.AddProcessCapabilityEffective(cap); err != nil {
298+
return err
299+
}
300+
}
301+
}
302+
303+
if context.IsSet("process-cap-add-inheritable") {
304+
addCaps := context.StringSlice("process-cap-add-inheritable")
305+
for _, cap := range addCaps {
306+
if err := g.AddProcessCapabilityInheritable(cap); err != nil {
307+
return err
308+
}
309+
}
310+
}
311+
312+
if context.IsSet("process-cap-add-permitted") {
313+
addCaps := context.StringSlice("process-cap-add-permitted")
314+
for _, cap := range addCaps {
315+
if err := g.AddProcessCapabilityPermitted(cap); err != nil {
316+
return err
317+
}
318+
}
319+
}
320+
321+
if context.Bool("process-cap-drop-all") {
322+
g.ClearProcessCapabilities()
323+
}
324+
325+
if context.IsSet("process-cap-drop-ambient") {
326+
dropCaps := context.StringSlice("process-cap-drop-ambient")
279327
for _, cap := range dropCaps {
280-
if err := g.DropProcessCapability(cap); err != nil {
328+
if err := g.DropProcessCapabilityAmbient(cap); err != nil {
329+
return err
330+
}
331+
}
332+
}
333+
334+
if context.IsSet("process-cap-drop-bounding") {
335+
dropCaps := context.StringSlice("process-cap-drop-bounding")
336+
for _, cap := range dropCaps {
337+
if err := g.DropProcessCapabilityBounding(cap); err != nil {
338+
return err
339+
}
340+
}
341+
}
342+
343+
if context.IsSet("process-cap-drop-effective") {
344+
dropCaps := context.StringSlice("process-cap-drop-effective")
345+
for _, cap := range dropCaps {
346+
if err := g.DropProcessCapabilityEffective(cap); err != nil {
347+
return err
348+
}
349+
}
350+
}
351+
352+
if context.IsSet("process-cap-drop-inheritable") {
353+
dropCaps := context.StringSlice("process-cap-drop-inheritable")
354+
for _, cap := range dropCaps {
355+
if err := g.DropProcessCapabilityInheritable(cap); err != nil {
356+
return err
357+
}
358+
}
359+
}
360+
361+
if context.IsSet("process-cap-drop-permitted") {
362+
dropCaps := context.StringSlice("process-cap-drop-permitted")
363+
for _, cap := range dropCaps {
364+
if err := g.DropProcessCapabilityPermitted(cap); err != nil {
281365
return err
282366
}
283367
}
@@ -292,10 +376,6 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
292376
g.SetProcessConsoleSize(width, height)
293377
}
294378

295-
if context.Bool("process-cap-drop-all") {
296-
g.ClearProcessCapabilities()
297-
}
298-
299379
var uidMaps, gidMaps []string
300380

301381
if context.IsSet("linux-uidmappings") {

‎completions/bash/oci-runtime-tool

+10-2
Original file line numberDiff line numberDiff line change
@@ -363,8 +363,16 @@ _oci-runtime-tool_generate() {
363363
--mount-bind
364364
--mount-cgroups
365365
--output
366-
--process-cap-add
367-
--process-cap-drop
366+
--process-cap-add-ambient
367+
--process-cap-add-bounding
368+
--process-cap-add-effective
369+
--process-cap-add-inheritable
370+
--process-cap-add-permitted
371+
--process-cap-drop-ambient
372+
--process-cap-drop-bounding
373+
--process-cap-drop-effective
374+
--process-cap-drop-inheritable
375+
--process-cap-drop-permitted
368376
--process-consolesize
369377
--process-cwd
370378
--process-gid

‎generate/generate.go

+112-24
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,12 @@ import (
1717
var (
1818
// Namespaces include the names of supported namespaces.
1919
Namespaces = []string{"network", "pid", "mount", "ipc", "uts", "user", "cgroup"}
20+
21+
// we don't care about order...and this is way faster...
22+
removeFunc = func(s []string, i int) []string {
23+
s[i] = s[len(s)-1]
24+
return s[:len(s)-1]
25+
}
2026
)
2127

2228
// Generator represents a generator for a container spec.
@@ -980,8 +986,32 @@ func (g *Generator) ClearProcessCapabilities() {
980986
g.spec.Process.Capabilities.Ambient = []string{}
981987
}
982988

983-
// AddProcessCapability adds a process capability into g.spec.Process.Capabilities.
984-
func (g *Generator) AddProcessCapability(c string) error {
989+
// AddProcessCapabilityAmbient adds a process capability into g.spec.Process.Capabilities.Ambient.
990+
func (g *Generator) AddProcessCapabilityAmbient(c string) error {
991+
cp := strings.ToUpper(c)
992+
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
993+
return err
994+
}
995+
996+
g.initSpecProcessCapabilities()
997+
998+
var foundAmbient bool
999+
for _, cap := range g.spec.Process.Capabilities.Ambient {
1000+
if strings.ToUpper(cap) == cp {
1001+
foundAmbient = true
1002+
break
1003+
}
1004+
}
1005+
1006+
if !foundAmbient {
1007+
g.spec.Process.Capabilities.Ambient = append(g.spec.Process.Capabilities.Ambient, cp)
1008+
}
1009+
1010+
return nil
1011+
}
1012+
1013+
// AddProcessCapabilityBounding adds a process capability into g.spec.Process.Capabilities.Bounding.
1014+
func (g *Generator) AddProcessCapabilityBounding(c string) error {
9851015
cp := strings.ToUpper(c)
9861016
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
9871017
return err
@@ -1000,6 +1030,18 @@ func (g *Generator) AddProcessCapability(c string) error {
10001030
g.spec.Process.Capabilities.Bounding = append(g.spec.Process.Capabilities.Bounding, cp)
10011031
}
10021032

1033+
return nil
1034+
}
1035+
1036+
// AddProcessCapabilityEffective adds a process capability into g.spec.Process.Capabilities.Effective.
1037+
func (g *Generator) AddProcessCapabilityEffective(c string) error {
1038+
cp := strings.ToUpper(c)
1039+
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1040+
return err
1041+
}
1042+
1043+
g.initSpecProcessCapabilities()
1044+
10031045
var foundEffective bool
10041046
for _, cap := range g.spec.Process.Capabilities.Effective {
10051047
if strings.ToUpper(cap) == cp {
@@ -1011,6 +1053,18 @@ func (g *Generator) AddProcessCapability(c string) error {
10111053
g.spec.Process.Capabilities.Effective = append(g.spec.Process.Capabilities.Effective, cp)
10121054
}
10131055

1056+
return nil
1057+
}
1058+
1059+
// AddProcessCapabilityInheritable adds a process capability into g.spec.Process.Capabilities.Inheritable.
1060+
func (g *Generator) AddProcessCapabilityInheritable(c string) error {
1061+
cp := strings.ToUpper(c)
1062+
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1063+
return err
1064+
}
1065+
1066+
g.initSpecProcessCapabilities()
1067+
10141068
var foundInheritable bool
10151069
for _, cap := range g.spec.Process.Capabilities.Inheritable {
10161070
if strings.ToUpper(cap) == cp {
@@ -1022,6 +1076,18 @@ func (g *Generator) AddProcessCapability(c string) error {
10221076
g.spec.Process.Capabilities.Inheritable = append(g.spec.Process.Capabilities.Inheritable, cp)
10231077
}
10241078

1079+
return nil
1080+
}
1081+
1082+
// AddProcessCapabilityPermitted adds a process capability into g.spec.Process.Capabilities.Permitted.
1083+
func (g *Generator) AddProcessCapabilityPermitted(c string) error {
1084+
cp := strings.ToUpper(c)
1085+
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1086+
return err
1087+
}
1088+
1089+
g.initSpecProcessCapabilities()
1090+
10251091
var foundPermitted bool
10261092
for _, cap := range g.spec.Process.Capabilities.Permitted {
10271093
if strings.ToUpper(cap) == cp {
@@ -1033,57 +1099,79 @@ func (g *Generator) AddProcessCapability(c string) error {
10331099
g.spec.Process.Capabilities.Permitted = append(g.spec.Process.Capabilities.Permitted, cp)
10341100
}
10351101

1036-
var foundAmbient bool
1037-
for _, cap := range g.spec.Process.Capabilities.Ambient {
1102+
return nil
1103+
}
1104+
1105+
// DropProcessCapabilityAmbient drops a process capability from g.spec.Process.Capabilities.Ambient.
1106+
func (g *Generator) DropProcessCapabilityAmbient(c string) error {
1107+
cp := strings.ToUpper(c)
1108+
1109+
g.initSpecProcessCapabilities()
1110+
1111+
for i, cap := range g.spec.Process.Capabilities.Ambient {
10381112
if strings.ToUpper(cap) == cp {
1039-
foundAmbient = true
1040-
break
1113+
g.spec.Process.Capabilities.Ambient = removeFunc(g.spec.Process.Capabilities.Ambient, i)
10411114
}
10421115
}
1043-
if !foundAmbient {
1044-
g.spec.Process.Capabilities.Ambient = append(g.spec.Process.Capabilities.Ambient, cp)
1045-
}
10461116

1047-
return nil
1117+
return validate.CapValid(cp, false)
10481118
}
10491119

1050-
// DropProcessCapability drops a process capability from g.spec.Process.Capabilities.
1051-
func (g *Generator) DropProcessCapability(c string) error {
1120+
// DropProcessCapabilityBounding drops a process capability from g.spec.Process.Capabilities.Bounding.
1121+
func (g *Generator) DropProcessCapabilityBounding(c string) error {
10521122
cp := strings.ToUpper(c)
10531123

10541124
g.initSpecProcessCapabilities()
10551125

1056-
// we don't care about order...and this is way faster...
1057-
removeFunc := func(s []string, i int) []string {
1058-
s[i] = s[len(s)-1]
1059-
return s[:len(s)-1]
1060-
}
1061-
10621126
for i, cap := range g.spec.Process.Capabilities.Bounding {
10631127
if strings.ToUpper(cap) == cp {
10641128
g.spec.Process.Capabilities.Bounding = removeFunc(g.spec.Process.Capabilities.Bounding, i)
10651129
}
10661130
}
10671131

1132+
return validate.CapValid(cp, false)
1133+
}
1134+
1135+
// DropProcessCapabilityEffective drops a process capability from g.spec.Process.Capabilities.Effective.
1136+
func (g *Generator) DropProcessCapabilityEffective(c string) error {
1137+
cp := strings.ToUpper(c)
1138+
1139+
g.initSpecProcessCapabilities()
1140+
10681141
for i, cap := range g.spec.Process.Capabilities.Effective {
10691142
if strings.ToUpper(cap) == cp {
10701143
g.spec.Process.Capabilities.Effective = removeFunc(g.spec.Process.Capabilities.Effective, i)
10711144
}
10721145
}
10731146

1147+
return validate.CapValid(cp, false)
1148+
}
1149+
1150+
// DropProcessCapabilityInheritable drops a process capability from g.spec.Process.Capabilities.Inheritable.
1151+
func (g *Generator) DropProcessCapabilityInheritable(c string) error {
1152+
cp := strings.ToUpper(c)
1153+
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1154+
return err
1155+
}
1156+
1157+
g.initSpecProcessCapabilities()
1158+
10741159
for i, cap := range g.spec.Process.Capabilities.Inheritable {
10751160
if strings.ToUpper(cap) == cp {
10761161
g.spec.Process.Capabilities.Inheritable = removeFunc(g.spec.Process.Capabilities.Inheritable, i)
10771162
}
10781163
}
10791164

1080-
for i, cap := range g.spec.Process.Capabilities.Permitted {
1081-
if strings.ToUpper(cap) == cp {
1082-
g.spec.Process.Capabilities.Permitted = removeFunc(g.spec.Process.Capabilities.Permitted, i)
1083-
}
1084-
}
1165+
return validate.CapValid(cp, false)
1166+
}
10851167

1086-
for i, cap := range g.spec.Process.Capabilities.Ambient {
1168+
// DropProcessCapabilityPermitted drops a process capability from g.spec.Process.Capabilities.Permitted.
1169+
func (g *Generator) DropProcessCapabilityPermitted(c string) error {
1170+
cp := strings.ToUpper(c)
1171+
1172+
g.initSpecProcessCapabilities()
1173+
1174+
for i, cap := range g.spec.Process.Capabilities.Permitted {
10871175
if strings.ToUpper(cap) == cp {
10881176
g.spec.Process.Capabilities.Ambient = removeFunc(g.spec.Process.Capabilities.Ambient, i)
10891177
}

0 commit comments

Comments
 (0)