specconv

package
v1.1.15 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Oct 4, 2024 License: Apache-2.0 Imports: 19 Imported by: 140

Documentation

Overview

Package specconv implements conversion of specifications to libcontainer configurations

Index

Constants

This section is empty.

Variables

View Source
var AllowedDevices = []*devices.Device{

	{
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       devices.Wildcard,
			Minor:       devices.Wildcard,
			Permissions: "m",
			Allow:       true,
		},
	},
	{
		Rule: devices.Rule{
			Type:        devices.BlockDevice,
			Major:       devices.Wildcard,
			Minor:       devices.Wildcard,
			Permissions: "m",
			Allow:       true,
		},
	},
	{
		Path:     "/dev/null",
		FileMode: 0o666,
		Uid:      0,
		Gid:      0,
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       1,
			Minor:       3,
			Permissions: "rwm",
			Allow:       true,
		},
	},
	{
		Path:     "/dev/random",
		FileMode: 0o666,
		Uid:      0,
		Gid:      0,
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       1,
			Minor:       8,
			Permissions: "rwm",
			Allow:       true,
		},
	},
	{
		Path:     "/dev/full",
		FileMode: 0o666,
		Uid:      0,
		Gid:      0,
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       1,
			Minor:       7,
			Permissions: "rwm",
			Allow:       true,
		},
	},
	{
		Path:     "/dev/tty",
		FileMode: 0o666,
		Uid:      0,
		Gid:      0,
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       5,
			Minor:       0,
			Permissions: "rwm",
			Allow:       true,
		},
	},
	{
		Path:     "/dev/zero",
		FileMode: 0o666,
		Uid:      0,
		Gid:      0,
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       1,
			Minor:       5,
			Permissions: "rwm",
			Allow:       true,
		},
	},
	{
		Path:     "/dev/urandom",
		FileMode: 0o666,
		Uid:      0,
		Gid:      0,
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       1,
			Minor:       9,
			Permissions: "rwm",
			Allow:       true,
		},
	},

	{
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       136,
			Minor:       devices.Wildcard,
			Permissions: "rwm",
			Allow:       true,
		},
	},
	{
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       5,
			Minor:       2,
			Permissions: "rwm",
			Allow:       true,
		},
	},

	{
		Rule: devices.Rule{
			Type:        devices.CharDevice,
			Major:       10,
			Minor:       200,
			Permissions: "rwm",
			Allow:       true,
		},
	},
}

AllowedDevices is the set of devices which are automatically included for all containers.

XXX (cyphar)

This behaviour is at the very least "questionable" (if not outright wrong) according to the runtime-spec.

Yes, we have to include certain devices other than the ones the user specifies, but several devices listed here are not part of the spec (including "mknod for any device"?!). In addition, these rules are appended to the user-provided set which means that users *cannot disable this behaviour*.

... unfortunately I'm too scared to change this now because who knows how many people depend on this (incorrect and arguably insecure) behaviour.

Functions

func CreateCgroupConfig added in v1.0.0

func CreateCgroupConfig(opts *CreateOpts, defaultDevs []*devices.Device) (*configs.Cgroup, error)

func CreateLibcontainerConfig

func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error)

CreateLibcontainerConfig creates a new libcontainer configuration from a given specification and a cgroup name

func Example added in v1.0.0

func Example() *specs.Spec

Example returns an example spec file, with many options set so a user can see what a standard spec file looks like.

func KnownMountOptions added in v1.1.0

func KnownMountOptions() []string

KnownMountOptions returns the list of the known mount options. Used by `runc features`.

func KnownNamespaces added in v1.1.0

func KnownNamespaces() []string

KnownNamespaces returns the list of the known namespaces. Used by `runc features`.

func SetupSeccomp added in v1.0.0

func SetupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error)

func ToRootless added in v1.0.0

func ToRootless(spec *specs.Spec)

ToRootless converts the given spec file into one that should work with rootless containers (euid != 0), by removing incompatible options and adding others that are needed.

Types

type CreateOpts

type CreateOpts struct {
	CgroupName       string
	UseSystemdCgroup bool
	NoPivotRoot      bool
	NoNewKeyring     bool
	Spec             *specs.Spec
	RootlessEUID     bool
	RootlessCgroups  bool
}

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL