From bd9010d4c691222f6166edb4081efad0ab077740 Mon Sep 17 00:00:00 2001 From: Nicolas Lacasse Date: Fri, 17 Feb 2023 15:47:03 -0800 Subject: [PATCH] Add new capabilites to pkg/abi/linux, and handle them in runsc. Fixes #8529 PiperOrigin-RevId: 510539632 --- pkg/abi/linux/capability.go | 81 +++++++++++++++++++----------------- runsc/cmd/capability.go | 79 ++++++++++++++++++----------------- runsc/specutils/specutils.go | 79 ++++++++++++++++++----------------- 3 files changed, 124 insertions(+), 115 deletions(-) diff --git a/pkg/abi/linux/capability.go b/pkg/abi/linux/capability.go index afd16cc27..6683d2979 100644 --- a/pkg/abi/linux/capability.go +++ b/pkg/abi/linux/capability.go @@ -21,48 +21,51 @@ type Capability int // include/uapi/linux/capability.h. See capabilities(7) or that file for more // detailed capability descriptions. const ( - CAP_CHOWN = Capability(0) - CAP_DAC_OVERRIDE = Capability(1) - CAP_DAC_READ_SEARCH = Capability(2) - CAP_FOWNER = Capability(3) - CAP_FSETID = Capability(4) - CAP_KILL = Capability(5) - CAP_SETGID = Capability(6) - CAP_SETUID = Capability(7) - CAP_SETPCAP = Capability(8) - CAP_LINUX_IMMUTABLE = Capability(9) - CAP_NET_BIND_SERVICE = Capability(10) - CAP_NET_BROADCAST = Capability(11) - CAP_NET_ADMIN = Capability(12) - CAP_NET_RAW = Capability(13) - CAP_IPC_LOCK = Capability(14) - CAP_IPC_OWNER = Capability(15) - CAP_SYS_MODULE = Capability(16) - CAP_SYS_RAWIO = Capability(17) - CAP_SYS_CHROOT = Capability(18) - CAP_SYS_PTRACE = Capability(19) - CAP_SYS_PACCT = Capability(20) - CAP_SYS_ADMIN = Capability(21) - CAP_SYS_BOOT = Capability(22) - CAP_SYS_NICE = Capability(23) - CAP_SYS_RESOURCE = Capability(24) - CAP_SYS_TIME = Capability(25) - CAP_SYS_TTY_CONFIG = Capability(26) - CAP_MKNOD = Capability(27) - CAP_LEASE = Capability(28) - CAP_AUDIT_WRITE = Capability(29) - CAP_AUDIT_CONTROL = Capability(30) - CAP_SETFCAP = Capability(31) - CAP_MAC_OVERRIDE = Capability(32) - CAP_MAC_ADMIN = Capability(33) - CAP_SYSLOG = Capability(34) - CAP_WAKE_ALARM = Capability(35) - CAP_BLOCK_SUSPEND = Capability(36) - CAP_AUDIT_READ = Capability(37) + CAP_CHOWN = Capability(0) + CAP_DAC_OVERRIDE = Capability(1) + CAP_DAC_READ_SEARCH = Capability(2) + CAP_FOWNER = Capability(3) + CAP_FSETID = Capability(4) + CAP_KILL = Capability(5) + CAP_SETGID = Capability(6) + CAP_SETUID = Capability(7) + CAP_SETPCAP = Capability(8) + CAP_LINUX_IMMUTABLE = Capability(9) + CAP_NET_BIND_SERVICE = Capability(10) + CAP_NET_BROADCAST = Capability(11) + CAP_NET_ADMIN = Capability(12) + CAP_NET_RAW = Capability(13) + CAP_IPC_LOCK = Capability(14) + CAP_IPC_OWNER = Capability(15) + CAP_SYS_MODULE = Capability(16) + CAP_SYS_RAWIO = Capability(17) + CAP_SYS_CHROOT = Capability(18) + CAP_SYS_PTRACE = Capability(19) + CAP_SYS_PACCT = Capability(20) + CAP_SYS_ADMIN = Capability(21) + CAP_SYS_BOOT = Capability(22) + CAP_SYS_NICE = Capability(23) + CAP_SYS_RESOURCE = Capability(24) + CAP_SYS_TIME = Capability(25) + CAP_SYS_TTY_CONFIG = Capability(26) + CAP_MKNOD = Capability(27) + CAP_LEASE = Capability(28) + CAP_AUDIT_WRITE = Capability(29) + CAP_AUDIT_CONTROL = Capability(30) + CAP_SETFCAP = Capability(31) + CAP_MAC_OVERRIDE = Capability(32) + CAP_MAC_ADMIN = Capability(33) + CAP_SYSLOG = Capability(34) + CAP_WAKE_ALARM = Capability(35) + CAP_BLOCK_SUSPEND = Capability(36) + CAP_AUDIT_READ = Capability(37) + CAP_PERFMON = Capability(38) + CAP_BPF = Capability(39) + CAP_CHECKPOINT_RESTORE = Capability(40) // CAP_LAST_CAP is the highest-numbered capability. // Seach for "CAP_LAST_CAP" to find other places that need to change. - CAP_LAST_CAP = CAP_AUDIT_READ + CAP_LAST_CAP = CAP_CHECKPOINT_RESTORE ) // Ok returns true if cp is a supported capability. diff --git a/runsc/cmd/capability.go b/runsc/cmd/capability.go index abfbb7cfc..7a6639b7b 100644 --- a/runsc/cmd/capability.go +++ b/runsc/cmd/capability.go @@ -116,42 +116,45 @@ func capsFromNames(names []string) ([]capability.Cap, error) { } var capFromName = map[string]capability.Cap{ - "CAP_CHOWN": capability.CAP_CHOWN, - "CAP_DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE, - "CAP_DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH, - "CAP_FOWNER": capability.CAP_FOWNER, - "CAP_FSETID": capability.CAP_FSETID, - "CAP_KILL": capability.CAP_KILL, - "CAP_SETGID": capability.CAP_SETGID, - "CAP_SETUID": capability.CAP_SETUID, - "CAP_SETPCAP": capability.CAP_SETPCAP, - "CAP_LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE, - "CAP_NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE, - "CAP_NET_BROADCAST": capability.CAP_NET_BROADCAST, - "CAP_NET_ADMIN": capability.CAP_NET_ADMIN, - "CAP_NET_RAW": capability.CAP_NET_RAW, - "CAP_IPC_LOCK": capability.CAP_IPC_LOCK, - "CAP_IPC_OWNER": capability.CAP_IPC_OWNER, - "CAP_SYS_MODULE": capability.CAP_SYS_MODULE, - "CAP_SYS_RAWIO": capability.CAP_SYS_RAWIO, - "CAP_SYS_CHROOT": capability.CAP_SYS_CHROOT, - "CAP_SYS_PTRACE": capability.CAP_SYS_PTRACE, - "CAP_SYS_PACCT": capability.CAP_SYS_PACCT, - "CAP_SYS_ADMIN": capability.CAP_SYS_ADMIN, - "CAP_SYS_BOOT": capability.CAP_SYS_BOOT, - "CAP_SYS_NICE": capability.CAP_SYS_NICE, - "CAP_SYS_RESOURCE": capability.CAP_SYS_RESOURCE, - "CAP_SYS_TIME": capability.CAP_SYS_TIME, - "CAP_SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG, - "CAP_MKNOD": capability.CAP_MKNOD, - "CAP_LEASE": capability.CAP_LEASE, - "CAP_AUDIT_WRITE": capability.CAP_AUDIT_WRITE, - "CAP_AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL, - "CAP_SETFCAP": capability.CAP_SETFCAP, - "CAP_MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE, - "CAP_MAC_ADMIN": capability.CAP_MAC_ADMIN, - "CAP_SYSLOG": capability.CAP_SYSLOG, - "CAP_WAKE_ALARM": capability.CAP_WAKE_ALARM, - "CAP_BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND, - "CAP_AUDIT_READ": capability.CAP_AUDIT_READ, + "CAP_CHOWN": capability.CAP_CHOWN, + "CAP_DAC_OVERRIDE": capability.CAP_DAC_OVERRIDE, + "CAP_DAC_READ_SEARCH": capability.CAP_DAC_READ_SEARCH, + "CAP_FOWNER": capability.CAP_FOWNER, + "CAP_FSETID": capability.CAP_FSETID, + "CAP_KILL": capability.CAP_KILL, + "CAP_SETGID": capability.CAP_SETGID, + "CAP_SETUID": capability.CAP_SETUID, + "CAP_SETPCAP": capability.CAP_SETPCAP, + "CAP_LINUX_IMMUTABLE": capability.CAP_LINUX_IMMUTABLE, + "CAP_NET_BIND_SERVICE": capability.CAP_NET_BIND_SERVICE, + "CAP_NET_BROADCAST": capability.CAP_NET_BROADCAST, + "CAP_NET_ADMIN": capability.CAP_NET_ADMIN, + "CAP_NET_RAW": capability.CAP_NET_RAW, + "CAP_IPC_LOCK": capability.CAP_IPC_LOCK, + "CAP_IPC_OWNER": capability.CAP_IPC_OWNER, + "CAP_SYS_MODULE": capability.CAP_SYS_MODULE, + "CAP_SYS_RAWIO": capability.CAP_SYS_RAWIO, + "CAP_SYS_CHROOT": capability.CAP_SYS_CHROOT, + "CAP_SYS_PTRACE": capability.CAP_SYS_PTRACE, + "CAP_SYS_PACCT": capability.CAP_SYS_PACCT, + "CAP_SYS_ADMIN": capability.CAP_SYS_ADMIN, + "CAP_SYS_BOOT": capability.CAP_SYS_BOOT, + "CAP_SYS_NICE": capability.CAP_SYS_NICE, + "CAP_SYS_RESOURCE": capability.CAP_SYS_RESOURCE, + "CAP_SYS_TIME": capability.CAP_SYS_TIME, + "CAP_SYS_TTY_CONFIG": capability.CAP_SYS_TTY_CONFIG, + "CAP_MKNOD": capability.CAP_MKNOD, + "CAP_LEASE": capability.CAP_LEASE, + "CAP_AUDIT_WRITE": capability.CAP_AUDIT_WRITE, + "CAP_AUDIT_CONTROL": capability.CAP_AUDIT_CONTROL, + "CAP_SETFCAP": capability.CAP_SETFCAP, + "CAP_MAC_OVERRIDE": capability.CAP_MAC_OVERRIDE, + "CAP_MAC_ADMIN": capability.CAP_MAC_ADMIN, + "CAP_SYSLOG": capability.CAP_SYSLOG, + "CAP_WAKE_ALARM": capability.CAP_WAKE_ALARM, + "CAP_BLOCK_SUSPEND": capability.CAP_BLOCK_SUSPEND, + "CAP_AUDIT_READ": capability.CAP_AUDIT_READ, + "CAP_PERFMON": capability.CAP_PERFMON, + "CAP_BPF": capability.CAP_BPF, + "CAP_CHECKPOINT_RESTORE": capability.CAP_CHECKPOINT_RESTORE, } diff --git a/runsc/specutils/specutils.go b/runsc/specutils/specutils.go index c9bb6ecf3..c93c101f9 100644 --- a/runsc/specutils/specutils.go +++ b/runsc/specutils/specutils.go @@ -304,44 +304,47 @@ func AllCapabilitiesUint64() uint64 { } var capFromName = map[string]linux.Capability{ - "CAP_CHOWN": linux.CAP_CHOWN, - "CAP_DAC_OVERRIDE": linux.CAP_DAC_OVERRIDE, - "CAP_DAC_READ_SEARCH": linux.CAP_DAC_READ_SEARCH, - "CAP_FOWNER": linux.CAP_FOWNER, - "CAP_FSETID": linux.CAP_FSETID, - "CAP_KILL": linux.CAP_KILL, - "CAP_SETGID": linux.CAP_SETGID, - "CAP_SETUID": linux.CAP_SETUID, - "CAP_SETPCAP": linux.CAP_SETPCAP, - "CAP_LINUX_IMMUTABLE": linux.CAP_LINUX_IMMUTABLE, - "CAP_NET_BIND_SERVICE": linux.CAP_NET_BIND_SERVICE, - "CAP_NET_BROADCAST": linux.CAP_NET_BROADCAST, - "CAP_NET_ADMIN": linux.CAP_NET_ADMIN, - "CAP_NET_RAW": linux.CAP_NET_RAW, - "CAP_IPC_LOCK": linux.CAP_IPC_LOCK, - "CAP_IPC_OWNER": linux.CAP_IPC_OWNER, - "CAP_SYS_MODULE": linux.CAP_SYS_MODULE, - "CAP_SYS_RAWIO": linux.CAP_SYS_RAWIO, - "CAP_SYS_CHROOT": linux.CAP_SYS_CHROOT, - "CAP_SYS_PTRACE": linux.CAP_SYS_PTRACE, - "CAP_SYS_PACCT": linux.CAP_SYS_PACCT, - "CAP_SYS_ADMIN": linux.CAP_SYS_ADMIN, - "CAP_SYS_BOOT": linux.CAP_SYS_BOOT, - "CAP_SYS_NICE": linux.CAP_SYS_NICE, - "CAP_SYS_RESOURCE": linux.CAP_SYS_RESOURCE, - "CAP_SYS_TIME": linux.CAP_SYS_TIME, - "CAP_SYS_TTY_CONFIG": linux.CAP_SYS_TTY_CONFIG, - "CAP_MKNOD": linux.CAP_MKNOD, - "CAP_LEASE": linux.CAP_LEASE, - "CAP_AUDIT_WRITE": linux.CAP_AUDIT_WRITE, - "CAP_AUDIT_CONTROL": linux.CAP_AUDIT_CONTROL, - "CAP_SETFCAP": linux.CAP_SETFCAP, - "CAP_MAC_OVERRIDE": linux.CAP_MAC_OVERRIDE, - "CAP_MAC_ADMIN": linux.CAP_MAC_ADMIN, - "CAP_SYSLOG": linux.CAP_SYSLOG, - "CAP_WAKE_ALARM": linux.CAP_WAKE_ALARM, - "CAP_BLOCK_SUSPEND": linux.CAP_BLOCK_SUSPEND, - "CAP_AUDIT_READ": linux.CAP_AUDIT_READ, + "CAP_CHOWN": linux.CAP_CHOWN, + "CAP_DAC_OVERRIDE": linux.CAP_DAC_OVERRIDE, + "CAP_DAC_READ_SEARCH": linux.CAP_DAC_READ_SEARCH, + "CAP_FOWNER": linux.CAP_FOWNER, + "CAP_FSETID": linux.CAP_FSETID, + "CAP_KILL": linux.CAP_KILL, + "CAP_SETGID": linux.CAP_SETGID, + "CAP_SETUID": linux.CAP_SETUID, + "CAP_SETPCAP": linux.CAP_SETPCAP, + "CAP_LINUX_IMMUTABLE": linux.CAP_LINUX_IMMUTABLE, + "CAP_NET_BIND_SERVICE": linux.CAP_NET_BIND_SERVICE, + "CAP_NET_BROADCAST": linux.CAP_NET_BROADCAST, + "CAP_NET_ADMIN": linux.CAP_NET_ADMIN, + "CAP_NET_RAW": linux.CAP_NET_RAW, + "CAP_IPC_LOCK": linux.CAP_IPC_LOCK, + "CAP_IPC_OWNER": linux.CAP_IPC_OWNER, + "CAP_SYS_MODULE": linux.CAP_SYS_MODULE, + "CAP_SYS_RAWIO": linux.CAP_SYS_RAWIO, + "CAP_SYS_CHROOT": linux.CAP_SYS_CHROOT, + "CAP_SYS_PTRACE": linux.CAP_SYS_PTRACE, + "CAP_SYS_PACCT": linux.CAP_SYS_PACCT, + "CAP_SYS_ADMIN": linux.CAP_SYS_ADMIN, + "CAP_SYS_BOOT": linux.CAP_SYS_BOOT, + "CAP_SYS_NICE": linux.CAP_SYS_NICE, + "CAP_SYS_RESOURCE": linux.CAP_SYS_RESOURCE, + "CAP_SYS_TIME": linux.CAP_SYS_TIME, + "CAP_SYS_TTY_CONFIG": linux.CAP_SYS_TTY_CONFIG, + "CAP_MKNOD": linux.CAP_MKNOD, + "CAP_LEASE": linux.CAP_LEASE, + "CAP_AUDIT_WRITE": linux.CAP_AUDIT_WRITE, + "CAP_AUDIT_CONTROL": linux.CAP_AUDIT_CONTROL, + "CAP_SETFCAP": linux.CAP_SETFCAP, + "CAP_MAC_OVERRIDE": linux.CAP_MAC_OVERRIDE, + "CAP_MAC_ADMIN": linux.CAP_MAC_ADMIN, + "CAP_SYSLOG": linux.CAP_SYSLOG, + "CAP_WAKE_ALARM": linux.CAP_WAKE_ALARM, + "CAP_BLOCK_SUSPEND": linux.CAP_BLOCK_SUSPEND, + "CAP_AUDIT_READ": linux.CAP_AUDIT_READ, + "CAP_PERFMON": linux.CAP_PERFMON, + "CAP_BPF": linux.CAP_BPF, + "CAP_CHECKPOINT_RESTORE": linux.CAP_CHECKPOINT_RESTORE, } func capsFromNames(names []string, skipSet map[linux.Capability]struct{}) (auth.CapabilitySet, error) {