deleted file mode 100644

@@ -1,139 +0,0 @@

-package caps // import "github.com/docker/docker/daemon/caps"

-

-import (

-	"fmt"

-	"strings"

-

-	"github.com/syndtr/gocapability/capability"

-)

-

-var capabilityList Capabilities

-

-func init() {

-	last := capability.CAP_LAST_CAP

-	// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap

-	if last == capability.Cap(63) {

-		last = capability.CAP_BLOCK_SUSPEND

-	}

-	for _, cap := range capability.List() {

-		if cap > last {

-			continue

-		}

-		capabilityList = append(capabilityList,

-			&CapabilityMapping{

-				Key:   "CAP_" + strings.ToUpper(cap.String()),

-				Value: cap,

-			},

-		)

-	}

-}

-

-type (

-	// CapabilityMapping maps linux capability name to its value of capability.Cap type

-	// Capabilities is one of the security systems in Linux Security Module (LSM)

-	// framework provided by the kernel.

-	// For more details on capabilities, see http://man7.org/linux/man-pages/man7/capabilities.7.html

-	CapabilityMapping struct {

-		Key   string         `json:"key,omitempty"`

-		Value capability.Cap `json:"value,omitempty"`

-	}

-	// Capabilities contains all CapabilityMapping

-	Capabilities []*CapabilityMapping

-)

-

-// String returns <key> of CapabilityMapping

-func (c *CapabilityMapping) String() string {

-	return c.Key

-}

-

-// GetCapability returns CapabilityMapping which contains specific key

-func GetCapability(key string) *CapabilityMapping {

-	for _, capp := range capabilityList {

-		if capp.Key == key {

-			cpy := *capp

-			return &cpy

-		}

-	}

-	return nil

-}

-

-// GetAllCapabilities returns all of the capabilities

-func GetAllCapabilities() []string {

-	output := make([]string, len(capabilityList))

-	for i, capability := range capabilityList {

-		output[i] = capability.String()

-	}

-	return output

-}

-

-// inSlice tests whether a string is contained in a slice of strings or not.

-// Comparison is case insensitive

-func inSlice(slice []string, s string) bool {

-	for _, ss := range slice {

-		if strings.ToLower(s) == strings.ToLower(ss) {

-			return true

-		}

-	}

-	return false

-}

-

-// TweakCapabilities can tweak capabilities by adding or dropping capabilities

-// based on the basics capabilities.

-func TweakCapabilities(basics, adds, drops []string) ([]string, error) {

-	var (

-		newCaps []string

-		allCaps = GetAllCapabilities()

-	)

-

-	// FIXME(tonistiigi): docker format is without CAP_ prefix, oci is with prefix

-	// Currently they are mixed in here. We should do conversion in one place.

-

-	// look for invalid cap in the drop list

-	for _, cap := range drops {

-		if strings.ToLower(cap) == "all" {

-			continue

-		}

-

-		if !inSlice(allCaps, "CAP_"+cap) {

-			return nil, fmt.Errorf("Unknown capability drop: %q", cap)

-		}

-	}

-

-	// handle --cap-add=all

-	if inSlice(adds, "all") {

-		basics = allCaps

-	}

-

-	if !inSlice(drops, "all") {

-		for _, cap := range basics {

-			// skip `all` already handled above

-			if strings.ToLower(cap) == "all" {

-				continue

-			}

-

-			// if we don't drop `all`, add back all the non-dropped caps

-			if !inSlice(drops, cap[4:]) {

-				newCaps = append(newCaps, strings.ToUpper(cap))

-			}

-		}

-	}

-

-	for _, cap := range adds {

-		// skip `all` already handled above

-		if strings.ToLower(cap) == "all" {

-			continue

-		}

-

-		cap = "CAP_" + cap

-

-		if !inSlice(allCaps, cap) {

-			return nil, fmt.Errorf("Unknown capability to add: %q", cap)

-		}

-

-		// add cap if not already in the list

-		if !inSlice(newCaps, cap) {

-			newCaps = append(newCaps, strings.ToUpper(cap))

-		}

-	}

-	return newCaps, nil

-}

@@ -2,8 +2,8 @@ package daemon // import "github.com/docker/docker/daemon"

 import (

 	"github.com/docker/docker/container"

-	"github.com/docker/docker/daemon/caps"

 	"github.com/docker/docker/daemon/exec"

+	"github.com/docker/docker/oci/caps"

 	"github.com/opencontainers/runc/libcontainer/apparmor"

 	"github.com/opencontainers/runtime-spec/specs-go"

 )

deleted file mode 100644

@@ -1,78 +0,0 @@

-package daemon // import "github.com/docker/docker/daemon"

-

-import (

-	"fmt"

-	"regexp"

-	"strconv"

-

-	"github.com/docker/docker/container"

-	"github.com/docker/docker/daemon/caps"

-	specs "github.com/opencontainers/runtime-spec/specs-go"

-)

-

-// nolint: gosimple

-var (

-	deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$")

-)

-

-func setCapabilities(s *specs.Spec, c *container.Container) error {

-	var caplist []string

-	var err error

-	if c.HostConfig.Privileged {

-		caplist = caps.GetAllCapabilities()

-	} else {

-		caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Bounding, c.HostConfig.CapAdd, c.HostConfig.CapDrop)

-		if err != nil {

-			return err

-		}

-	}

-	s.Process.Capabilities.Effective = caplist

-	s.Process.Capabilities.Bounding = caplist

-	s.Process.Capabilities.Permitted = caplist

-	s.Process.Capabilities.Inheritable = caplist

-	// setUser has already been executed here

-	// if non root drop capabilities in the way execve does

-	if s.Process.User.UID != 0 {

-		s.Process.Capabilities.Effective = []string{}

-		s.Process.Capabilities.Permitted = []string{}

-	}

-	return nil

-}

-

-func appendDevicePermissionsFromCgroupRules(devPermissions []specs.LinuxDeviceCgroup, rules []string) ([]specs.LinuxDeviceCgroup, error) {

-	for _, deviceCgroupRule := range rules {

-		ss := deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1)

-		if len(ss[0]) != 5 {

-			return nil, fmt.Errorf("invalid device cgroup rule format: '%s'", deviceCgroupRule)

-		}

-		matches := ss[0]

-

-		dPermissions := specs.LinuxDeviceCgroup{

-			Allow:  true,

-			Type:   matches[1],

-			Access: matches[4],

-		}

-		if matches[2] == "*" {

-			major := int64(-1)

-			dPermissions.Major = &major

-		} else {

-			major, err := strconv.ParseInt(matches[2], 10, 64)

-			if err != nil {

-				return nil, fmt.Errorf("invalid major value in device cgroup rule format: '%s'", deviceCgroupRule)

-			}

-			dPermissions.Major = &major

-		}

-		if matches[3] == "*" {

-			minor := int64(-1)

-			dPermissions.Minor = &minor

-		} else {

-			minor, err := strconv.ParseInt(matches[3], 10, 64)

-			if err != nil {

-				return nil, fmt.Errorf("invalid minor value in device cgroup rule format: '%s'", deviceCgroupRule)

-			}

-			dPermissions.Minor = &minor

-		}

-		devPermissions = append(devPermissions, dPermissions)

-	}

-	return devPermissions, nil

-}

@@ -113,7 +113,7 @@ func setDevices(s *specs.Spec, c *container.Container) error {

 		}

 		var err error

-		devPermissions, err = appendDevicePermissionsFromCgroupRules(devPermissions, c.HostConfig.DeviceCgroupRules)

+		devPermissions, err = oci.AppendDevicePermissionsFromCgroupRules(devPermissions, c.HostConfig.DeviceCgroupRules)

 		if err != nil {

 			return err

 		}

@@ -762,7 +762,7 @@ func (daemon *Daemon) createSpec(c *container.Container) (retSpec *specs.Spec, e

 	if err := setNamespaces(daemon, &s, c); err != nil {

 		return nil, fmt.Errorf("linux spec namespaces: %v", err)

 	}

-	if err := setCapabilities(&s, c); err != nil {

+	if err := oci.SetCapabilities(&s, c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Privileged); err != nil {

 		return nil, fmt.Errorf("linux spec capabilities: %v", err)

 	}

 	if err := setSeccomp(daemon, &s, c); err != nil {

@@ -368,10 +368,10 @@ func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spe

 	}

 	s.Root.Path = "rootfs"

 	s.Root.Readonly = c.HostConfig.ReadonlyRootfs

-	if err := setCapabilities(s, c); err != nil {

+	if err := oci.SetCapabilities(s, c.HostConfig.CapAdd, c.HostConfig.CapDrop, c.HostConfig.Privileged); err != nil {

 		return fmt.Errorf("linux spec capabilities: %v", err)

 	}

-	devPermissions, err := appendDevicePermissionsFromCgroupRules(nil, c.HostConfig.DeviceCgroupRules)

+	devPermissions, err := oci.AppendDevicePermissionsFromCgroupRules(nil, c.HostConfig.DeviceCgroupRules)

 	if err != nil {

 		return fmt.Errorf("linux runtime spec devices: %v", err)

 	}

new file mode 100644

@@ -0,0 +1,139 @@

+package caps // import "github.com/docker/docker/oci/caps"

+

+import (

+	"fmt"

+	"strings"

+

+	"github.com/syndtr/gocapability/capability"

+)

+

+var capabilityList Capabilities

+

+func init() {

+	last := capability.CAP_LAST_CAP

+	// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap

+	if last == capability.Cap(63) {

+		last = capability.CAP_BLOCK_SUSPEND

+	}

+	for _, cap := range capability.List() {

+		if cap > last {

+			continue

+		}

+		capabilityList = append(capabilityList,

+			&CapabilityMapping{

+				Key:   "CAP_" + strings.ToUpper(cap.String()),

+				Value: cap,

+			},

+		)

+	}

+}

+

+type (

+	// CapabilityMapping maps linux capability name to its value of capability.Cap type

+	// Capabilities is one of the security systems in Linux Security Module (LSM)

+	// framework provided by the kernel.

+	// For more details on capabilities, see http://man7.org/linux/man-pages/man7/capabilities.7.html

+	CapabilityMapping struct {

+		Key   string         `json:"key,omitempty"`

+		Value capability.Cap `json:"value,omitempty"`

+	}

+	// Capabilities contains all CapabilityMapping

+	Capabilities []*CapabilityMapping

+)

+

+// String returns <key> of CapabilityMapping

+func (c *CapabilityMapping) String() string {

+	return c.Key

+}

+

+// GetCapability returns CapabilityMapping which contains specific key

+func GetCapability(key string) *CapabilityMapping {

+	for _, capp := range capabilityList {

+		if capp.Key == key {

+			cpy := *capp

+			return &cpy

+		}

+	}

+	return nil

+}

+

+// GetAllCapabilities returns all of the capabilities

+func GetAllCapabilities() []string {

+	output := make([]string, len(capabilityList))

+	for i, capability := range capabilityList {

+		output[i] = capability.String()

+	}

+	return output

+}

+

+// inSlice tests whether a string is contained in a slice of strings or not.

+// Comparison is case insensitive

+func inSlice(slice []string, s string) bool {

+	for _, ss := range slice {

+		if strings.ToLower(s) == strings.ToLower(ss) {

+			return true

+		}

+	}

+	return false

+}

+

+// TweakCapabilities can tweak capabilities by adding or dropping capabilities

+// based on the basics capabilities.

+func TweakCapabilities(basics, adds, drops []string) ([]string, error) {

+	var (

+		newCaps []string

+		allCaps = GetAllCapabilities()

+	)

+

+	// FIXME(tonistiigi): docker format is without CAP_ prefix, oci is with prefix

+	// Currently they are mixed in here. We should do conversion in one place.

+

+	// look for invalid cap in the drop list

+	for _, cap := range drops {

+		if strings.ToLower(cap) == "all" {

+			continue

+		}

+

+		if !inSlice(allCaps, "CAP_"+cap) {

+			return nil, fmt.Errorf("Unknown capability drop: %q", cap)

+		}

+	}

+

+	// handle --cap-add=all

+	if inSlice(adds, "all") {

+		basics = allCaps

+	}

+

+	if !inSlice(drops, "all") {

+		for _, cap := range basics {

+			// skip `all` already handled above

+			if strings.ToLower(cap) == "all" {

+				continue

+			}

+

+			// if we don't drop `all`, add back all the non-dropped caps

+			if !inSlice(drops, cap[4:]) {

+				newCaps = append(newCaps, strings.ToUpper(cap))

+			}

+		}

+	}

+

+	for _, cap := range adds {

+		// skip `all` already handled above

+		if strings.ToLower(cap) == "all" {

+			continue

+		}

+

+		cap = "CAP_" + cap

+

+		if !inSlice(allCaps, cap) {

+			return nil, fmt.Errorf("Unknown capability to add: %q", cap)

+		}

+

+		// add cap if not already in the list

+		if !inSlice(newCaps, cap) {

+			newCaps = append(newCaps, strings.ToUpper(cap))

+		}

+	}

+	return newCaps, nil

+}

new file mode 100644

@@ -0,0 +1,80 @@

+package oci // import "github.com/docker/docker/oci"

+

+import (

+	"fmt"

+	"regexp"

+	"strconv"

+

+	"github.com/docker/docker/oci/caps"

+	specs "github.com/opencontainers/runtime-spec/specs-go"

+)

+

+// nolint: gosimple

+var deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$")

+

+// SetCapabilities sets the provided capabilities on the spec

+// All capabilities are added if privileged is true

+func SetCapabilities(s *specs.Spec, add, drop []string, privileged bool) error {

+	var (

+		caplist []string

+		err     error

+	)

+	if privileged {

+		caplist = caps.GetAllCapabilities()

+	} else {

+		caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Bounding, add, drop)

+		if err != nil {

+			return err

+		}

+	}

+	s.Process.Capabilities.Effective = caplist

+	s.Process.Capabilities.Bounding = caplist

+	s.Process.Capabilities.Permitted = caplist

+	s.Process.Capabilities.Inheritable = caplist

+	// setUser has already been executed here

+	// if non root drop capabilities in the way execve does

+	if s.Process.User.UID != 0 {

+		s.Process.Capabilities.Effective = []string{}

+		s.Process.Capabilities.Permitted = []string{}

+	}

+	return nil

+}

+

+// AppendDevicePermissionsFromCgroupRules takes rules for the devices cgroup to append to the default set

+func AppendDevicePermissionsFromCgroupRules(devPermissions []specs.LinuxDeviceCgroup, rules []string) ([]specs.LinuxDeviceCgroup, error) {

+	for _, deviceCgroupRule := range rules {

+		ss := deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1)

+		if len(ss[0]) != 5 {

+			return nil, fmt.Errorf("invalid device cgroup rule format: '%s'", deviceCgroupRule)

+		}

+		matches := ss[0]

+

+		dPermissions := specs.LinuxDeviceCgroup{

+			Allow:  true,

+			Type:   matches[1],

+			Access: matches[4],

+		}

+		if matches[2] == "*" {

+			major := int64(-1)

+			dPermissions.Major = &major

+		} else {

+			major, err := strconv.ParseInt(matches[2], 10, 64)

+			if err != nil {

+				return nil, fmt.Errorf("invalid major value in device cgroup rule format: '%s'", deviceCgroupRule)

+			}

+			dPermissions.Major = &major

+		}

+		if matches[3] == "*" {

+			minor := int64(-1)

+			dPermissions.Minor = &minor

+		} else {

+			minor, err := strconv.ParseInt(matches[3], 10, 64)

+			if err != nil {

+				return nil, fmt.Errorf("invalid minor value in device cgroup rule format: '%s'", deviceCgroupRule)

+			}

+			dPermissions.Minor = &minor

+		}

+		devPermissions = append(devPermissions, dPermissions)

+	}

+	return devPermissions, nil

+}