vbatts/cri-o
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

container_create: handle cap add/drop ALL

Browse source 
Kubelet can send cap add/drop ALL. Handle that in CRI-O as well.
Also, this PR is re-vendoring runtime-tools to fix capabilities add to
add caps to _all_ caps set **and** fix a shared memory issue (caps set
were initialized with the same slice, if one modifies one slice, it's
reflected on the other slices, the vendoring fixes this as well)

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
This commit is contained in:
Antonio Murdaca 2017-09-06 13:25:19 +02:00
parent 7f4f630b98
commit af0a494251
No known key found for this signature in database
GPG key ID: B2BEAD150DE936B9
25 changed files with 2057 additions and 283 deletions
Download patch file Download diff file Expand all files Collapse all files

1
test/testdata/container_config.json vendored
View file

@ -57,7 +57,6 @@
"setgid"
],
"drop_capabilities": [
"audit_read"
]
},
"selinux_options": {

1
test/testdata/container_config_by_imageid.json vendored
View file

@ -57,7 +57,6 @@
"setgid"
],
"drop_capabilities": [
"audit_read"
]
},
"selinux_options": {

1
test/testdata/container_config_hostport.json vendored
View file

@ -59,7 +59,6 @@
"setgid"
],
"drop_capabilities": [
"audit_read"
]
},
"selinux_options": {

1
test/testdata/container_config_logging.json vendored
View file

@ -59,7 +59,6 @@
"setgid"
],
"drop_capabilities": [
"audit_read"
]
},
"selinux_options": {

1
test/testdata/container_config_resolvconf.json vendored
View file

@ -59,7 +59,6 @@
"setgid"
],
"drop_capabilities": [
"audit_read"
]
},
"selinux_options": {

1
test/testdata/container_config_resolvconf_ro.json vendored
View file

@ -59,7 +59,6 @@
"setgid"
],
"drop_capabilities": [
"audit_read"
]
},
"selinux_options": {

1
test/testdata/container_config_seccomp.json vendored
View file

@ -59,7 +59,6 @@
"setgid"
],
"drop_capabilities": [
"audit_read"
]
},
"selinux_options": {