Skip to content

Commit 24aab90

Browse files
klihubklihub
committed
generate, validate: isolate gojson* dependencies.
Split out those few capability validation functions (LastCap(), CapValid()) which Generator depends on into a validate/capabilities subpackage of their own. This should prevent github.com/xeipuuv/gojson* from sneaking in to the dependencies of anyone who uses Generator for OCI Spec manipulation. Those gojsonschema and related packages are often considered problematic because they do not seem to be actively maintained. At the time of this commit they received their last updates in 2018, 2019 and 2020. Signed-off-by: Krisztian Litkey <[email protected]>
1 parent 17b3287 commit 24aab90

File tree

6 files changed

+82
-45
lines changed

6 files changed

+82
-45
lines changed

‎generate/generate.go‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010

1111
rspec "github.com/opencontainers/runtime-spec/specs-go"
1212
"github.com/opencontainers/runtime-tools/generate/seccomp"
13-
"github.com/opencontainers/runtime-tools/validate"
13+
capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"
1414
"github.com/syndtr/gocapability/capability"
1515
)
1616

@@ -1140,7 +1140,7 @@ func (g *Generator) SetupPrivileged(privileged bool) {
11401140
if privileged { // Add all capabilities in privileged mode.
11411141
var finalCapList []string
11421142
for _, cap := range capability.List() {
1143-
if g.HostSpecific && cap > validate.LastCap() {
1143+
if g.HostSpecific && cap > capsCheck.LastCap() {
11441144
continue
11451145
}
11461146
finalCapList = append(finalCapList, fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())))
@@ -1174,7 +1174,7 @@ func (g *Generator) ClearProcessCapabilities() {
11741174
// AddProcessCapability adds a process capability into all 5 capability sets.
11751175
func (g *Generator) AddProcessCapability(c string) error {
11761176
cp := strings.ToUpper(c)
1177-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1177+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
11781178
return err
11791179
}
11801180

@@ -1237,7 +1237,7 @@ func (g *Generator) AddProcessCapability(c string) error {
12371237
// AddProcessCapabilityAmbient adds a process capability into g.Config.Process.Capabilities.Ambient.
12381238
func (g *Generator) AddProcessCapabilityAmbient(c string) error {
12391239
cp := strings.ToUpper(c)
1240-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1240+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
12411241
return err
12421242
}
12431243

@@ -1261,7 +1261,7 @@ func (g *Generator) AddProcessCapabilityAmbient(c string) error {
12611261
// AddProcessCapabilityBounding adds a process capability into g.Config.Process.Capabilities.Bounding.
12621262
func (g *Generator) AddProcessCapabilityBounding(c string) error {
12631263
cp := strings.ToUpper(c)
1264-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1264+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
12651265
return err
12661266
}
12671267

@@ -1284,7 +1284,7 @@ func (g *Generator) AddProcessCapabilityBounding(c string) error {
12841284
// AddProcessCapabilityEffective adds a process capability into g.Config.Process.Capabilities.Effective.
12851285
func (g *Generator) AddProcessCapabilityEffective(c string) error {
12861286
cp := strings.ToUpper(c)
1287-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1287+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
12881288
return err
12891289
}
12901290

@@ -1307,7 +1307,7 @@ func (g *Generator) AddProcessCapabilityEffective(c string) error {
13071307
// AddProcessCapabilityInheritable adds a process capability into g.Config.Process.Capabilities.Inheritable.
13081308
func (g *Generator) AddProcessCapabilityInheritable(c string) error {
13091309
cp := strings.ToUpper(c)
1310-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1310+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
13111311
return err
13121312
}
13131313

@@ -1330,7 +1330,7 @@ func (g *Generator) AddProcessCapabilityInheritable(c string) error {
13301330
// AddProcessCapabilityPermitted adds a process capability into g.Config.Process.Capabilities.Permitted.
13311331
func (g *Generator) AddProcessCapabilityPermitted(c string) error {
13321332
cp := strings.ToUpper(c)
1333-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1333+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
13341334
return err
13351335
}
13361336

@@ -1383,7 +1383,7 @@ func (g *Generator) DropProcessCapability(c string) error {
13831383
}
13841384
}
13851385

1386-
return validate.CapValid(cp, false)
1386+
return capsCheck.CapValid(cp, false)
13871387
}
13881388

13891389
// DropProcessCapabilityAmbient drops a process capability from g.Config.Process.Capabilities.Ambient.
@@ -1399,7 +1399,7 @@ func (g *Generator) DropProcessCapabilityAmbient(c string) error {
13991399
}
14001400
}
14011401

1402-
return validate.CapValid(cp, false)
1402+
return capsCheck.CapValid(cp, false)
14031403
}
14041404

14051405
// DropProcessCapabilityBounding drops a process capability from g.Config.Process.Capabilities.Bounding.
@@ -1415,7 +1415,7 @@ func (g *Generator) DropProcessCapabilityBounding(c string) error {
14151415
}
14161416
}
14171417

1418-
return validate.CapValid(cp, false)
1418+
return capsCheck.CapValid(cp, false)
14191419
}
14201420

14211421
// DropProcessCapabilityEffective drops a process capability from g.Config.Process.Capabilities.Effective.
@@ -1431,7 +1431,7 @@ func (g *Generator) DropProcessCapabilityEffective(c string) error {
14311431
}
14321432
}
14331433

1434-
return validate.CapValid(cp, false)
1434+
return capsCheck.CapValid(cp, false)
14351435
}
14361436

14371437
// DropProcessCapabilityInheritable drops a process capability from g.Config.Process.Capabilities.Inheritable.
@@ -1447,7 +1447,7 @@ func (g *Generator) DropProcessCapabilityInheritable(c string) error {
14471447
}
14481448
}
14491449

1450-
return validate.CapValid(cp, false)
1450+
return capsCheck.CapValid(cp, false)
14511451
}
14521452

14531453
// DropProcessCapabilityPermitted drops a process capability from g.Config.Process.Capabilities.Permitted.
@@ -1463,7 +1463,7 @@ func (g *Generator) DropProcessCapabilityPermitted(c string) error {
14631463
}
14641464
}
14651465

1466-
return validate.CapValid(cp, false)
1466+
return capsCheck.CapValid(cp, false)
14671467
}
14681468

14691469
func mapStrToNamespace(ns string, path string) (rspec.LinuxNamespace, error) {

‎validate/capabilities/validate.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package capabilities
2+
3+
import (
4+
"fmt"
5+
"strings"
6+
7+
"github.com/syndtr/gocapability/capability"
8+
)
9+
10+
// CapValid checks whether a capability is valid
11+
func CapValid(c string, hostSpecific bool) error {
12+
isValid := false
13+
14+
if !strings.HasPrefix(c, "CAP_") {
15+
return fmt.Errorf("capability %s must start with CAP_", c)
16+
}
17+
for _, cap := range capability.List() {
18+
if c == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
19+
if hostSpecific && cap > LastCap() {
20+
return fmt.Errorf("%s is not supported on the current host", c)
21+
}
22+
isValid = true
23+
break
24+
}
25+
}
26+
27+
if !isValid {
28+
return fmt.Errorf("invalid capability: %s", c)
29+
}
30+
return nil
31+
}

‎validate/capabilities/validate_linux.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package capabilities
2+
3+
import (
4+
"github.com/syndtr/gocapability/capability"
5+
)
6+
7+
// LastCap return last cap of system
8+
func LastCap() capability.Cap {
9+
last := capability.CAP_LAST_CAP
10+
// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
11+
if last == capability.Cap(63) {
12+
last = capability.CAP_BLOCK_SUSPEND
13+
}
14+
15+
return last
16+
}

‎validate/capabilities/validate_unsupported.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
//go:build !linux
2+
// +build !linux
3+
4+
package validate
5+
6+
import (
7+
"github.com/syndtr/gocapability/capability"
8+
)
9+
10+
// LastCap return last cap of system
11+
func LastCap() capability.Cap {
12+
return capability.Cap(-1)
13+
}

‎validate/validate.go‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ import (
2020
"github.com/hashicorp/go-multierror"
2121
rspec "github.com/opencontainers/runtime-spec/specs-go"
2222
osFilepath "github.com/opencontainers/runtime-tools/filepath"
23+
capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"
2324
"github.com/sirupsen/logrus"
24-
"github.com/syndtr/gocapability/capability"
2525

2626
"github.com/opencontainers/runtime-tools/specerror"
2727
"github.com/xeipuuv/gojsonschema"
@@ -687,26 +687,10 @@ func (v *Validator) CheckAnnotations() (errs error) {
687687
}
688688

689689
// CapValid checks whether a capability is valid
690+
//
691+
// Deprecated: use github.com/opencontainers/runtime-tools/validate/capabilities.CapValid directly.
690692
func CapValid(c string, hostSpecific bool) error {
691-
isValid := false
692-
693-
if !strings.HasPrefix(c, "CAP_") {
694-
return fmt.Errorf("capability %s must start with CAP_", c)
695-
}
696-
for _, cap := range capability.List() {
697-
if c == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
698-
if hostSpecific && cap > LastCap() {
699-
return fmt.Errorf("%s is not supported on the current host", c)
700-
}
701-
isValid = true
702-
break
703-
}
704-
}
705-
706-
if !isValid {
707-
return fmt.Errorf("invalid capability: %s", c)
708-
}
709-
return nil
693+
return capsCheck.CapValid(c, hostSpecific)
710694
}
711695

712696
func envValid(env string) bool {

‎validate/validate_linux.go‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,19 @@ import (
1111
"strings"
1212
"syscall"
1313

14-
"github.com/syndtr/gocapability/capability"
15-
1614
multierror "github.com/hashicorp/go-multierror"
1715
rspec "github.com/opencontainers/runtime-spec/specs-go"
1816
osFilepath "github.com/opencontainers/runtime-tools/filepath"
1917
"github.com/opencontainers/runtime-tools/specerror"
18+
capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"
2019
"github.com/opencontainers/selinux/go-selinux/label"
2120
"github.com/sirupsen/logrus"
2221
)
2322

2423
// LastCap return last cap of system
25-
func LastCap() capability.Cap {
26-
last := capability.CAP_LAST_CAP
27-
// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
28-
if last == capability.Cap(63) {
29-
last = capability.CAP_BLOCK_SUSPEND
30-
}
31-
32-
return last
33-
}
24+
//
25+
// Deprecated: use github.com/opencontainers/runtime-tools/validate/capabilities.LastCap directly.
26+
var LastCap = capsCheck.LastCap
3427

3528
func deviceValid(d rspec.LinuxDevice) bool {
3629
switch d.Type {

0 commit comments

Comments
 (0)