mirrors/binctr
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

remove need for any caps

Browse source 
Signed-off-by: Jess Frazelle <jess@mesosphere.com>
This commit is contained in:
Jess Frazelle 2016-04-17 21:37:13 -07:00
parent 2b527491fe
commit 736052e309
4 changed files with 5 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
Makefile
View file

@ -40,7 +40,6 @@ static: $(BINDIR) rootfs.go
@echo "+ $@" @echo "+ $@"
CGO_ENABLED=1 go build -tags "$(BUILDTAGS) cgo static_build" \ CGO_ENABLED=1 go build -tags "$(BUILDTAGS) cgo static_build" \
-ldflags "-w -extldflags -static ${LDFLAGS}" -o bin/$(notdir $(IMAGE)) . -ldflags "-w -extldflags -static ${LDFLAGS}" -o bin/$(notdir $(IMAGE)) .
@sudo setcap cap_chown,cap_fowner,cap_dac_override+ep ./bin/$(notdir $(IMAGE))
@echo "Static container created at: ./bin/$(notdir $(IMAGE))" @echo "Static container created at: ./bin/$(notdir $(IMAGE))"
@echo "Run with ./bin/$(notdir $(IMAGE))" @echo "Run with ./bin/$(notdir $(IMAGE))"

9
README.md
View file

@ -120,11 +120,4 @@ systemd so that this binary is really just the launcher :)
## Caveats ## Caveats
**Caps the binary needs to unpack and set - cgroups: coming soon
the right perms on the rootfs for the userns user**
- **CAP_CHOWN**: chown the rootfs to the userns user
- **CAP_FOWNER**: chmod rootfs
- **CAP_DAC_OVERRIDE**: symlinks
**These can be dropped after the rootfs is unpacked and chowned.**

3
vendor/github.com/docker/docker/pkg/archive/archive.go generated vendored
View file

@ -421,7 +421,8 @@ func createTarFile(path, extractDir string, hdr *tar.Header, reader io.Reader, L
chownOpts = &TarChownOptions{UID: hdr.Uid, GID: hdr.Gid} chownOpts = &TarChownOptions{UID: hdr.Uid, GID: hdr.Gid}
} }
if err := os.Lchown(path, chownOpts.UID, chownOpts.GID); err != nil { if err := os.Lchown(path, chownOpts.UID, chownOpts.GID); err != nil {
return err logrus.Debugf("lchown archive err: %v", err)
// return err
} }
} }

3
vendor/github.com/opencontainers/runc/libcontainer/process_linux.go generated vendored
View file

@ -255,7 +255,8 @@ func (p *initProcess) start() error {
// Do this before syncing with child so that no children // Do this before syncing with child so that no children
// can escape the cgroup // can escape the cgroup
if err := p.manager.Apply(p.pid()); err != nil { if err := p.manager.Apply(p.pid()); err != nil {
return newSystemError(err) logrus.Debugf("cgroups apply err: %v", err)
// return newSystemError(err)
} }
defer func() { defer func() {
if err != nil { if err != nil {