Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[20.10 backport] Use v2 capabilities in layer archives #42352

Merged
merged 1 commit into from Jun 1, 2021
Merged

[20.10 backport] Use v2 capabilities in layer archives #42352

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 1 addition & 10 deletions integration/build/build_userns_linux_test.go
View file
Open in desktop
Expand Up @@ -118,15 +118,6 @@ func TestBuildUserNamespaceValidateCapabilitiesAreV2(t *testing.T) {
_, err = stdcopy.StdCopy(actualStdout, actualStderr, logReader)
assert.NilError(t, err)
if strings.TrimSpace(actualStdout.String()) != "/bin/sleep cap_net_bind_service=eip" {
// Activate when fix is merged: https://github.com/moby/moby/pull/41724
//t.Fatalf("run produced invalid output: %q, expected %q", actualStdout.String(), "/bin/sleep cap_net_bind_service=eip")
// t.Logf("run produced invalid output (expected until #41724 merges): %q, expected %q",
// actualStdout.String(),
// "/bin/sleep cap_net_bind_service=eip")
} else {
// Shouldn't happen until fix is merged: https://github.com/moby/moby/pull/41724
t.Fatalf("run produced valid output (unexpected until #41724 merges): %q, expected %q",
actualStdout.String(),
"/bin/sleep cap_net_bind_service=eip")
t.Fatalf("run produced invalid output: %q, expected %q", actualStdout.String(), "/bin/sleep cap_net_bind_service=eip")
}
}
16 changes: 15 additions & 1 deletion pkg/archive/archive.go
View file
Open in desktop
Expand Up @@ -402,10 +402,24 @@ func fillGo18FileTypeBits(mode int64, fi os.FileInfo) int64 {
// ReadSecurityXattrToTarHeader reads security.capability xattr from filesystem
// to a tar header
func ReadSecurityXattrToTarHeader(path string, hdr *tar.Header) error {
const (
// Values based on linux/include/uapi/linux/capability.h
xattrCapsSz2 = 20
versionOffset = 3
vfsCapRevision2 = 2
vfsCapRevision3 = 3
)
capability, _ := system.Lgetxattr(path, "security.capability")
if capability != nil {
length := len(capability)
if capability[versionOffset] == vfsCapRevision3 {
// Convert VFS_CAP_REVISION_3 to VFS_CAP_REVISION_2 as root UID makes no
// sense outside the user namespace the archive is built in.
capability[versionOffset] = vfsCapRevision2
length = xattrCapsSz2
}
hdr.Xattrs = make(map[string]string)
hdr.Xattrs["security.capability"] = string(capability)
hdr.Xattrs["security.capability"] = string(capability[:length])
}
return nil
}
Expand Down