github.com/docker/docker@v299999999.0.0-20200612211812-aaf470eca7b5+incompatible/oci/oci.go (about)

     1  package oci // import "github.com/docker/docker/oci"
     2  
     3  import (
     4  	"fmt"
     5  	"regexp"
     6  	"strconv"
     7  
     8  	specs "github.com/opencontainers/runtime-spec/specs-go"
     9  )
    10  
    11  // nolint: gosimple
    12  var deviceCgroupRuleRegex = regexp.MustCompile("^([acb]) ([0-9]+|\\*):([0-9]+|\\*) ([rwm]{1,3})$")
    13  
    14  // SetCapabilities sets the provided capabilities on the spec
    15  // All capabilities are added if privileged is true
    16  func SetCapabilities(s *specs.Spec, caplist []string) error {
    17  	s.Process.Capabilities.Effective = caplist
    18  	s.Process.Capabilities.Bounding = caplist
    19  	s.Process.Capabilities.Permitted = caplist
    20  	s.Process.Capabilities.Inheritable = caplist
    21  	// setUser has already been executed here
    22  	// if non root drop capabilities in the way execve does
    23  	if s.Process.User.UID != 0 {
    24  		s.Process.Capabilities.Effective = []string{}
    25  		s.Process.Capabilities.Permitted = []string{}
    26  	}
    27  	return nil
    28  }
    29  
    30  // AppendDevicePermissionsFromCgroupRules takes rules for the devices cgroup to append to the default set
    31  func AppendDevicePermissionsFromCgroupRules(devPermissions []specs.LinuxDeviceCgroup, rules []string) ([]specs.LinuxDeviceCgroup, error) {
    32  	for _, deviceCgroupRule := range rules {
    33  		ss := deviceCgroupRuleRegex.FindAllStringSubmatch(deviceCgroupRule, -1)
    34  		if len(ss[0]) != 5 {
    35  			return nil, fmt.Errorf("invalid device cgroup rule format: '%s'", deviceCgroupRule)
    36  		}
    37  		matches := ss[0]
    38  
    39  		dPermissions := specs.LinuxDeviceCgroup{
    40  			Allow:  true,
    41  			Type:   matches[1],
    42  			Access: matches[4],
    43  		}
    44  		if matches[2] == "*" {
    45  			major := int64(-1)
    46  			dPermissions.Major = &major
    47  		} else {
    48  			major, err := strconv.ParseInt(matches[2], 10, 64)
    49  			if err != nil {
    50  				return nil, fmt.Errorf("invalid major value in device cgroup rule format: '%s'", deviceCgroupRule)
    51  			}
    52  			dPermissions.Major = &major
    53  		}
    54  		if matches[3] == "*" {
    55  			minor := int64(-1)
    56  			dPermissions.Minor = &minor
    57  		} else {
    58  			minor, err := strconv.ParseInt(matches[3], 10, 64)
    59  			if err != nil {
    60  				return nil, fmt.Errorf("invalid minor value in device cgroup rule format: '%s'", deviceCgroupRule)
    61  			}
    62  			dPermissions.Minor = &minor
    63  		}
    64  		devPermissions = append(devPermissions, dPermissions)
    65  	}
    66  	return devPermissions, nil
    67  }