netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Add new capabilites to pkg/abi/linux, and handle them in runsc.

Browse Source 
Fixes #8529

PiperOrigin-RevId: 510539632
This commit is contained in:
Nicolas Lacasse
2023-02-17 15:49:42 -08:00
committed by gVisor bot
parent c829d82a8f
commit bd9010d4c6
3 changed files with 124 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/abi/linux/capability.go
+42 -39
View File
@@ -21,48 +21,51 @@ type Capability int
// include/uapi/linux/capability.h. See capabilities(7) or that file for more
// detailed capability descriptions.
const (
CAP_CHOWN = Capability(0)
CAP_DAC_OVERRIDE = Capability(1)
CAP_DAC_READ_SEARCH = Capability(2)
CAP_FOWNER = Capability(3)
CAP_FSETID = Capability(4)
CAP_KILL = Capability(5)
CAP_SETGID = Capability(6)
CAP_SETUID = Capability(7)
CAP_SETPCAP = Capability(8)
CAP_LINUX_IMMUTABLE = Capability(9)
CAP_NET_BIND_SERVICE = Capability(10)
CAP_NET_BROADCAST = Capability(11)
CAP_NET_ADMIN = Capability(12)
CAP_NET_RAW = Capability(13)
CAP_IPC_LOCK = Capability(14)
CAP_IPC_OWNER = Capability(15)
CAP_SYS_MODULE = Capability(16)
CAP_SYS_RAWIO = Capability(17)
CAP_SYS_CHROOT = Capability(18)
CAP_SYS_PTRACE = Capability(19)
CAP_SYS_PACCT = Capability(20)
CAP_SYS_ADMIN = Capability(21)
CAP_SYS_BOOT = Capability(22)
CAP_SYS_NICE = Capability(23)
CAP_SYS_RESOURCE = Capability(24)
CAP_SYS_TIME = Capability(25)
CAP_SYS_TTY_CONFIG = Capability(26)
CAP_MKNOD = Capability(27)
CAP_LEASE = Capability(28)
CAP_AUDIT_WRITE = Capability(29)
CAP_AUDIT_CONTROL = Capability(30)
CAP_SETFCAP = Capability(31)
CAP_MAC_OVERRIDE = Capability(32)
CAP_MAC_ADMIN = Capability(33)
CAP_SYSLOG = Capability(34)
CAP_WAKE_ALARM = Capability(35)
CAP_BLOCK_SUSPEND = Capability(36)
CAP_AUDIT_READ = Capability(37)
CAP_CHOWN = Capability(0)
CAP_DAC_OVERRIDE = Capability(1)
CAP_DAC_READ_SEARCH = Capability(2)
CAP_FOWNER = Capability(3)
CAP_FSETID = Capability(4)
CAP_KILL = Capability(5)
CAP_SETGID = Capability(6)
CAP_SETUID = Capability(7)
CAP_SETPCAP = Capability(8)
CAP_LINUX_IMMUTABLE = Capability(9)
CAP_NET_BIND_SERVICE = Capability(10)
CAP_NET_BROADCAST = Capability(11)
CAP_NET_ADMIN = Capability(12)
CAP_NET_RAW = Capability(13)
CAP_IPC_LOCK = Capability(14)
CAP_IPC_OWNER = Capability(15)
CAP_SYS_MODULE = Capability(16)
CAP_SYS_RAWIO = Capability(17)
CAP_SYS_CHROOT = Capability(18)
CAP_SYS_PTRACE = Capability(19)
CAP_SYS_PACCT = Capability(20)
CAP_SYS_ADMIN = Capability(21)
CAP_SYS_BOOT = Capability(22)
CAP_SYS_NICE = Capability(23)
CAP_SYS_RESOURCE = Capability(24)
CAP_SYS_TIME = Capability(25)
CAP_SYS_TTY_CONFIG = Capability(26)
CAP_MKNOD = Capability(27)
CAP_LEASE = Capability(28)
CAP_AUDIT_WRITE = Capability(29)
CAP_AUDIT_CONTROL = Capability(30)
CAP_SETFCAP = Capability(31)
CAP_MAC_OVERRIDE = Capability(32)
CAP_MAC_ADMIN = Capability(33)
CAP_SYSLOG = Capability(34)
CAP_WAKE_ALARM = Capability(35)
CAP_BLOCK_SUSPEND = Capability(36)
CAP_AUDIT_READ = Capability(37)
CAP_PERFMON = Capability(38)
CAP_BPF = Capability(39)
CAP_CHECKPOINT_RESTORE = Capability(40)
// CAP_LAST_CAP is the highest-numbered capability.
// Seach for "CAP_LAST_CAP" to find other places that need to change.
CAP_LAST_CAP = CAP_AUDIT_READ
CAP_LAST_CAP = CAP_CHECKPOINT_RESTORE
)
// Ok returns true if cp is a supported capability.
runsc/cmd/capability.go
+41 -38
View File
@@ -116,42 +116,45 @@ func capsFromNames(names []string) ([]capability.Cap, error) {
}
var capFromName = map[string]capability.Cap{
"CAP_CHOWN": capability.CAP_CHOWN,
"CAP_DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE,
"CAP_DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH,
"CAP_FOWNER": capability.CAP_FOWNER,
"CAP_FSETID": capability.CAP_FSETID,
"CAP_KILL": capability.CAP_KILL,
"CAP_SETGID": capability.CAP_SETGID,
"CAP_SETUID": capability.CAP_SETUID,
"CAP_SETPCAP": capability.CAP_SETPCAP,
"CAP_LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE,
"CAP_NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE,
"CAP_NET_BROADCAST": capability.CAP_NET_BROADCAST,
"CAP_NET_ADMIN": capability.CAP_NET_ADMIN,
"CAP_NET_RAW": capability.CAP_NET_RAW,
"CAP_IPC_LOCK": capability.CAP_IPC_LOCK,
"CAP_IPC_OWNER": capability.CAP_IPC_OWNER,
"CAP_SYS_MODULE": capability.CAP_SYS_MODULE,
"CAP_SYS_RAWIO": capability.CAP_SYS_RAWIO,
"CAP_SYS_CHROOT": capability.CAP_SYS_CHROOT,
"CAP_SYS_PTRACE": capability.CAP_SYS_PTRACE,
"CAP_SYS_PACCT": capability.CAP_SYS_PACCT,
"CAP_SYS_ADMIN": capability.CAP_SYS_ADMIN,
"CAP_SYS_BOOT": capability.CAP_SYS_BOOT,
"CAP_SYS_NICE": capability.CAP_SYS_NICE,
"CAP_SYS_RESOURCE": capability.CAP_SYS_RESOURCE,
"CAP_SYS_TIME": capability.CAP_SYS_TIME,
"CAP_SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG,
"CAP_MKNOD": capability.CAP_MKNOD,
"CAP_LEASE": capability.CAP_LEASE,
"CAP_AUDIT_WRITE": capability.CAP_AUDIT_WRITE,
"CAP_AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL,
"CAP_SETFCAP": capability.CAP_SETFCAP,
"CAP_MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE,
"CAP_MAC_ADMIN": capability.CAP_MAC_ADMIN,
"CAP_SYSLOG": capability.CAP_SYSLOG,
"CAP_WAKE_ALARM": capability.CAP_WAKE_ALARM,
"CAP_BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND,
"CAP_AUDIT_READ": capability.CAP_AUDIT_READ,
"CAP_CHOWN": capability.CAP_CHOWN,
"CAP_DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE,
"CAP_DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH,
"CAP_FOWNER": capability.CAP_FOWNER,
"CAP_FSETID": capability.CAP_FSETID,
"CAP_KILL": capability.CAP_KILL,
"CAP_SETGID": capability.CAP_SETGID,
"CAP_SETUID": capability.CAP_SETUID,
"CAP_SETPCAP": capability.CAP_SETPCAP,
"CAP_LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE,
"CAP_NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE,
"CAP_NET_BROADCAST": capability.CAP_NET_BROADCAST,
"CAP_NET_ADMIN": capability.CAP_NET_ADMIN,
"CAP_NET_RAW": capability.CAP_NET_RAW,
"CAP_IPC_LOCK": capability.CAP_IPC_LOCK,
"CAP_IPC_OWNER": capability.CAP_IPC_OWNER,
"CAP_SYS_MODULE": capability.CAP_SYS_MODULE,
"CAP_SYS_RAWIO": capability.CAP_SYS_RAWIO,
"CAP_SYS_CHROOT": capability.CAP_SYS_CHROOT,
"CAP_SYS_PTRACE": capability.CAP_SYS_PTRACE,
"CAP_SYS_PACCT": capability.CAP_SYS_PACCT,
"CAP_SYS_ADMIN": capability.CAP_SYS_ADMIN,
"CAP_SYS_BOOT": capability.CAP_SYS_BOOT,
"CAP_SYS_NICE": capability.CAP_SYS_NICE,
"CAP_SYS_RESOURCE": capability.CAP_SYS_RESOURCE,
"CAP_SYS_TIME": capability.CAP_SYS_TIME,
"CAP_SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG,
"CAP_MKNOD": capability.CAP_MKNOD,
"CAP_LEASE": capability.CAP_LEASE,
"CAP_AUDIT_WRITE": capability.CAP_AUDIT_WRITE,
"CAP_AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL,
"CAP_SETFCAP": capability.CAP_SETFCAP,
"CAP_MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE,
"CAP_MAC_ADMIN": capability.CAP_MAC_ADMIN,
"CAP_SYSLOG": capability.CAP_SYSLOG,
"CAP_WAKE_ALARM": capability.CAP_WAKE_ALARM,
"CAP_BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND,
"CAP_AUDIT_READ": capability.CAP_AUDIT_READ,
"CAP_PERFMON": capability.CAP_PERFMON,
"CAP_BPF": capability.CAP_BPF,
"CAP_CHECKPOINT_RESTORE": capability.CAP_CHECKPOINT_RESTORE,
}
runsc/specutils/specutils.go
+41 -38
View File
@@ -304,44 +304,47 @@ func AllCapabilitiesUint64() uint64 {
}
var capFromName = map[string]linux.Capability{
"CAP_CHOWN": linux.CAP_CHOWN,
"CAP_DAC_OVERRIDE": linux.CAP_DAC_OVERRIDE,
"CAP_DAC_READ_SEARCH": linux.CAP_DAC_READ_SEARCH,
"CAP_FOWNER": linux.CAP_FOWNER,
"CAP_FSETID": linux.CAP_FSETID,
"CAP_KILL": linux.CAP_KILL,
"CAP_SETGID": linux.CAP_SETGID,
"CAP_SETUID": linux.CAP_SETUID,
"CAP_SETPCAP": linux.CAP_SETPCAP,
"CAP_LINUX_IMMUTABLE": linux.CAP_LINUX_IMMUTABLE,
"CAP_NET_BIND_SERVICE": linux.CAP_NET_BIND_SERVICE,
"CAP_NET_BROADCAST": linux.CAP_NET_BROADCAST,
"CAP_NET_ADMIN": linux.CAP_NET_ADMIN,
"CAP_NET_RAW": linux.CAP_NET_RAW,
"CAP_IPC_LOCK": linux.CAP_IPC_LOCK,
"CAP_IPC_OWNER": linux.CAP_IPC_OWNER,
"CAP_SYS_MODULE": linux.CAP_SYS_MODULE,
"CAP_SYS_RAWIO": linux.CAP_SYS_RAWIO,
"CAP_SYS_CHROOT": linux.CAP_SYS_CHROOT,
"CAP_SYS_PTRACE": linux.CAP_SYS_PTRACE,
"CAP_SYS_PACCT": linux.CAP_SYS_PACCT,
"CAP_SYS_ADMIN": linux.CAP_SYS_ADMIN,
"CAP_SYS_BOOT": linux.CAP_SYS_BOOT,
"CAP_SYS_NICE": linux.CAP_SYS_NICE,
"CAP_SYS_RESOURCE": linux.CAP_SYS_RESOURCE,
"CAP_SYS_TIME": linux.CAP_SYS_TIME,
"CAP_SYS_TTY_CONFIG": linux.CAP_SYS_TTY_CONFIG,
"CAP_MKNOD": linux.CAP_MKNOD,
"CAP_LEASE": linux.CAP_LEASE,
"CAP_AUDIT_WRITE": linux.CAP_AUDIT_WRITE,
"CAP_AUDIT_CONTROL": linux.CAP_AUDIT_CONTROL,
"CAP_SETFCAP": linux.CAP_SETFCAP,
"CAP_MAC_OVERRIDE": linux.CAP_MAC_OVERRIDE,
"CAP_MAC_ADMIN": linux.CAP_MAC_ADMIN,
"CAP_SYSLOG": linux.CAP_SYSLOG,
"CAP_WAKE_ALARM": linux.CAP_WAKE_ALARM,
"CAP_BLOCK_SUSPEND": linux.CAP_BLOCK_SUSPEND,
"CAP_AUDIT_READ": linux.CAP_AUDIT_READ,
"CAP_CHOWN": linux.CAP_CHOWN,
"CAP_DAC_OVERRIDE": linux.CAP_DAC_OVERRIDE,
"CAP_DAC_READ_SEARCH": linux.CAP_DAC_READ_SEARCH,
"CAP_FOWNER": linux.CAP_FOWNER,
"CAP_FSETID": linux.CAP_FSETID,
"CAP_KILL": linux.CAP_KILL,
"CAP_SETGID": linux.CAP_SETGID,
"CAP_SETUID": linux.CAP_SETUID,
"CAP_SETPCAP": linux.CAP_SETPCAP,
"CAP_LINUX_IMMUTABLE": linux.CAP_LINUX_IMMUTABLE,
"CAP_NET_BIND_SERVICE": linux.CAP_NET_BIND_SERVICE,
"CAP_NET_BROADCAST": linux.CAP_NET_BROADCAST,
"CAP_NET_ADMIN": linux.CAP_NET_ADMIN,
"CAP_NET_RAW": linux.CAP_NET_RAW,
"CAP_IPC_LOCK": linux.CAP_IPC_LOCK,
"CAP_IPC_OWNER": linux.CAP_IPC_OWNER,
"CAP_SYS_MODULE": linux.CAP_SYS_MODULE,
"CAP_SYS_RAWIO": linux.CAP_SYS_RAWIO,
"CAP_SYS_CHROOT": linux.CAP_SYS_CHROOT,
"CAP_SYS_PTRACE": linux.CAP_SYS_PTRACE,
"CAP_SYS_PACCT": linux.CAP_SYS_PACCT,
"CAP_SYS_ADMIN": linux.CAP_SYS_ADMIN,
"CAP_SYS_BOOT": linux.CAP_SYS_BOOT,
"CAP_SYS_NICE": linux.CAP_SYS_NICE,
"CAP_SYS_RESOURCE": linux.CAP_SYS_RESOURCE,
"CAP_SYS_TIME": linux.CAP_SYS_TIME,
"CAP_SYS_TTY_CONFIG": linux.CAP_SYS_TTY_CONFIG,
"CAP_MKNOD": linux.CAP_MKNOD,
"CAP_LEASE": linux.CAP_LEASE,
"CAP_AUDIT_WRITE": linux.CAP_AUDIT_WRITE,
"CAP_AUDIT_CONTROL": linux.CAP_AUDIT_CONTROL,
"CAP_SETFCAP": linux.CAP_SETFCAP,
"CAP_MAC_OVERRIDE": linux.CAP_MAC_OVERRIDE,
"CAP_MAC_ADMIN": linux.CAP_MAC_ADMIN,
"CAP_SYSLOG": linux.CAP_SYSLOG,
"CAP_WAKE_ALARM": linux.CAP_WAKE_ALARM,
"CAP_BLOCK_SUSPEND": linux.CAP_BLOCK_SUSPEND,
"CAP_AUDIT_READ": linux.CAP_AUDIT_READ,
"CAP_PERFMON": linux.CAP_PERFMON,
"CAP_BPF": linux.CAP_BPF,
"CAP_CHECKPOINT_RESTORE": linux.CAP_CHECKPOINT_RESTORE,
}
func capsFromNames(names []string, skipSet map[linux.Capability]struct{}) (auth.CapabilitySet, error) {