Make libcontainer's CapabilitiesMask into a []string (Capabilities).

Docker-DCO-1.1-Signed-off-by: Victor Marmol <vmarmol@google.com> (github: vmarmol)

libcontainer/container.go

@@ -11,19 +11,19 @@ type Context map[string]string
 // Container defines configuration options for how a
 // container is setup inside a directory and how a process should be executed
 type Container struct {
-	Hostname         string          `json:"hostname,omitempty"`          // hostname
+	Hostname     string          `json:"hostname,omitempty"`      // hostname
-	ReadonlyFs       bool            `json:"readonly_fs,omitempty"`       // set the containers rootfs as readonly
+	ReadonlyFs   bool            `json:"readonly_fs,omitempty"`   // set the containers rootfs as readonly
-	NoPivotRoot      bool            `json:"no_pivot_root,omitempty"`     // this can be enabled if you are running in ramdisk
+	NoPivotRoot  bool            `json:"no_pivot_root,omitempty"` // this can be enabled if you are running in ramdisk
-	User             string          `json:"user,omitempty"`              // user to execute the process as
+	User         string          `json:"user,omitempty"`          // user to execute the process as
-	WorkingDir       string          `json:"working_dir,omitempty"`       // current working directory
+	WorkingDir   string          `json:"working_dir,omitempty"`   // current working directory
-	Env              []string        `json:"environment,omitempty"`       // environment to set
+	Env          []string        `json:"environment,omitempty"`   // environment to set
-	Tty              bool            `json:"tty,omitempty"`               // setup a proper tty or not
+	Tty          bool            `json:"tty,omitempty"`           // setup a proper tty or not
-	Namespaces       map[string]bool `json:"namespaces,omitempty"`        // namespaces to apply
+	Namespaces   map[string]bool `json:"namespaces,omitempty"`    // namespaces to apply
-	CapabilitiesMask map[string]bool `json:"capabilities_mask,omitempty"` // capabilities to drop
+	Capabilities []string        `json:"capabilities,omitempty"`  // capabilities given to the container
-	Networks         []*Network      `json:"networks,omitempty"`          // nil for host's network stack
+	Networks     []*Network      `json:"networks,omitempty"`      // nil for host's network stack
-	Cgroups          *cgroups.Cgroup `json:"cgroups,omitempty"`           // cgroups
+	Cgroups      *cgroups.Cgroup `json:"cgroups,omitempty"`       // cgroups
-	Context          Context         `json:"context,omitempty"`           // generic context for specific options (apparmor, selinux)
+	Context      Context         `json:"context,omitempty"`       // generic context for specific options (apparmor, selinux)
-	Mounts           Mounts          `json:"mounts,omitempty"`
+	Mounts       Mounts          `json:"mounts,omitempty"`
 }
 
 // Network defines configuration for a container's networking stack

libcontainer/container.json

@@ -24,24 +24,9 @@
       "mtu": 1500
     }
   ],
-  "capabilities_mask": {
+  "capabilities": [
-    "SYSLOG": false,
+    "MKNOD"
-    "MKNOD": true,
+  ],
-    "NET_ADMIN": false,
-    "MAC_ADMIN": false,
-    "MAC_OVERRIDE": false,
-    "AUDIT_CONTROL": false,
-    "AUDIT_WRITE": false,
-    "SYS_TTY_CONFIG": false,
-    "SETPCAP": false,
-    "SYS_MODULE": false,
-    "SYS_RAWIO": false,
-    "SYS_PACCT": false,
-    "SYS_ADMIN": false,
-    "SYS_NICE": false,
-    "SYS_RESOURCE": false,
-    "SYS_TIME": false
-  },
   "cgroups": {
     "name": "docker-koye",
     "parent": "docker"

libcontainer/container_test.go

@@ -6,6 +6,16 @@ import (
 	"testing"
 )
 
+// Checks whether the expected capability is specified in the capabilities.
+func hasCapability(expected string, capabilities []string) bool {
+	for _, capability := range capabilities {
+		if capability == expected {
+			return true
+		}
+	}
+	return false
+}
+
 func TestContainerJsonFormat(t *testing.T) {
 	f, err := os.Open("container.json")
 	if err != nil {
@@ -37,22 +47,17 @@ func TestContainerJsonFormat(t *testing.T) {
 		t.Fail()
 	}
 
-	if _, exists := container.CapabilitiesMask["SYS_ADMIN"]; !exists {
+	if hasCapability("SYS_ADMIN", container.Capabilities) {
-		t.Log("capabilities mask should contain SYS_ADMIN")
-		t.Fail()
-	}
-
-	if container.CapabilitiesMask["SYS_ADMIN"] {
 		t.Log("SYS_ADMIN should not be enabled in capabilities mask")
 		t.Fail()
 	}
 
-	if !container.CapabilitiesMask["MKNOD"] {
+	if !hasCapability("MKNOD", container.Capabilities) {
 		t.Log("MKNOD should be enabled in capabilities mask")
 		t.Fail()
 	}
 
-	if container.CapabilitiesMask["SYS_CHROOT"] {
+	if hasCapability("SYS_CHROOT", container.Capabilities) {
 		t.Log("capabilities mask should not contain SYS_CHROOT")
 		t.Fail()
 	}

libcontainer/security/capabilities/capabilities.go

@@ -26,14 +26,12 @@ func DropCapabilities(container *libcontainer.Container) error {
 	return nil
 }
 
-// getCapabilitiesMask returns the capabilities that should not be dropped by the container.
+// getEnabledCapabilities returns the capabilities that should not be dropped by the container.
 func getEnabledCapabilities(container *libcontainer.Container) []capability.Cap {
 	keep := []capability.Cap{}
-	for key, enabled := range container.CapabilitiesMask {
+	for _, capability := range container.Capabilities {
-		if enabled {
+		if c := libcontainer.GetCapability(capability); c != nil {
-			if c := libcontainer.GetCapability(key); c != nil {
+			keep = append(keep, c.Value)
-				keep = append(keep, c.Value)
-			}
 		}
 	}
 	return keep

libcontainer/types.go

@@ -123,6 +123,14 @@ func GetCapability(key string) *Capability {
 	return nil
 }
 
+func GetAllCapabilities() []string {
+	output := make([]string, len(capabilityList))
+	for i, capability := range capabilityList {
+		output[i] = capability.String()
+	}
+	return output
+}
+
 // Contains returns true if the specified Capability is
 // in the slice
 func (c Capabilities) Contains(capp string) bool {