Skip to content

Commit 751e18b

Browse files
author
Haiyan Meng
committed
Check CAP_LAST_CAP while setting privileged
Signed-off-by: Haiyan Meng <[email protected]>
1 parent 3334d03 commit 751e18b

File tree

6 files changed

+51
-25
lines changed

6 files changed

+51
-25
lines changed

‎cmd/ocitools/generate.go‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ var generateCommand = cli.Command{
7878
}
7979
}
8080

81-
err := setupSpec(specgen, context)
81+
err := setupSpec(&specgen, context)
8282
if err != nil {
8383
return err
8484
}
@@ -96,8 +96,13 @@ var generateCommand = cli.Command{
9696
},
9797
}
9898

99-
func setupSpec(g generate.Generator, context *cli.Context) error {
100-
spec := g.GetSpec()
99+
func setupSpec(gp *generate.Generator, context *cli.Context) error {
100+
if context.GlobalBool("host-specific") {
101+
gp.HostSpecific = true
102+
}
103+
104+
g := *gp
105+
spec := g.Spec()
101106

102107
if len(spec.Version) == 0 {
103108
g.SetVersion(rspec.Version)

‎cmd/ocitools/main.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,10 @@ func main() {
1818
Value: "error",
1919
Usage: "Log level (panic, fatal, error, warn, info, or debug)",
2020
},
21+
cli.BoolFlag{
22+
Name: "host-specific",
23+
Usage: "generate host-specific configs or do host-specific validations",
24+
},
2125
}
2226

2327
app.Commands = []cli.Command{

‎cmd/ocitools/validate.go‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@ type configCheck func(rspec.Spec, string, bool) []string
2424

2525
var bundleValidateFlags = []cli.Flag{
2626
cli.StringFlag{Name: "path", Value: ".", Usage: "path to a bundle"},
27-
cli.BoolFlag{Name: "host-specific", Usage: "Check host specific configs."},
2827
}
2928

3029
var (
@@ -99,7 +98,7 @@ var bundleValidateCommand = cli.Command{
9998
return fmt.Errorf("The root path %q is not a directory.", rootfsPath)
10099
}
101100

102-
hostCheck := context.Bool("host-specific")
101+
hostCheck := context.GlobalBool("host-specific")
103102

104103
checks := []configCheck{
105104
checkMandatoryFields,

‎generate/generate.go‎

Lines changed: 22 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ var (
2121

2222
// Generator represents a generator for a container spec.
2323
type Generator struct {
24-
spec *rspec.Spec
24+
spec *rspec.Spec
25+
HostSpecific bool
2526
}
2627

2728
// New creates a spec Generator with the default spec.
@@ -139,12 +140,16 @@ func New() Generator {
139140
Devices: []rspec.Device{},
140141
},
141142
}
142-
return Generator{&spec}
143+
return Generator{
144+
spec: &spec,
145+
}
143146
}
144147

145148
// NewFromSpec creates a spec Generator from a given spec.
146149
func NewFromSpec(spec *rspec.Spec) Generator {
147-
return Generator{spec}
150+
return Generator{
151+
spec: spec,
152+
}
148153
}
149154

150155
// NewFromFile loads the template specifed in a file into a spec Generator.
@@ -166,16 +171,18 @@ func NewFromTemplate(r io.Reader) (Generator, error) {
166171
if err := json.NewDecoder(r).Decode(&spec); err != nil {
167172
return Generator{}, err
168173
}
169-
return Generator{&spec}, nil
174+
return Generator{
175+
spec: &spec,
176+
}, nil
170177
}
171178

172179
// SetSpec sets the spec in the Generator g.
173180
func (g *Generator) SetSpec(spec *rspec.Spec) {
174181
g.spec = spec
175182
}
176183

177-
// GetSpec gets the spec in the Generator g.
178-
func (g *Generator) GetSpec() *rspec.Spec {
184+
// Spec gets the spec in the Generator g.
185+
func (g *Generator) Spec() *rspec.Spec {
179186
return g.spec
180187
}
181188

@@ -953,6 +960,9 @@ func (g *Generator) SetupPrivileged(privileged bool) {
953960
// Add all capabilities in privileged mode.
954961
var finalCapList []string
955962
for _, cap := range capability.List() {
963+
if g.HostSpecific && cap > capability.CAP_LAST_CAP {
964+
continue
965+
}
956966
finalCapList = append(finalCapList, fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())))
957967
}
958968
g.initSpecLinux()
@@ -963,12 +973,15 @@ func (g *Generator) SetupPrivileged(privileged bool) {
963973
}
964974
}
965975

966-
func checkCap(c string) error {
976+
func checkCap(c string, hostSpecific bool) error {
967977
isValid := false
968978
cp := strings.ToUpper(c)
969979

970980
for _, cap := range capability.List() {
971981
if cp == strings.ToUpper(cap.String()) {
982+
if hostSpecific && cap > capability.CAP_LAST_CAP {
983+
return fmt.Errorf("CAP_%s is not supported on the current host", cp)
984+
}
972985
isValid = true
973986
break
974987
}
@@ -990,7 +1003,7 @@ func (g *Generator) ClearProcessCapabilities() {
9901003

9911004
// AddProcessCapability adds a process capability into g.spec.Process.Capabilities.
9921005
func (g *Generator) AddProcessCapability(c string) error {
993-
if err := checkCap(c); err != nil {
1006+
if err := checkCap(c, g.HostSpecific); err != nil {
9941007
return err
9951008
}
9961009

@@ -1009,7 +1022,7 @@ func (g *Generator) AddProcessCapability(c string) error {
10091022

10101023
// DropProcessCapability drops a process capability from g.spec.Process.Capabilities.
10111024
func (g *Generator) DropProcessCapability(c string) error {
1012-
if err := checkCap(c); err != nil {
1025+
if err := checkCap(c, g.HostSpecific); err != nil {
10131026
return err
10141027
}
10151028

‎man/ocitools-validate.1.md‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -18,16 +18,6 @@ Validate an OCI bundle
1818
**--path=PATH
1919
Path to bundle
2020

21-
**--host-specific**
22-
Check host specific configs.
23-
By default, validation only tests for compatibility with a hypothetical host.
24-
With this flag, validation will also run more specific tests to see whether
25-
the current host is capable of launching a container from the configuration.
26-
For example, validating a compliant Windows configuration on a Linux machine
27-
will pass without this flag ("there may be a Windows host capable of
28-
launching this container"), but will fail with it ("this host is not capable
29-
of launching this container").
30-
3121
# SEE ALSO
3222
**ocitools**(1)
3323

‎man/ocitools.1.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,11 +15,26 @@ ocitools is a collection of tools for working with the [OCI runtime specificatio
1515

1616
# OPTIONS
1717
**--help**
18-
Print usage statement
18+
Print usage statement.
1919

2020
**-v**, **--version**
2121
Print version information.
2222

23+
**--log-level**
24+
Log level (panic, fatal, error, warn, info, or debug) (default: "error").
25+
26+
**--host-specific**
27+
Generate host-specific configs or do host-specific validations.
28+
29+
By default, generator generates configs without checking whether they are
30+
supported on the current host. With this flag, generator will first check
31+
whether each config is supported on the current host, and only add it into
32+
the config file if it passes the checking.
33+
34+
By default, validation only tests for compatibility with a hypothetical host.
35+
With this flag, validation will also run more specific tests to see whether
36+
the current host is capable of launching a container from the configuration.
37+
2338
# COMMANDS
2439
**validate**
2540
Validating OCI bundle

0 commit comments

Comments
 (0)