Skip to content

Commit d02c140

Browse files
crosbymichaelcrosbymichael
committed
Add ambient and bounding capability support
Closes opencontainers#668 Signed-off-by: Michael Crosby <[email protected]>
1 parent 359de8f commit d02c140

File tree

4 files changed

+110
-17
lines changed

4 files changed

+110
-17
lines changed

‎config.md

Lines changed: 55 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,13 @@ For Windows, see links for details about [mountvol](http://ss64.com/nt/mountvol.
132132
* **`env`** (array of strings, OPTIONAL) with the same semantics as [IEEE Std 1003.1-2001's `environ`][ieee-1003.1-2001-xbd-c8.1].
133133
* **`args`** (array of strings, REQUIRED) with similar semantics to [IEEE Std 1003.1-2001 `execvp`'s *argv*][ieee-1003.1-2001-xsh-exec].
134134
This specification extends the IEEE standard in that at least one entry is REQUIRED, and that entry is used with the same semantics as `execvp`'s *file*.
135-
* **`capabilities`** (array of strings, OPTIONAL) is an array that specifies the set of capabilities of the process(es) inside the container. Valid values are platform-specific. For example, valid values for Linux are defined in the [CAPABILITIES(7)](http://man7.org/linux/man-pages/man7/capabilities.7.html) man page.
135+
* **`capabilities`** (object, OPTIONAL) is an array that specifies the set of capabilities of the process(es) inside the container. Valid values are platform-specific. For example, valid values for Linux are defined in the [CAPABILITIES(7)](http://man7.org/linux/man-pages/man7/capabilities.7.html) man page.
136+
capabilities contains the following properties:
137+
* **`effective`** (array of strings, OPTIONAL) - the `effective` field is a array of effective capabilities that are kept for the process.
138+
* **`bounding`** (array of strings, OPTIONAL) - the `bounding` field is a array of bounding capabilities that are kept for the process.
139+
* **`inheritable`** (array of strings, OPTIONAL) - the `inheritable` field is a array of inheritable capabilities that are kept for the process.
140+
* **`permitted`** (array of strings, OPTIONAL) - the `permitted` field is a array of permitted capabilities that are kept for the process.
141+
* **`ambient`** (array of strings, OPTIONAL) - the `ambient` field is a array of ambient capabilities that are kept for the process.
136142
* **`rlimits`** (array of objects, OPTIONAL) allows setting resource limits for a process inside the container.
137143
Each entry has the following structure:
138144

@@ -191,11 +197,30 @@ _Note: symbolic name for uid and gid, such as uname and gname respectively, are
191197
"apparmorProfile": "acme_secure_profile",
192198
"selinuxLabel": "system_u:system_r:svirt_lxc_net_t:s0:c124,c675",
193199
"noNewPrivileges": true,
194-
"capabilities": [
195-
"CAP_AUDIT_WRITE",
196-
"CAP_KILL",
197-
"CAP_NET_BIND_SERVICE"
198-
],
200+
"capabilities": {
201+
"bounding": [
202+
"CAP_AUDIT_WRITE",
203+
"CAP_KILL",
204+
"CAP_NET_BIND_SERVICE"
205+
],
206+
"permitted": [
207+
"CAP_AUDIT_WRITE",
208+
"CAP_KILL",
209+
"CAP_NET_BIND_SERVICE"
210+
],
211+
"inheritable": [
212+
"CAP_AUDIT_WRITE",
213+
"CAP_KILL",
214+
"CAP_NET_BIND_SERVICE"
215+
],
216+
"effective": [
217+
"CAP_AUDIT_WRITE",
218+
"CAP_KILL",
219+
],
220+
"ambient": [
221+
"CAP_NET_BIND_SERVICE"
222+
]
223+
},
199224
"rlimits": [
200225
{
201226
"type": "RLIMIT_NOFILE",
@@ -446,11 +471,30 @@ Here is a full example `config.json` for reference.
446471
"TERM=xterm"
447472
],
448473
"cwd": "/",
449-
"capabilities": [
450-
"CAP_AUDIT_WRITE",
451-
"CAP_KILL",
452-
"CAP_NET_BIND_SERVICE"
453-
],
474+
"capabilities": {
475+
"bounding": [
476+
"CAP_AUDIT_WRITE",
477+
"CAP_KILL",
478+
"CAP_NET_BIND_SERVICE"
479+
],
480+
"permitted": [
481+
"CAP_AUDIT_WRITE",
482+
"CAP_KILL",
483+
"CAP_NET_BIND_SERVICE"
484+
],
485+
"inheritable": [
486+
"CAP_AUDIT_WRITE",
487+
"CAP_KILL",
488+
"CAP_NET_BIND_SERVICE"
489+
],
490+
"effective": [
491+
"CAP_AUDIT_WRITE",
492+
"CAP_KILL",
493+
],
494+
"ambient": [
495+
"CAP_NET_BIND_SERVICE"
496+
]
497+
},
454498
"rlimits": [
455499
{
456500
"type": "RLIMIT_CORE",

‎schema/config-schema.json

Lines changed: 37 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,9 +135,43 @@
135135
},
136136
"capabilities": {
137137
"id": "https://opencontainers.org/schema/bundle/process/linux/capabilities",
138-
"type": "array",
139-
"items": {
140-
"$ref": "defs-linux.json#/definitions/Capability"
138+
"type": "object",
139+
"properties": {
140+
"bounding": {
141+
"id": "https://opencontainers.org/schema/bundle/process/linux/capabilities/bounding",
142+
"type": "array",
143+
"items": {
144+
"$ref": "defs-linux.json#/definitions/Capability"
145+
}
146+
},
147+
"permitted": {
148+
"id": "https://opencontainers.org/schema/bundle/process/linux/capabilities/permitted",
149+
"type": "array",
150+
"items": {
151+
"$ref": "defs-linux.json#/definitions/Capability"
152+
}
153+
},
154+
"effective": {
155+
"id": "https://opencontainers.org/schema/bundle/process/linux/capabilities/effective",
156+
"type": "array",
157+
"items": {
158+
"$ref": "defs-linux.json#/definitions/Capability"
159+
}
160+
},
161+
"inheritable": {
162+
"id": "https://opencontainers.org/schema/bundle/process/linux/capabilities/inheritable",
163+
"type": "array",
164+
"items": {
165+
"$ref": "defs-linux.json#/definitions/Capability"
166+
}
167+
},
168+
"ambient": {
169+
"id": "https://opencontainers.org/schema/bundle/process/linux/capabilities/ambient",
170+
"type": "array",
171+
"items": {
172+
"$ref": "defs-linux.json#/definitions/Capability"
173+
}
174+
}
141175
}
142176
},
143177
"apparmorProfile": {

‎schema/defs-linux.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@
7878
}
7979
},
8080
"Capability": {
81-
"description": "Linux process permissions",
81+
"description": "Linux process capabilities",
8282
"type": "string",
8383
"pattern": "^CAP_([A-Z]|_)+$"
8484
},

‎specs-go/config.go

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ type Process struct {
4444
// Cwd is the current working directory for the process and must be
4545
// relative to the container's root.
4646
Cwd string `json:"cwd"`
47-
// Capabilities are Linux capabilities that are kept for the container.
48-
Capabilities []string `json:"capabilities,omitempty" platform:"linux"`
47+
// Capabilities are Linux capabilities that are kept for the process.
48+
Capabilities *LinuxCapabilities `json:"capabilities,omitempty" platform:"linux"`
4949
// Rlimits specifies rlimit options to apply to the process.
5050
Rlimits []LinuxRlimit `json:"rlimits,omitempty" platform:"linux"`
5151
// NoNewPrivileges controls whether additional privileges could be gained by processes in the container.
@@ -56,6 +56,21 @@ type Process struct {
5656
SelinuxLabel string `json:"selinuxLabel,omitempty" platform:"linux"`
5757
}
5858

59+
// LinuxCapabilities specifies the whitelist of capabilities that are kept for a process.
60+
// http://man7.org/linux/man-pages/man7/capabilities.7.html
61+
type LinuxCapabilities struct {
62+
// Bounding is the set of capabilities checked by the kernel.
63+
Bounding []string `json:"bounding,omitempty" platform:"linux"`
64+
// Effective is the set of capabilities checked by the kernel.
65+
Effective []string `json:"effective,omitempty" platform:"linux"`
66+
// Inheritable is the capabilities preserved across execve.
67+
Inheritable []string `json:"inheritable,omitempty" platform:"linux"`
68+
// Permitted is the limiting superset for effective capabilities.
69+
Permitted []string `json:"permitted,omitempty" platform:"linux"`
70+
// Ambient is the ambient set of capabilities that are kept.
71+
Ambient []string `json:"ambient,omitempty" platform:"linux"`
72+
}
73+
5974
// Box specifies dimensions of a rectangle. Used for specifying the size of a console.
6075
type Box struct {
6176
// Height is the vertical dimension of a box.

0 commit comments

Comments
 (0)