Skip to content

Commit e18fb05

Browse files
giuseppegiuseppe
authored
Merge pull request #755 from klihub/fixes/isolate-gojson-deps
generate, validate: isolate gojson* dependencies.
2 parents 22c10da + 24aab90 commit e18fb05

File tree

6 files changed

+82
-45
lines changed

6 files changed

+82
-45
lines changed

‎generate/generate.go‎

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import (
1010

1111
rspec "github.com/opencontainers/runtime-spec/specs-go"
1212
"github.com/opencontainers/runtime-tools/generate/seccomp"
13-
"github.com/opencontainers/runtime-tools/validate"
13+
capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"
1414
"github.com/syndtr/gocapability/capability"
1515
)
1616

@@ -1136,7 +1136,7 @@ func (g *Generator) SetupPrivileged(privileged bool) {
11361136
if privileged { // Add all capabilities in privileged mode.
11371137
var finalCapList []string
11381138
for _, cap := range capability.List() {
1139-
if g.HostSpecific && cap > validate.LastCap() {
1139+
if g.HostSpecific && cap > capsCheck.LastCap() {
11401140
continue
11411141
}
11421142
finalCapList = append(finalCapList, fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())))
@@ -1170,7 +1170,7 @@ func (g *Generator) ClearProcessCapabilities() {
11701170
// AddProcessCapability adds a process capability into all 5 capability sets.
11711171
func (g *Generator) AddProcessCapability(c string) error {
11721172
cp := strings.ToUpper(c)
1173-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1173+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
11741174
return err
11751175
}
11761176

@@ -1233,7 +1233,7 @@ func (g *Generator) AddProcessCapability(c string) error {
12331233
// AddProcessCapabilityAmbient adds a process capability into g.Config.Process.Capabilities.Ambient.
12341234
func (g *Generator) AddProcessCapabilityAmbient(c string) error {
12351235
cp := strings.ToUpper(c)
1236-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1236+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
12371237
return err
12381238
}
12391239

@@ -1257,7 +1257,7 @@ func (g *Generator) AddProcessCapabilityAmbient(c string) error {
12571257
// AddProcessCapabilityBounding adds a process capability into g.Config.Process.Capabilities.Bounding.
12581258
func (g *Generator) AddProcessCapabilityBounding(c string) error {
12591259
cp := strings.ToUpper(c)
1260-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1260+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
12611261
return err
12621262
}
12631263

@@ -1280,7 +1280,7 @@ func (g *Generator) AddProcessCapabilityBounding(c string) error {
12801280
// AddProcessCapabilityEffective adds a process capability into g.Config.Process.Capabilities.Effective.
12811281
func (g *Generator) AddProcessCapabilityEffective(c string) error {
12821282
cp := strings.ToUpper(c)
1283-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1283+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
12841284
return err
12851285
}
12861286

@@ -1303,7 +1303,7 @@ func (g *Generator) AddProcessCapabilityEffective(c string) error {
13031303
// AddProcessCapabilityInheritable adds a process capability into g.Config.Process.Capabilities.Inheritable.
13041304
func (g *Generator) AddProcessCapabilityInheritable(c string) error {
13051305
cp := strings.ToUpper(c)
1306-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1306+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
13071307
return err
13081308
}
13091309

@@ -1326,7 +1326,7 @@ func (g *Generator) AddProcessCapabilityInheritable(c string) error {
13261326
// AddProcessCapabilityPermitted adds a process capability into g.Config.Process.Capabilities.Permitted.
13271327
func (g *Generator) AddProcessCapabilityPermitted(c string) error {
13281328
cp := strings.ToUpper(c)
1329-
if err := validate.CapValid(cp, g.HostSpecific); err != nil {
1329+
if err := capsCheck.CapValid(cp, g.HostSpecific); err != nil {
13301330
return err
13311331
}
13321332

@@ -1379,7 +1379,7 @@ func (g *Generator) DropProcessCapability(c string) error {
13791379
}
13801380
}
13811381

1382-
return validate.CapValid(cp, false)
1382+
return capsCheck.CapValid(cp, false)
13831383
}
13841384

13851385
// DropProcessCapabilityAmbient drops a process capability from g.Config.Process.Capabilities.Ambient.
@@ -1395,7 +1395,7 @@ func (g *Generator) DropProcessCapabilityAmbient(c string) error {
13951395
}
13961396
}
13971397

1398-
return validate.CapValid(cp, false)
1398+
return capsCheck.CapValid(cp, false)
13991399
}
14001400

14011401
// DropProcessCapabilityBounding drops a process capability from g.Config.Process.Capabilities.Bounding.
@@ -1411,7 +1411,7 @@ func (g *Generator) DropProcessCapabilityBounding(c string) error {
14111411
}
14121412
}
14131413

1414-
return validate.CapValid(cp, false)
1414+
return capsCheck.CapValid(cp, false)
14151415
}
14161416

14171417
// DropProcessCapabilityEffective drops a process capability from g.Config.Process.Capabilities.Effective.
@@ -1427,7 +1427,7 @@ func (g *Generator) DropProcessCapabilityEffective(c string) error {
14271427
}
14281428
}
14291429

1430-
return validate.CapValid(cp, false)
1430+
return capsCheck.CapValid(cp, false)
14311431
}
14321432

14331433
// DropProcessCapabilityInheritable drops a process capability from g.Config.Process.Capabilities.Inheritable.
@@ -1443,7 +1443,7 @@ func (g *Generator) DropProcessCapabilityInheritable(c string) error {
14431443
}
14441444
}
14451445

1446-
return validate.CapValid(cp, false)
1446+
return capsCheck.CapValid(cp, false)
14471447
}
14481448

14491449
// DropProcessCapabilityPermitted drops a process capability from g.Config.Process.Capabilities.Permitted.
@@ -1459,7 +1459,7 @@ func (g *Generator) DropProcessCapabilityPermitted(c string) error {
14591459
}
14601460
}
14611461

1462-
return validate.CapValid(cp, false)
1462+
return capsCheck.CapValid(cp, false)
14631463
}
14641464

14651465
func mapStrToNamespace(ns string, path string) (rspec.LinuxNamespace, error) {

‎validate/capabilities/validate.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
package capabilities
2+
3+
import (
4+
"fmt"
5+
"strings"
6+
7+
"github.com/syndtr/gocapability/capability"
8+
)
9+
10+
// CapValid checks whether a capability is valid
11+
func CapValid(c string, hostSpecific bool) error {
12+
isValid := false
13+
14+
if !strings.HasPrefix(c, "CAP_") {
15+
return fmt.Errorf("capability %s must start with CAP_", c)
16+
}
17+
for _, cap := range capability.List() {
18+
if c == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
19+
if hostSpecific && cap > LastCap() {
20+
return fmt.Errorf("%s is not supported on the current host", c)
21+
}
22+
isValid = true
23+
break
24+
}
25+
}
26+
27+
if !isValid {
28+
return fmt.Errorf("invalid capability: %s", c)
29+
}
30+
return nil
31+
}

‎validate/capabilities/validate_linux.go‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
package capabilities
2+
3+
import (
4+
"github.com/syndtr/gocapability/capability"
5+
)
6+
7+
// LastCap return last cap of system
8+
func LastCap() capability.Cap {
9+
last := capability.CAP_LAST_CAP
10+
// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
11+
if last == capability.Cap(63) {
12+
last = capability.CAP_BLOCK_SUSPEND
13+
}
14+
15+
return last
16+
}

‎validate/capabilities/validate_unsupported.go‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
//go:build !linux
2+
// +build !linux
3+
4+
package validate
5+
6+
import (
7+
"github.com/syndtr/gocapability/capability"
8+
)
9+
10+
// LastCap return last cap of system
11+
func LastCap() capability.Cap {
12+
return capability.Cap(-1)
13+
}

‎validate/validate.go‎

Lines changed: 4 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,8 @@ import (
2020
"github.com/hashicorp/go-multierror"
2121
rspec "github.com/opencontainers/runtime-spec/specs-go"
2222
osFilepath "github.com/opencontainers/runtime-tools/filepath"
23+
capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"
2324
"github.com/sirupsen/logrus"
24-
"github.com/syndtr/gocapability/capability"
2525

2626
"github.com/opencontainers/runtime-tools/specerror"
2727
"github.com/xeipuuv/gojsonschema"
@@ -687,26 +687,10 @@ func (v *Validator) CheckAnnotations() (errs error) {
687687
}
688688

689689
// CapValid checks whether a capability is valid
690+
//
691+
// Deprecated: use github.com/opencontainers/runtime-tools/validate/capabilities.CapValid directly.
690692
func CapValid(c string, hostSpecific bool) error {
691-
isValid := false
692-
693-
if !strings.HasPrefix(c, "CAP_") {
694-
return fmt.Errorf("capability %s must start with CAP_", c)
695-
}
696-
for _, cap := range capability.List() {
697-
if c == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
698-
if hostSpecific && cap > LastCap() {
699-
return fmt.Errorf("%s is not supported on the current host", c)
700-
}
701-
isValid = true
702-
break
703-
}
704-
}
705-
706-
if !isValid {
707-
return fmt.Errorf("invalid capability: %s", c)
708-
}
709-
return nil
693+
return capsCheck.CapValid(c, hostSpecific)
710694
}
711695

712696
func envValid(env string) bool {

‎validate/validate_linux.go‎

Lines changed: 4 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -11,26 +11,19 @@ import (
1111
"strings"
1212
"syscall"
1313

14-
"github.com/syndtr/gocapability/capability"
15-
1614
multierror "github.com/hashicorp/go-multierror"
1715
rspec "github.com/opencontainers/runtime-spec/specs-go"
1816
osFilepath "github.com/opencontainers/runtime-tools/filepath"
1917
"github.com/opencontainers/runtime-tools/specerror"
18+
capsCheck "github.com/opencontainers/runtime-tools/validate/capabilities"
2019
"github.com/opencontainers/selinux/go-selinux/label"
2120
"github.com/sirupsen/logrus"
2221
)
2322

2423
// LastCap return last cap of system
25-
func LastCap() capability.Cap {
26-
last := capability.CAP_LAST_CAP
27-
// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
28-
if last == capability.Cap(63) {
29-
last = capability.CAP_BLOCK_SUSPEND
30-
}
31-
32-
return last
33-
}
24+
//
25+
// Deprecated: use github.com/opencontainers/runtime-tools/validate/capabilities.LastCap directly.
26+
var LastCap = capsCheck.LastCap
3427

3528
func deviceValid(d rspec.LinuxDevice) bool {
3629
switch d.Type {

0 commit comments

Comments
 (0)