new file mode 100644

@@ -0,0 +1,139 @@

+package caps // import "github.com/docker/docker/daemon/caps"

+

+import (

+	"fmt"

+	"strings"

+

+	"github.com/syndtr/gocapability/capability"

+)

+

+var capabilityList Capabilities

+

+func init() {

+	last := capability.CAP_LAST_CAP

+	// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap

+	if last == capability.Cap(63) {

+		last = capability.CAP_BLOCK_SUSPEND

+	}

+	for _, cap := range capability.List() {

+		if cap > last {

+			continue

+		}

+		capabilityList = append(capabilityList,

+			&CapabilityMapping{

+				Key:   "CAP_" + strings.ToUpper(cap.String()),

+				Value: cap,

+			},

+		)

+	}

+}

+

+type (

+	// CapabilityMapping maps linux capability name to its value of capability.Cap type

+	// Capabilities is one of the security systems in Linux Security Module (LSM)

+	// framework provided by the kernel.

+	// For more details on capabilities, see http://man7.org/linux/man-pages/man7/capabilities.7.html

+	CapabilityMapping struct {

+		Key   string         `json:"key,omitempty"`

+		Value capability.Cap `json:"value,omitempty"`

+	}

+	// Capabilities contains all CapabilityMapping

+	Capabilities []*CapabilityMapping

+)

+

+// String returns <key> of CapabilityMapping

+func (c *CapabilityMapping) String() string {

+	return c.Key

+}

+

+// GetCapability returns CapabilityMapping which contains specific key

+func GetCapability(key string) *CapabilityMapping {

+	for _, capp := range capabilityList {

+		if capp.Key == key {

+			cpy := *capp

+			return &cpy

+		}

+	}

+	return nil

+}

+

+// GetAllCapabilities returns all of the capabilities

+func GetAllCapabilities() []string {

+	output := make([]string, len(capabilityList))

+	for i, capability := range capabilityList {

+		output[i] = capability.String()

+	}

+	return output

+}

+

+// inSlice tests whether a string is contained in a slice of strings or not.

+// Comparison is case insensitive

+func inSlice(slice []string, s string) bool {

+	for _, ss := range slice {

+		if strings.ToLower(s) == strings.ToLower(ss) {

+			return true

+		}

+	}

+	return false

+}

+

+// TweakCapabilities can tweak capabilities by adding or dropping capabilities

+// based on the basics capabilities.

+func TweakCapabilities(basics, adds, drops []string) ([]string, error) {

+	var (

+		newCaps []string

+		allCaps = GetAllCapabilities()

+	)

+

+	// FIXME(tonistiigi): docker format is without CAP_ prefix, oci is with prefix

+	// Currently they are mixed in here. We should do conversion in one place.

+

+	// look for invalid cap in the drop list

+	for _, cap := range drops {

+		if strings.ToLower(cap) == "all" {

+			continue

+		}

+

+		if !inSlice(allCaps, "CAP_"+cap) {

+			return nil, fmt.Errorf("Unknown capability drop: %q", cap)

+		}

+	}

+

+	// handle --cap-add=all

+	if inSlice(adds, "all") {

+		basics = allCaps

+	}

+

+	if !inSlice(drops, "all") {

+		for _, cap := range basics {

+			// skip `all` already handled above

+			if strings.ToLower(cap) == "all" {

+				continue

+			}

+

+			// if we don't drop `all`, add back all the non-dropped caps

+			if !inSlice(drops, cap[4:]) {

+				newCaps = append(newCaps, strings.ToUpper(cap))

+			}

+		}

+	}

+

+	for _, cap := range adds {

+		// skip `all` already handled above

+		if strings.ToLower(cap) == "all" {

+			continue

+		}

+

+		cap = "CAP_" + cap

+

+		if !inSlice(allCaps, cap) {

+			return nil, fmt.Errorf("Unknown capability to add: %q", cap)

+		}

+

+		// add cap if not already in the list

+		if !inSlice(newCaps, cap) {

+			newCaps = append(newCaps, strings.ToUpper(cap))

+		}

+	}

+	return newCaps, nil

+}

deleted file mode 100644

@@ -1,141 +0,0 @@

-// +build !windows

-

-package caps // import "github.com/docker/docker/daemon/caps"

-

-import (

-	"fmt"

-	"strings"

-

-	"github.com/syndtr/gocapability/capability"

-)

-

-var capabilityList Capabilities

-

-func init() {

-	last := capability.CAP_LAST_CAP

-	// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap

-	if last == capability.Cap(63) {

-		last = capability.CAP_BLOCK_SUSPEND

-	}

-	for _, cap := range capability.List() {

-		if cap > last {

-			continue

-		}

-		capabilityList = append(capabilityList,

-			&CapabilityMapping{

-				Key:   "CAP_" + strings.ToUpper(cap.String()),

-				Value: cap,

-			},

-		)

-	}

-}

-

-type (

-	// CapabilityMapping maps linux capability name to its value of capability.Cap type

-	// Capabilities is one of the security systems in Linux Security Module (LSM)

-	// framework provided by the kernel.

-	// For more details on capabilities, see http://man7.org/linux/man-pages/man7/capabilities.7.html

-	CapabilityMapping struct {

-		Key   string         `json:"key,omitempty"`

-		Value capability.Cap `json:"value,omitempty"`

-	}

-	// Capabilities contains all CapabilityMapping

-	Capabilities []*CapabilityMapping

-)

-

-// String returns <key> of CapabilityMapping

-func (c *CapabilityMapping) String() string {

-	return c.Key

-}

-

-// GetCapability returns CapabilityMapping which contains specific key

-func GetCapability(key string) *CapabilityMapping {

-	for _, capp := range capabilityList {

-		if capp.Key == key {

-			cpy := *capp

-			return &cpy

-		}

-	}

-	return nil

-}

-

-// GetAllCapabilities returns all of the capabilities

-func GetAllCapabilities() []string {

-	output := make([]string, len(capabilityList))

-	for i, capability := range capabilityList {

-		output[i] = capability.String()

-	}

-	return output

-}

-

-// inSlice tests whether a string is contained in a slice of strings or not.

-// Comparison is case insensitive

-func inSlice(slice []string, s string) bool {

-	for _, ss := range slice {

-		if strings.ToLower(s) == strings.ToLower(ss) {

-			return true

-		}

-	}

-	return false

-}

-

-// TweakCapabilities can tweak capabilities by adding or dropping capabilities

-// based on the basics capabilities.

-func TweakCapabilities(basics, adds, drops []string) ([]string, error) {

-	var (

-		newCaps []string

-		allCaps = GetAllCapabilities()

-	)

-

-	// FIXME(tonistiigi): docker format is without CAP_ prefix, oci is with prefix

-	// Currently they are mixed in here. We should do conversion in one place.

-

-	// look for invalid cap in the drop list

-	for _, cap := range drops {

-		if strings.ToLower(cap) == "all" {

-			continue

-		}

-

-		if !inSlice(allCaps, "CAP_"+cap) {

-			return nil, fmt.Errorf("Unknown capability drop: %q", cap)

-		}

-	}

-

-	// handle --cap-add=all

-	if inSlice(adds, "all") {

-		basics = allCaps

-	}

-

-	if !inSlice(drops, "all") {

-		for _, cap := range basics {

-			// skip `all` already handled above

-			if strings.ToLower(cap) == "all" {

-				continue

-			}

-

-			// if we don't drop `all`, add back all the non-dropped caps

-			if !inSlice(drops, cap[4:]) {

-				newCaps = append(newCaps, strings.ToUpper(cap))

-			}

-		}

-	}

-

-	for _, cap := range adds {

-		// skip `all` already handled above

-		if strings.ToLower(cap) == "all" {

-			continue

-		}

-

-		cap = "CAP_" + cap

-

-		if !inSlice(allCaps, cap) {

-			return nil, fmt.Errorf("Unknown capability to add: %q", cap)

-		}

-

-		// add cap if not already in the list

-		if !inSlice(newCaps, cap) {

-			newCaps = append(newCaps, strings.ToUpper(cap))

-		}

-	}

-	return newCaps, nil

-}

new file mode 100644

@@ -0,0 +1,78 @@

+package daemon // import "github.com/docker/docker/daemon"

+

+import (

+	"fmt"

+	"regexp"

+	"strconv"

+

+	"github.com/docker/docker/container"

+	"github.com/docker/docker/daemon/caps"

+	specs "github.com/opencontainers/runtime-spec/specs-go"

+)

+

+// nolint: gosimple

+var (

+	deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$")

+)

+

+func setCapabilities(s *specs.Spec, c *container.Container) error {

+	var caplist []string

+	var err error

+	if c.HostConfig.Privileged {

+		caplist = caps.GetAllCapabilities()

+	} else {

+		caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Bounding, c.HostConfig.CapAdd, c.HostConfig.CapDrop)

+		if err != nil {

+			return err

+		}

+	}

+	s.Process.Capabilities.Effective = caplist

+	s.Process.Capabilities.Bounding = caplist

+	s.Process.Capabilities.Permitted = caplist

+	s.Process.Capabilities.Inheritable = caplist

+	// setUser has already been executed here

+	// if non root drop capabilities in the way execve does

+	if s.Process.User.UID != 0 {

+		s.Process.Capabilities.Effective = []string{}

+		s.Process.Capabilities.Permitted = []string{}

+	}

+	return nil

+}

+

+func appendDevicePermissionsFromCgroupRules(devPermissions []specs.LinuxDeviceCgroup, rules []string) ([]specs.LinuxDeviceCgroup, error) {

+	for _, deviceCgroupRule := range rules {

+		ss := deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1)

+		if len(ss[0]) != 5 {

+			return nil, fmt.Errorf("invalid device cgroup rule format: '%s'", deviceCgroupRule)

+		}

+		matches := ss[0]

+

+		dPermissions := specs.LinuxDeviceCgroup{

+			Allow:  true,

+			Type:   matches[1],

+			Access: matches[4],

+		}

+		if matches[2] == "*" {

+			major := int64(-1)

+			dPermissions.Major = &major

+		} else {

+			major, err := strconv.ParseInt(matches[2], 10, 64)

+			if err != nil {

+				return nil, fmt.Errorf("invalid major value in device cgroup rule format: '%s'", deviceCgroupRule)

+			}

+			dPermissions.Major = &major

+		}

+		if matches[3] == "*" {

+			minor := int64(-1)

+			dPermissions.Minor = &minor

+		} else {

+			minor, err := strconv.ParseInt(matches[3], 10, 64)

+			if err != nil {

+				return nil, fmt.Errorf("invalid minor value in device cgroup rule format: '%s'", deviceCgroupRule)

+			}

+			dPermissions.Minor = &minor

+		}

+		devPermissions = append(devPermissions, dPermissions)

+	}

+	return devPermissions, nil

+}

@@ -6,14 +6,12 @@ import (

 	"os"

 	"os/exec"

 	"path/filepath"

-	"regexp"

 	"sort"

 	"strconv"

 	"strings"

 	containertypes "github.com/docker/docker/api/types/container"

 	"github.com/docker/docker/container"

-	"github.com/docker/docker/daemon/caps"

 	daemonconfig "github.com/docker/docker/daemon/config"

 	"github.com/docker/docker/oci"

 	"github.com/docker/docker/pkg/idtools"

@@ -29,11 +27,6 @@ import (

 	"golang.org/x/sys/unix"

 )

-// nolint: gosimple

-var (

-	deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$")

-)

-

 func setResources(s *specs.Spec, r containertypes.Resources) error {

 	weightDevices, err := getBlkioWeightDevices(r)

 	if err != nil {

@@ -115,39 +108,10 @@ func setDevices(s *specs.Spec, c *container.Container) error {

 			devPermissions = append(devPermissions, dPermissions...)

 		}

-		for _, deviceCgroupRule := range c.HostConfig.DeviceCgroupRules {

-			ss := deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1)

-			if len(ss[0]) != 5 {

-				return fmt.Errorf("invalid device cgroup rule format: '%s'", deviceCgroupRule)

-			}

-			matches := ss[0]

-

-			dPermissions := specs.LinuxDeviceCgroup{

-				Allow:  true,

-				Type:   matches[1],

-				Access: matches[4],

-			}

-			if matches[2] == "*" {

-				major := int64(-1)

-				dPermissions.Major = &major

-			} else {

-				major, err := strconv.ParseInt(matches[2], 10, 64)

-				if err != nil {

-					return fmt.Errorf("invalid major value in device cgroup rule format: '%s'", deviceCgroupRule)

-				}

-				dPermissions.Major = &major

-			}

-			if matches[3] == "*" {

-				minor := int64(-1)

-				dPermissions.Minor = &minor

-			} else {

-				minor, err := strconv.ParseInt(matches[3], 10, 64)

-				if err != nil {

-					return fmt.Errorf("invalid minor value in device cgroup rule format: '%s'", deviceCgroupRule)

-				}

-				dPermissions.Minor = &minor

-			}

-			devPermissions = append(devPermissions, dPermissions)

+		var err error

+		devPermissions, err = appendDevicePermissionsFromCgroupRules(devPermissions, c.HostConfig.DeviceCgroupRules)

+		if err != nil {

+			return err

 		}

 	}

@@ -249,30 +213,6 @@ func setNamespace(s *specs.Spec, ns specs.LinuxNamespace) {

 	s.Linux.Namespaces = append(s.Linux.Namespaces, ns)

 }

-func setCapabilities(s *specs.Spec, c *container.Container) error {

-	var caplist []string

-	var err error

-	if c.HostConfig.Privileged {

-		caplist = caps.GetAllCapabilities()

-	} else {

-		caplist, err = caps.TweakCapabilities(s.Process.Capabilities.Bounding, c.HostConfig.CapAdd, c.HostConfig.CapDrop)

-		if err != nil {

-			return err

-		}

-	}

-	s.Process.Capabilities.Effective = caplist

-	s.Process.Capabilities.Bounding = caplist

-	s.Process.Capabilities.Permitted = caplist

-	s.Process.Capabilities.Inheritable = caplist

-	// setUser has already been executed here

-	// if non root drop capabilities in the way execve does

-	if s.Process.User.UID != 0 {

-		s.Process.Capabilities.Effective = []string{}

-		s.Process.Capabilities.Permitted = []string{}

-	}

-	return nil

-}

-

 func setNamespaces(daemon *Daemon, s *specs.Spec, c *container.Container) error {

 	userNS := false

 	// user

@@ -211,7 +211,9 @@ func (daemon *Daemon) createSpec(c *container.Container) (*specs.Spec, error) {

 		if !system.LCOWSupported() {

 			return nil, fmt.Errorf("Linux containers on Windows are not supported")

 		}

-		daemon.createSpecLinuxFields(c, &s)

+		if err := daemon.createSpecLinuxFields(c, &s); err != nil {

+			return nil, err

+		}

 	default:

 		return nil, fmt.Errorf("Unsupported platform %q", img.OS)

 	}

@@ -336,12 +338,21 @@ func (daemon *Daemon) createSpecWindowsFields(c *container.Container, s *specs.S

 // Sets the Linux-specific fields of the OCI spec

 // TODO: @jhowardmsft LCOW Support. We need to do a lot more pulling in what can

 // be pulled in from oci_linux.go.

-func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spec) {

+func (daemon *Daemon) createSpecLinuxFields(c *container.Container, s *specs.Spec) error {

 	if len(s.Process.Cwd) == 0 {

 		s.Process.Cwd = `/`

 	}

 	s.Root.Path = "rootfs"

 	s.Root.Readonly = c.HostConfig.ReadonlyRootfs

+	if err := setCapabilities(s, c); err != nil {

+		return fmt.Errorf("linux spec capabilities: %v", err)

+	}

+	devPermissions, err := appendDevicePermissionsFromCgroupRules(nil, c.HostConfig.DeviceCgroupRules)

+	if err != nil {

+		return fmt.Errorf("linux runtime spec devices: %v", err)

+	}

+	s.Linux.Resources.Devices = devPermissions

+	return nil

 }

 func escapeArgs(args []string) []string {