github.com/demonoid81/moby@v0.0.0-20200517203328-62dd8e17c460/oci/oci.go (about) 1 package oci // import "github.com/demonoid81/moby/oci" 2 3 import ( 4 "fmt" 5 "regexp" 6 "strconv" 7 8 specs "github.com/opencontainers/runtime-spec/specs-go" 9 ) 10 11 // nolint: gosimple 12 var deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$") 13 14 // SetCapabilities sets the provided capabilities on the spec 15 // All capabilities are added if privileged is true 16 func SetCapabilities(s *specs.Spec, caplist []string) error { 17 s.Process.Capabilities.Effective = caplist 18 s.Process.Capabilities.Bounding = caplist 19 s.Process.Capabilities.Permitted = caplist 20 s.Process.Capabilities.Inheritable = caplist 21 // setUser has already been executed here 22 // if non root drop capabilities in the way execve does 23 if s.Process.User.UID != 0 { 24 s.Process.Capabilities.Effective = []string{} 25 s.Process.Capabilities.Permitted = []string{} 26 } 27 return nil 28 } 29 30 // AppendDevicePermissionsFromCgroupRules takes rules for the devices cgroup to append to the default set 31 func AppendDevicePermissionsFromCgroupRules(devPermissions []specs.LinuxDeviceCgroup, rules []string) ([]specs.LinuxDeviceCgroup, error) { 32 for _, deviceCgroupRule := range rules { 33 ss := deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1) 34 if len(ss[0]) != 5 { 35 return nil, fmt.Errorf("invalid device cgroup rule format: '%s'", deviceCgroupRule) 36 } 37 matches := ss[0] 38 39 dPermissions := specs.LinuxDeviceCgroup{ 40 Allow: true, 41 Type: matches[1], 42 Access: matches[4], 43 } 44 if matches[2] == "*" { 45 major := int64(-1) 46 dPermissions.Major = &major 47 } else { 48 major, err := strconv.ParseInt(matches[2], 10, 64) 49 if err != nil { 50 return nil, fmt.Errorf("invalid major value in device cgroup rule format: '%s'", deviceCgroupRule) 51 } 52 dPermissions.Major = &major 53 } 54 if matches[3] == "*" { 55 minor := int64(-1) 56 dPermissions.Minor = &minor 57 } else { 58 minor, err := strconv.ParseInt(matches[3], 10, 64) 59 if err != nil { 60 return nil, fmt.Errorf("invalid minor value in device cgroup rule format: '%s'", deviceCgroupRule) 61 } 62 dPermissions.Minor = &minor 63 } 64 devPermissions = append(devPermissions, dPermissions) 65 } 66 return devPermissions, nil 67 }