Skip to content

Commit f4d221c

Browse files
author
Mrunal Patel
authored
Merge pull request opencontainers#880 from dqminh/wking-linux-only-capabilities-again
rebase: config: Make capabilities, noNewPrivileges, and rlimits Linux-only (again)
2 parents 96a580d + f7335bd commit f4d221c

File tree

2 files changed

+38
-22
lines changed

2 files changed

+38
-22
lines changed

‎config.md

+35-19
Original file line numberDiff line numberDiff line change
@@ -156,33 +156,48 @@ For POSIX platforms the `mounts` structure has the following fields:
156156
* **`env`** (array of strings, OPTIONAL) with the same semantics as [IEEE Std 1003.1-2008's `environ`][ieee-1003.1-2008-xbd-c8.1].
157157
* **`args`** (array of strings, REQUIRED) with similar semantics to [IEEE Std 1003.1-2008 `execvp`'s *argv*][ieee-1003.1-2008-xsh-exec].
158158
This specification extends the IEEE standard in that at least one entry is REQUIRED, and that entry is used with the same semantics as `execvp`'s *file*.
159-
* **`capabilities`** (object, OPTIONAL) is an object containing arrays that specifies the sets of capabilities for the process.
160-
Valid values are platform-specific.
161-
For example, valid values for Linux are defined in the [capabilities(7)][capabilities.7] man page, such as `CAP_CHOWN`.
162-
Any value which cannot be mapped to a relevant kernel interface MUST cause an error.
163-
`capabilities` contains the following properties:
164-
* **`effective`** (array of strings, OPTIONAL) - the `effective` field is an array of effective capabilities that are kept for the process.
165-
* **`bounding`** (array of strings, OPTIONAL) - the `bounding` field is an array of bounding capabilities that are kept for the process.
166-
* **`inheritable`** (array of strings, OPTIONAL) - the `inheritable` field is an array of inheritable capabilities that are kept for the process.
167-
* **`permitted`** (array of strings, OPTIONAL) - the `permitted` field is an array of permitted capabilities that are kept for the process.
168-
* **`ambient`** (array of strings, OPTIONAL) - the `ambient` field is an array of ambient capabilities that are kept for the process.
159+
160+
### <a name="configPOSIXProcess" />POSIX process
161+
162+
For systems that support POSIX rlimits (for example Linux and Solaris), the `process` object supports the following process-specific properties:
163+
169164
* **`rlimits`** (array of objects, OPTIONAL) allows setting resource limits for the process.
170165
Each entry has the following structure:
171166

172-
* **`type`** (string, REQUIRED) - the platform resource being limited, for example on Linux as defined in the [setrlimit(2)][setrlimit.2] man page.
173-
* **`soft`** (uint64, REQUIRED) - the value of the limit enforced for the corresponding resource.
174-
* **`hard`** (uint64, REQUIRED) - the ceiling for the soft limit that could be set by an unprivileged process.
175-
Only a privileged process (e.g. under Linux: one with the CAP_SYS_RESOURCE capability) can raise a hard limit.
167+
* **`type`** (string, REQUIRED) the platform resource being limited.
168+
* Linux: valid values are defined in the [`getrlimit(2)`][getrlimit.2] man page, such as `RLIMIT_MSGQUEUE`.
169+
* Solaris: valid values are defined in the [`getrlimit(3)`][getrlimit.3] man page, such as `RLIMIT_CORE`.
176170

177-
If `rlimits` contains duplicated entries with same `type`, the runtime MUST error out.
171+
The runtime MUST [generate an error](runtime.md#errors) for any values which cannot be mapped to a relevant kernel interface
172+
For each entry in `rlimits`, a [`getrlimit(3)`][getrlimit.3] on `type` MUST succeed.
173+
For the following properties, `rlim` refers to the status returned by the `getrlimit(3)` call.
178174

179-
* **`noNewPrivileges`** (bool, OPTIONAL) setting `noNewPrivileges` to true prevents the process from gaining additional privileges.
180-
As an example, the ['no_new_privs'][no-new-privs] article in the kernel documentation has information on how this is achieved using a prctl system call on Linux.
175+
* **`soft`** (uint64, REQUIRED) the value of the limit enforced for the corresponding resource.
176+
`rlim.rlim_cur` MUST match the configured value.
177+
* **`hard`** (uint64, REQUIRED) the ceiling for the soft limit that could be set by an unprivileged process.
178+
`rlim.rlim_max` MUST match the configured value.
179+
Only a privileged process (e.g. one with the `CAP_SYS_RESOURCE` capability) can raise a hard limit.
181180

182-
For Linux-based systems the process structure supports the following process-specific fields.
181+
If `rlimits` contains duplicated entries with same `type`, the runtime MUST [generate an error](runtime.md#errors).
182+
183+
### <a name="configLinuxProcess" />Linux Process
184+
185+
For Linux-based systems, the `process` object supports the following process-specific properties.
183186

184187
* **`apparmorProfile`** (string, OPTIONAL) specifies the name of the AppArmor profile for the process.
185188
For more information about AppArmor, see [AppArmor documentation][apparmor].
189+
* **`capabilities`** (object, OPTIONAL) is an object containing arrays that specifies the sets of capabilities for the process.
190+
Valid values are defined in the [capabilities(7)][capabilities.7] man page, such as `CAP_CHOWN`.
191+
Any value which cannot be mapped to a relevant kernel interface MUST cause an error.
192+
`capabilities` contains the following properties:
193+
194+
* **`effective`** (array of strings, OPTIONAL) the `effective` field is an array of effective capabilities that are kept for the process.
195+
* **`bounding`** (array of strings, OPTIONAL) the `bounding` field is an array of bounding capabilities that are kept for the process.
196+
* **`inheritable`** (array of strings, OPTIONAL) the `inheritable` field is an array of inheritable capabilities that are kept for the process.
197+
* **`permitted`** (array of strings, OPTIONAL) the `permitted` field is an array of permitted capabilities that are kept for the process.
198+
* **`ambient`** (array of strings, OPTIONAL) the `ambient` field is an array of ambient capabilities that are kept for the process.
199+
* **`noNewPrivileges`** (bool, OPTIONAL) setting `noNewPrivileges` to true prevents the process from gaining additional privileges.
200+
As an example, the [`no_new_privs`][no-new-privs] article in the kernel documentation has information on how this is achieved using a `prctl` system call on Linux.
186201
* **`oomScoreAdj`** *(int, OPTIONAL)* adjusts the oom-killer score in `[pid]/oom_score_adj` for the process's `[pid]` in a [proc pseudo-filesystem][procfs].
187202
If `oomScoreAdj` is set, the runtime MUST set `oom_score_adj` to the given value.
188203
If `oomScoreAdj` is not set, the runtime MUST NOT change the value of `oom_score_adj`.
@@ -838,7 +853,8 @@ Here is a full example `config.json` for reference.
838853
[mount.8]: http://man7.org/linux/man-pages/man8/mount.8.html
839854
[mount.8-filesystem-independent]: http://man7.org/linux/man-pages/man8/mount.8.html#FILESYSTEM-INDEPENDENT_MOUNT%20OPTIONS
840855
[mount.8-filesystem-specific]: http://man7.org/linux/man-pages/man8/mount.8.html#FILESYSTEM-SPECIFIC_MOUNT%20OPTIONS
841-
[setrlimit.2]: http://man7.org/linux/man-pages/man2/setrlimit.2.html
856+
[getrlimit.2]: http://man7.org/linux/man-pages/man2/getrlimit.2.html
857+
[getrlimit.3]: http://pubs.opengroup.org/onlinepubs/9699919799/functions/getrlimit.html
842858
[stdin.3]: http://man7.org/linux/man-pages/man3/stdin.3.html
843859
[uts-namespace.7]: http://man7.org/linux/man-pages/man7/namespaces.7.html
844860
[zonecfg.1m]: http://docs.oracle.com/cd/E86824_01/html/E54764/zonecfg-1m.html

‎specs-go/config.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ type Process struct {
4545
// Capabilities are Linux capabilities that are kept for the process.
4646
Capabilities *LinuxCapabilities `json:"capabilities,omitempty" platform:"linux"`
4747
// Rlimits specifies rlimit options to apply to the process.
48-
Rlimits []LinuxRlimit `json:"rlimits,omitempty" platform:"linux"`
48+
Rlimits []POSIXRlimit `json:"rlimits,omitempty" platform:"linux,solaris"`
4949
// NoNewPrivileges controls whether additional privileges could be gained by processes in the container.
5050
NoNewPrivileges bool `json:"noNewPrivileges,omitempty" platform:"linux"`
5151
// ApparmorProfile specifies the apparmor profile for the container.
@@ -202,8 +202,8 @@ type LinuxIDMapping struct {
202202
Size uint32 `json:"size"`
203203
}
204204

205-
// LinuxRlimit type and restrictions
206-
type LinuxRlimit struct {
205+
// POSIXRlimit type and restrictions
206+
type POSIXRlimit struct {
207207
// Type of the rlimit to set
208208
Type string `json:"type"`
209209
// Hard is the hard limit for the specified type

0 commit comments

Comments
 (0)