vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Improve libcontainer namespace and cap format

Browse source 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-05-05 12:34:21 -07:00
parent bbc3c913a9
commit 412c081a9b
9 changed files with 128 additions and 206 deletions
Download patch file Download diff file Expand all files Collapse all files

11
libcontainer/security/capabilities/capabilities.go
View file

@ -1,9 +1,10 @@
package capabilities
import (
"os"
"github.com/dotcloud/docker/pkg/libcontainer"
"github.com/syndtr/gocapability/capability"
"os"
)
// DropCapabilities drops capabilities for the current process based
@ -26,9 +27,11 @@ func DropCapabilities(container *libcontainer.Container) error {
// getCapabilitiesMask returns the specific cap mask values for the libcontainer types
func getCapabilitiesMask(container *libcontainer.Container) []capability.Cap {
drop := []capability.Cap{}
for _, c := range container.CapabilitiesMask {
if !c.Enabled {
drop = append(drop, c.Value)
for key, enabled := range container.CapabilitiesMask {
if !enabled {
if c := libcontainer.GetCapability(key); c != nil {
drop = append(drop, c.Value)
}
}
}
return drop