Make libcontainer's CapabilitiesMask into a []string (Capabilities).

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)

libcontainer/container.go

@@ -19,7 +19,7 @@ type Container struct {
 	Env          []string        `json:"environment,omitempty"`   // environment to set
 	Tty          bool            `json:"tty,omitempty"`           // setup a proper tty or not
 	Namespaces   map[string]bool `json:"namespaces,omitempty"`    // namespaces to apply
-	CapabilitiesMask map[string]bool `json:"capabilities_mask,omitempty"` // capabilities to drop
+	Capabilities []string        `json:"capabilities,omitempty"`  // capabilities given to the container
 	Networks     []*Network      `json:"networks,omitempty"`      // nil for host's network stack
 	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`       // cgroups
 	Context      Context         `json:"context,omitempty"`       // generic context for specific options (apparmor, selinux)

libcontainer/container.json

@@ -24,24 +24,9 @@
       "mtu": 1500
     }
   ],
-  "capabilities_mask": {
+  "capabilities": [
-    "SYSLOG": false,
+    "MKNOD"
-    "MKNOD": true,
+  ],
-    "NET_ADMIN": false,
-    "MAC_ADMIN": false,
-    "MAC_OVERRIDE": false,
-    "AUDIT_CONTROL": false,
-    "AUDIT_WRITE": false,
-    "SYS_TTY_CONFIG": false,
-    "SETPCAP": false,
-    "SYS_MODULE": false,
-    "SYS_RAWIO": false,
-    "SYS_PACCT": false,
-    "SYS_ADMIN": false,
-    "SYS_NICE": false,
-    "SYS_RESOURCE": false,
-    "SYS_TIME": false
-  },
   "cgroups": {
     "name": "docker-koye",
     "parent": "docker"

libcontainer/container_test.go

@@ -6,6 +6,16 @@ import (
 	"testing"
 )
 
+// Checks whether the expected capability is specified in the capabilities.
+func hasCapability(expected string, capabilities []string) bool {
+	for _, capability := range capabilities {
+		if capability == expected {
+			return true
+		}
+	}
+	return false
+}
+
 func TestContainerJsonFormat(t *testing.T) {
 	f, err := os.Open("container.json")
 	if err != nil {
@@ -37,22 +47,17 @@ func TestContainerJsonFormat(t *testing.T) {
 		t.Fail()
 	}
 
-	if _, exists := container.CapabilitiesMask["SYS_ADMIN"]; !exists {
+	if hasCapability("SYS_ADMIN", container.Capabilities) {
-		t.Log("capabilities mask should contain SYS_ADMIN")
-		t.Fail()
-	}
-
-	if container.CapabilitiesMask["SYS_ADMIN"] {
 		t.Log("SYS_ADMIN should not be enabled in capabilities mask")
 		t.Fail()
 	}
 
-	if !container.CapabilitiesMask["MKNOD"] {
+	if !hasCapability("MKNOD", container.Capabilities) {
 		t.Log("MKNOD should be enabled in capabilities mask")
 		t.Fail()
 	}
 
-	if container.CapabilitiesMask["SYS_CHROOT"] {
+	if hasCapability("SYS_CHROOT", container.Capabilities) {
 		t.Log("capabilities mask should not contain SYS_CHROOT")
 		t.Fail()
 	}

libcontainer/security/capabilities/capabilities.go

@@ -26,15 +26,13 @@ func DropCapabilities(container *libcontainer.Container) error {
 	return nil
 }
 
-// getCapabilitiesMask returns the capabilities that should not be dropped by the container.
+// getEnabledCapabilities returns the capabilities that should not be dropped by the container.
 func getEnabledCapabilities(container *libcontainer.Container) []capability.Cap {
 	keep := []capability.Cap{}
-	for key, enabled := range container.CapabilitiesMask {
+	for _, capability := range container.Capabilities {
-		if enabled {
+		if c := libcontainer.GetCapability(capability); c != nil {
-			if c := libcontainer.GetCapability(key); c != nil {
 			keep = append(keep, c.Value)
 		}
 	}
-	}
 	return keep
 }

libcontainer/types.go

@@ -123,6 +123,14 @@ func GetCapability(key string) *Capability {
 	return nil
 }
 
+func GetAllCapabilities() []string {
+	output := make([]string, len(capabilityList))
+	for i, capability := range capabilityList {
+		output[i] = capability.String()
+	}
+	return output
+}
+
 // Contains returns true if the specified Capability is
 // in the slice
 func (c Capabilities) Contains(capp string) bool {