1. docker
  2. Commit 1308a3a99faa13ff279dcb4eb5ad23aee3ab5cdb
Browse code

Move DefaultCapabilities() to caps package

Signed-off-by: Olli Janatuinen <olli.janatuinen@gmail.com>

Olli Janatuinen authored on 2019/11/15 02:53:52
Showing 4 changed files
daemon/oci_linux.go
History View file @ 1308a3a
... ... 
@@ -139,7 +139,7 @@ func WithApparmor(c *container.Container) coci.SpecOpts {
139 139 
 func WithCapabilities(c *container.Container) coci.SpecOpts {
140 140 
 	return func(ctx context.Context, _ coci.Client, _ *containers.Container, s *coci.Spec) error {
141 141 
 		capabilities, err := caps.TweakCapabilities(
142 
-			oci.DefaultCapabilities(),
142 
+			caps.DefaultCapabilities(),
143 143 
 			c.HostConfig.CapAdd,
144 144 
 			c.HostConfig.CapDrop,
145 145 
 			c.HostConfig.Capabilities,
daemon/oci_windows.go
History View file @ 1308a3a
... ... 
@@ -390,7 +390,7 @@ func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spe
390 390 
 	// Note these are against the UVM.
391 391 
 	setResourcesInSpec(c, s, true) // LCOW is Hyper-V only
392 392
393 
-	capabilities, err := caps.TweakCapabilities(oci.DefaultCapabilities(), c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Capabilities, c.HostConfig.Privileged)
393 
+	capabilities, err := caps.TweakCapabilities(caps.DefaultCapabilities(), c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Capabilities, c.HostConfig.Privileged)
394 394 
 	if err != nil {
395 395 
 		return fmt.Errorf("linux spec capabilities: %v", err)
396 396 
 	}
oci/caps/defaults.go
History View file @ 1308a3a
397 397 
new file mode 100644
... ... 
@@ -0,0 +1,21 @@
0 
+package caps // import "github.com/docker/docker/oci/caps"
1 
+
2 
+// DefaultCapabilities returns a Linux kernel default capabilities
3 
+func DefaultCapabilities() []string {
4 
+	return []string{
5 
+		"CAP_CHOWN",
6 
+		"CAP_DAC_OVERRIDE",
7 
+		"CAP_FSETID",
8 
+		"CAP_FOWNER",
9 
+		"CAP_MKNOD",
10 
+		"CAP_NET_RAW",
11 
+		"CAP_SETGID",
12 
+		"CAP_SETUID",
13 
+		"CAP_SETFCAP",
14 
+		"CAP_SETPCAP",
15 
+		"CAP_NET_BIND_SERVICE",
16 
+		"CAP_SYS_CHROOT",
17 
+		"CAP_KILL",
18 
+		"CAP_AUDIT_WRITE",
19 
+	}
20 
+}
oci/defaults.go
History View file @ 1308a3a
... ... 
@@ -4,6 +4,7 @@ import (
4 4 
 	"os"
5 5 
 	"runtime"
6 6
7 
+	"github.com/docker/docker/oci/caps"
7 8 
 	specs "github.com/opencontainers/runtime-spec/specs-go"
8 9 
 )
9 10
... ... 
@@ -11,26 +12,6 @@ func iPtr(i int64) *int64        { return &i }
11 11 
 func u32Ptr(i int64) *uint32     { u := uint32(i); return &u }
12 12 
 func fmPtr(i int64) *os.FileMode { fm := os.FileMode(i); return &fm }
13 13
14 
-// DefaultCapabilities returns a Linux kernel default capabilities
15 
-func DefaultCapabilities() []string {
16 
-	return []string{
17 
-		"CAP_CHOWN",
18 
-		"CAP_DAC_OVERRIDE",
19 
-		"CAP_FSETID",
20 
-		"CAP_FOWNER",
21 
-		"CAP_MKNOD",
22 
-		"CAP_NET_RAW",
23 
-		"CAP_SETGID",
24 
-		"CAP_SETUID",
25 
-		"CAP_SETFCAP",
26 
-		"CAP_SETPCAP",
27 
-		"CAP_NET_BIND_SERVICE",
28 
-		"CAP_SYS_CHROOT",
29 
-		"CAP_KILL",
30 
-		"CAP_AUDIT_WRITE",
31 
-	}
32 
-}
33 
-
34 14 
 // DefaultSpec returns the default spec used by docker for the current Platform
35 15 
 func DefaultSpec() specs.Spec {
36 16 
 	return DefaultOSSpec(runtime.GOOS)
... ... 
@@ -60,10 +41,10 @@ func DefaultLinuxSpec() specs.Spec {
60 60 
 		Version: specs.Version,
61 61 
 		Process: &specs.Process{
62 62 
 			Capabilities: &specs.LinuxCapabilities{
63 
-				Bounding:    DefaultCapabilities(),
64 
-				Permitted:   DefaultCapabilities(),
65 
-				Inheritable: DefaultCapabilities(),
66 
-				Effective:   DefaultCapabilities(),
63 
+				Bounding:    caps.DefaultCapabilities(),
64 
+				Permitted:   caps.DefaultCapabilities(),
65 
+				Inheritable: caps.DefaultCapabilities(),
66 
+				Effective:   caps.DefaultCapabilities(),
67 67 
 			},
68 68 
 		},
69 69 
 		Root: &specs.Root{},