Better capability/namespace management

Docker-DCO-1.1-Signed-off-by: Guillaume J. Charmes <guillaume.charmes@docker.com> (github: creack)

libcontainer/types.go

@@ -1,58 +1,131 @@
 package libcontainer
 
-// These constants are defined as string types so that
-// it is clear when adding the configuration in config files
-// instead of using ints or other types
-const (
-	CAP_SETPCAP        Capability = "SETPCAP"
-	CAP_SYS_MODULE     Capability = "SYS_MODULE"
-	CAP_SYS_RAWIO      Capability = "SYS_RAWIO"
-	CAP_SYS_PACCT      Capability = "SYS_PACCT"
-	CAP_SYS_ADMIN      Capability = "SYS_ADMIN"
-	CAP_SYS_NICE       Capability = "SYS_NICE"
-	CAP_SYS_RESOURCE   Capability = "SYS_RESOURCE"
-	CAP_SYS_TIME       Capability = "SYS_TIME"
-	CAP_SYS_TTY_CONFIG Capability = "SYS_TTY_CONFIG"
-	CAP_MKNOD          Capability = "MKNOD"
-	CAP_AUDIT_WRITE    Capability = "AUDIT_WRITE"
-	CAP_AUDIT_CONTROL  Capability = "AUDIT_CONTROL"
-	CAP_MAC_OVERRIDE   Capability = "MAC_OVERRIDE"
-	CAP_MAC_ADMIN      Capability = "MAC_ADMIN"
-	CAP_NET_ADMIN      Capability = "NET_ADMIN"
+import (
+	"encoding/json"
+	"errors"
+	"github.com/syndtr/gocapability/capability"
+	"os"
+	"syscall"
+)
 
-	CLONE_NEWNS   Namespace = "NEWNS"   // mount
-	CLONE_NEWUTS  Namespace = "NEWUTS"  // utsname
-	CLONE_NEWIPC  Namespace = "NEWIPC"  // ipc
-	CLONE_NEWUSER Namespace = "NEWUSER" // user
-	CLONE_NEWPID  Namespace = "NEWPID"  // pid
-	CLONE_NEWNET  Namespace = "NEWNET"  // network
+var (
+	ErrUnkownNamespace error = errors.New("Unkown namespace")
+)
+
+// namespaceList is used to convert the libcontainer types
+// into the names of the files located in /proc/<pid>/ns/* for
+// each namespace
+var (
+	namespaceList = Namespaces{
+		{Key: "NEWNS", Value: syscall.CLONE_NEWNS, File: "mnt"},
+		{Key: "NEWUTS", Value: syscall.CLONE_NEWUTS, File: "uts"},
+		{Key: "NEWIPC", Value: syscall.CLONE_NEWIPC, File: "ipc"},
+		{Key: "NEWUSER", Value: syscall.CLONE_NEWUSER, File: "user"},
+		{Key: "NEWPID", Value: syscall.CLONE_NEWPID, File: "pid"},
+		{Key: "NEWNET", Value: syscall.CLONE_NEWNET, File: "net"},
+	}
+	capabilityList = Capabilities{
+		{Key: "SETPCAP", Value: capability.CAP_SETPCAP},
+		{Key: "SYS_MODULE", Value: capability.CAP_SYS_MODULE},
+		{Key: "SYS_RAWIO", Value: capability.CAP_SYS_RAWIO},
+		{Key: "SYS_PACCT", Value: capability.CAP_SYS_PACCT},
+		{Key: "SYS_ADMIN", Value: capability.CAP_SYS_ADMIN},
+		{Key: "SYS_NICE", Value: capability.CAP_SYS_NICE},
+		{Key: "SYS_RESOURCE", Value: capability.CAP_SYS_RESOURCE},
+		{Key: "SYS_TIME", Value: capability.CAP_SYS_TIME},
+		{Key: "SYS_TTY_CONFIG", Value: capability.CAP_SYS_TTY_CONFIG},
+		{Key: "MKNOD", Value: capability.CAP_MKNOD},
+		{Key: "AUDIT_WRITE", Value: capability.CAP_AUDIT_WRITE},
+		{Key: "AUDIT_CONTROL", Value: capability.CAP_AUDIT_CONTROL},
+		{Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE},
+		{Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN},
+		{Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN},
+	}
 )
 
 type (
-	Namespace    string
-	Namespaces   []Namespace
-	Capability   string
-	Capabilities []Capability
+	Namespace struct {
+		Key   string
+		Value int
+		File  string
+	}
+	Namespaces []*Namespace
 )
 
+func (ns *Namespace) MarshalJSON() ([]byte, error) {
+	return json.Marshal(ns.Key)
+}
+
+func (ns *Namespace) UnmarshalJSON(src []byte) error {
+	var nsName string
+	if err := json.Unmarshal(src, &nsName); err != nil {
+		return err
+	}
+	ret := GetNamespace(nsName)
+	if ret == nil {
+		return ErrUnkownNamespace
+	}
+	*ns = *ret
+	return nil
+}
+
+func GetNamespace(key string) *Namespace {
+	for _, ns := range namespaceList {
+		if ns.Key == key {
+			return ns
+		}
+	}
+	if os.Getenv("DEBUG") != "" {
+		panic("Unreachable: Namespace not found")
+	}
+	return nil
+}
+
 // Contains returns true if the specified Namespace is
 // in the slice
-func (n Namespaces) Contains(ns Namespace) bool {
-	for _, nns := range n {
-		if nns == ns {
-			return true
+func (n Namespaces) Contains(ns string) bool {
+	return GetNamespace(ns) != nil
+}
+
+type (
+	Capability struct {
+		Key   string
+		Value capability.Cap
+	}
+	Capabilities []*Capability
+)
+
+func (ns *Capability) MarshalJSON() ([]byte, error) {
+	return json.Marshal(ns.Key)
+}
+
+func (ns *Capability) UnmarshalJSON(src []byte) error {
+	var capName string
+	if err := json.Unmarshal(src, &capName); err != nil {
+		return err
+	}
+	ret := GetCapability(capName)
+	if ret == nil {
+		return ErrUnkownNamespace
+	}
+	*ns = *ret
+	return nil
+}
+
+func GetCapability(key string) *Capability {
+	for _, capp := range capabilityList {
+		if capp.Key == key {
+			return capp
 		}
 	}
-	return false
+	if os.Getenv("DEBUG") != "" {
+		panic("Unreachable: Namespace not found")
+	}
+	return nil
 }
 
 // Contains returns true if the specified Capability is
 // in the slice
-func (c Capabilities) Contains(capp Capability) bool {
-	for _, cc := range c {
-		if cc == capp {
-			return true
-		}
-	}
-	return false
+func (c Capabilities) Contains(capp string) bool {
+	return GetCapability(capp) != nil
 }