vbatts/pkg
1
0
Fork 0
Code Pull requests Releases Activity

Allow caps to be toggled in native driver with plugin flag

Browse source 
Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@crosbymichael.com> (github: crosbymichael)
This commit is contained in:
Michael Crosby 2014-03-21 00:10:24 +00:00
parent f6a8719dd5
commit 67a1625791
2 changed files with 26 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
libcontainer/capabilities/capabilities.go
View file

@ -27,7 +27,9 @@ func DropCapabilities(container *libcontainer.Container) error {
func getCapabilitiesMask(container *libcontainer.Container) []capability.Cap { func getCapabilitiesMask(container *libcontainer.Container) []capability.Cap {
drop := []capability.Cap{} drop := []capability.Cap{}
for _, c := range container.CapabilitiesMask { for _, c := range container.CapabilitiesMask {
if !c.Enabled {
drop = append(drop, c.Value) drop = append(drop, c.Value)
} }
}
return drop return drop
} }

41
libcontainer/types.go
View file

@ -18,21 +18,21 @@ var (
namespaceList = Namespaces{} namespaceList = Namespaces{}
capabilityList = Capabilities{ capabilityList = Capabilities{
{Key: "SETPCAP", Value: capability.CAP_SETPCAP, Enabled: true}, {Key: "SETPCAP", Value: capability.CAP_SETPCAP, Enabled: false},
{Key: "SYS_MODULE", Value: capability.CAP_SYS_MODULE, Enabled: true}, {Key: "SYS_MODULE", Value: capability.CAP_SYS_MODULE, Enabled: false},
{Key: "SYS_RAWIO", Value: capability.CAP_SYS_RAWIO, Enabled: true}, {Key: "SYS_RAWIO", Value: capability.CAP_SYS_RAWIO, Enabled: false},
{Key: "SYS_PACCT", Value: capability.CAP_SYS_PACCT, Enabled: true}, {Key: "SYS_PACCT", Value: capability.CAP_SYS_PACCT, Enabled: false},
{Key: "SYS_ADMIN", Value: capability.CAP_SYS_ADMIN, Enabled: true}, {Key: "SYS_ADMIN", Value: capability.CAP_SYS_ADMIN, Enabled: false},
{Key: "SYS_NICE", Value: capability.CAP_SYS_NICE, Enabled: true}, {Key: "SYS_NICE", Value: capability.CAP_SYS_NICE, Enabled: false},
{Key: "SYS_RESOURCE", Value: capability.CAP_SYS_RESOURCE, Enabled: true}, {Key: "SYS_RESOURCE", Value: capability.CAP_SYS_RESOURCE, Enabled: false},
{Key: "SYS_TIME", Value: capability.CAP_SYS_TIME, Enabled: true}, {Key: "SYS_TIME", Value: capability.CAP_SYS_TIME, Enabled: false},
{Key: "SYS_TTY_CONFIG", Value: capability.CAP_SYS_TTY_CONFIG, Enabled: true}, {Key: "SYS_TTY_CONFIG", Value: capability.CAP_SYS_TTY_CONFIG, Enabled: false},
{Key: "MKNOD", Value: capability.CAP_MKNOD, Enabled: true}, {Key: "MKNOD", Value: capability.CAP_MKNOD, Enabled: false},
{Key: "AUDIT_WRITE", Value: capability.CAP_AUDIT_WRITE, Enabled: true}, {Key: "AUDIT_WRITE", Value: capability.CAP_AUDIT_WRITE, Enabled: false},
{Key: "AUDIT_CONTROL", Value: capability.CAP_AUDIT_CONTROL, Enabled: true}, {Key: "AUDIT_CONTROL", Value: capability.CAP_AUDIT_CONTROL, Enabled: false},
{Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE, Enabled: true}, {Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE, Enabled: false},
{Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN, Enabled: true}, {Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN, Enabled: false},
{Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN, Enabled: true}, {Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN, Enabled: false},
} }
) )
@ -86,7 +86,8 @@ func (c *Capability) String() string {
func GetCapability(key string) *Capability { func GetCapability(key string) *Capability {
for _, capp := range capabilityList { for _, capp := range capabilityList {
if capp.Key == key { if capp.Key == key {
return capp cpy := *capp
return &cpy
} }
} }
return nil return nil
@ -95,10 +96,14 @@ func GetCapability(key string) *Capability {
// Contains returns true if the specified Capability is // Contains returns true if the specified Capability is
// in the slice // in the slice
func (c Capabilities) Contains(capp string) bool { func (c Capabilities) Contains(capp string) bool {
return c.Get(capp) != nil
}
func (c Capabilities) Get(capp string) *Capability {
for _, cap := range c { for _, cap := range c {
if cap.Key == capp { if cap.Key == capp {
return true return cap
} }
} }
return false return nil
} }