Log extra environment information

NOTICES.txt

@@ -20,6 +20,14 @@ Affected Components:
 * golang.org/x/sys
   Copyright (c) 2009 The Go Authors. All rights reserved.
 
+B.2 MIT license
+* github.com/genuinetools/amicontained
+  Copyright (c) 2018 The Genuinetools Authors
+
+B.3 BSD 2-Clause license
+* github.com/syndtr/gocapability/
+  Copyright 2013 Suryandaru Triandana <syndtr@gmail.com>
+
 ===============================================================================
 END OF A. SUMMARY
 ===============================================================================
@@ -58,6 +66,58 @@ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 END OF B.1 BSD 3-Clause license
 ==========================================================================
 
+==========================================================================
+B.2 MIT license
+==========================================================================
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+==========================================================================
+END OF B.2 MIT license
+==========================================================================
+
+==========================================================================
+B.3 BSD 2-Clause license
+==========================================================================
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+    * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+    * Redistributions in binary form must reproduce the above copyright
+notice, this list of conditions and the following disclaimer in the
+documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+==========================================================================
+END OF B.3 BSD 2-Clause license
+==========================================================================
+
 ==========================================================================
 END OF B. LICENSE FILES AND OTHER INFORMATION
 ==========================================================================

cmd/runmqserver/mqconfig.go

@@ -22,9 +22,18 @@ import (
 	"runtime"
 	"strings"
 
-	"github.com/ibm-messaging/mq-container/internal/capabilities"
+	"github.com/genuinetools/amicontained/container"
 )
 
+func logContainerRuntime() error {
+	r, err := container.DetectRuntime()
+	if err != nil {
+		return err
+	}
+	log.Printf("Container runtime: %v", r)
+	return nil
+}
+
 func logBaseImage() error {
 	buf, err := ioutil.ReadFile("/etc/os-release")
 	if err != nil {
@@ -35,7 +44,7 @@ func logBaseImage() error {
 		if strings.HasPrefix(l, "PRETTY_NAME=") {
 			words := strings.Split(l, "\"")
 			if len(words) >= 2 {
-				log.Printf("Base image detected: %v", words[1])
+				log.Printf("Base image: %v", words[1])
 				return nil
 			}
 		}
@@ -46,20 +55,50 @@ func logBaseImage() error {
 func logUser() {
 	u, err := user.Current()
 	if err == nil {
-		log.Printf("Running as user ID %v (%v) with primary group %v", u.Uid, u.Name, u.Gid)
+		g, err := u.GroupIds()
+		if err != nil {
+			log.Printf("Running as user ID %v (%v) with primary group %v", u.Uid, u.Name, u.Gid)
+		} else {
+			// Look for the primary group in the list of group IDs
+			for i, v := range g {
+				if v == u.Gid {
+					// Remove the element from the slice
+					g = append(g[:i], g[i+1:]...)
+				}
+			}
+			log.Printf("Running as user ID %v (%v) with primary group %v, and supplemental groups %v", u.Uid, u.Name, u.Gid, strings.Join(g, ","))
+		}
 	}
 }
 
-func logCapabilities() {
-	status, err := readProc("/proc/1/status")
+// logCapabilities logs the Linux capabilities (e.g. setuid, setgid).  See https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities
+func logCapabilities() error {
+	caps, err := container.Capabilities()
 	if err != nil {
-		// Ignore
-		return
+		return err
 	}
-	caps, err := capabilities.DetectCapabilities(status)
-	if err == nil {
-		log.Printf("Detected capabilities: %v", strings.Join(caps, ","))
+	for k, v := range caps {
+		if len(v) > 0 {
+			log.Printf("Capabilities (%s set): %v", strings.ToLower(k), strings.Join(v, ","))
+		}
 	}
+	return nil
+}
+
+// logSeccomp logs the seccomp enforcing mode, which affects which kernel calls can be made
+func logSeccomp() error {
+	s, err := container.SeccompEnforcingMode()
+	if err != nil {
+		return err
+	}
+	log.Printf("seccomp enforcing mode: %v", s)
+	return nil
+}
+
+func logAppArmor() error {
+	s := container.AppArmorProfile()
+	log.Printf("AppArmor profile: %v", s)
+	return nil
 }
 
 func readProc(filename string) (value string, err error) {
@@ -106,6 +145,7 @@ func logConfig() error {
 		} else {
 			log.Printf("Linux kernel version: %v", osr)
 		}
+		logContainerRuntime()
 		logBaseImage()
 		fileMax, err := readProc("/proc/sys/fs/file-max")
 		if err != nil {
@@ -115,6 +155,8 @@ func logConfig() error {
 		}
 		logUser()
 		logCapabilities()
+		logSeccomp()
+		logAppArmor()
 		err = readMounts()
 		if err != nil {
 			return err

glide.yaml

@@ -21,5 +21,8 @@ excludeDirs:
 import:
 - package: golang.org/x/sys/unix
 - package: github.com/prometheus/client_golang
+  version: 0.8.0
 - package: github.com/ibm-messaging/mq-golang
   version: dev
+- package: github.com/genuinetools/amicontained
+  version: 0.4.0