summaryrefslogtreecommitdiff
path: root/vendor/github.com
diff options
context:
space:
mode:
Diffstat (limited to 'vendor/github.com')
-rw-r--r--vendor/github.com/containers/common/libimage/filters.go22
-rw-r--r--vendor/github.com/containers/common/pkg/config/containers.conf8
-rw-r--r--vendor/github.com/containers/common/pkg/config/default.go2
-rw-r--r--vendor/github.com/containers/common/pkg/seccomp/default_linux.go33
-rw-r--r--vendor/github.com/containers/common/pkg/seccomp/seccomp.json47
5 files changed, 62 insertions, 50 deletions
diff --git a/vendor/github.com/containers/common/libimage/filters.go b/vendor/github.com/containers/common/libimage/filters.go
index 063f07149..f9f73f527 100644
--- a/vendor/github.com/containers/common/libimage/filters.go
+++ b/vendor/github.com/containers/common/libimage/filters.go
@@ -95,9 +95,15 @@ func (r *Runtime) compileImageFilters(ctx context.Context, options *ListImagesOp
for _, f := range options.Filters {
var key, value string
var filter filterFunc
- split := strings.SplitN(f, "=", 2)
- if len(split) != 2 {
- return nil, errors.Errorf("invalid image filter %q: must be in the format %q", f, "filter=value")
+ negate := false
+ split := strings.SplitN(f, "!=", 2)
+ if len(split) == 2 {
+ negate = true
+ } else {
+ split = strings.SplitN(f, "=", 2)
+ if len(split) != 2 {
+ return nil, errors.Errorf("invalid image filter %q: must be in the format %q", f, "filter=value or filter!=value")
+ }
}
key = split[0]
@@ -182,12 +188,22 @@ func (r *Runtime) compileImageFilters(ctx context.Context, options *ListImagesOp
default:
return nil, errors.Errorf("unsupported image filter %q", key)
}
+ if negate {
+ filter = negateFilter(filter)
+ }
filters[key] = append(filters[key], filter)
}
return filters, nil
}
+func negateFilter(f filterFunc) filterFunc {
+ return func(img *Image) (bool, error) {
+ b, err := f(img)
+ return !b, err
+ }
+}
+
func (r *Runtime) containers(duplicate map[string]string, key, value string, externalFunc IsExternalContainerFunc) error {
if exists, ok := duplicate[key]; ok && exists != value {
return errors.Errorf("specifying %q filter more than once with different values is not supported", key)
diff --git a/vendor/github.com/containers/common/pkg/config/containers.conf b/vendor/github.com/containers/common/pkg/config/containers.conf
index 1db2d704a..48ea8263b 100644
--- a/vendor/github.com/containers/common/pkg/config/containers.conf
+++ b/vendor/github.com/containers/common/pkg/config/containers.conf
@@ -133,10 +133,12 @@ default_sysctls = [
# Default way to to create an IPC namespace (POSIX SysV IPC) for the container
# Options are:
-# `private` Create private IPC Namespace for the container.
-# `host` Share host IPC Namespace with the container.
+# "host" Share host IPC Namespace with the container.
+# "none" Create shareable IPC Namespace for the container without a private /dev/shm.
+# "private" Create private IPC Namespace for the container, other containers are not allowed to share it.
+# "shareable" Create shareable IPC Namespace for the container.
#
-#ipcns = "private"
+#ipcns = "shareable"
# keyring tells the container engine whether to create
# a kernel keyring for use within the container.
diff --git a/vendor/github.com/containers/common/pkg/config/default.go b/vendor/github.com/containers/common/pkg/config/default.go
index 3255cff9d..14858e967 100644
--- a/vendor/github.com/containers/common/pkg/config/default.go
+++ b/vendor/github.com/containers/common/pkg/config/default.go
@@ -205,7 +205,7 @@ func DefaultConfig() (*Config, error) {
HTTPProxy: true,
Init: false,
InitPath: "",
- IPCNS: "private",
+ IPCNS: "shareable",
LogDriver: defaultLogDriver(),
LogSizeMax: DefaultLogSizeMax,
NetNS: "private",
diff --git a/vendor/github.com/containers/common/pkg/seccomp/default_linux.go b/vendor/github.com/containers/common/pkg/seccomp/default_linux.go
index fbf10ca31..3712afc71 100644
--- a/vendor/github.com/containers/common/pkg/seccomp/default_linux.go
+++ b/vendor/github.com/containers/common/pkg/seccomp/default_linux.go
@@ -169,6 +169,7 @@ func DefaultProfile() *Seccomp {
"futex",
"futex_time64",
"futimesat",
+ "get_mempolicy",
"get_robust_list",
"get_thread_area",
"getcpu",
@@ -184,7 +185,6 @@ func DefaultProfile() *Seccomp {
"getgroups",
"getgroups32",
"getitimer",
- "get_mempolicy",
"getpeername",
"getpgid",
"getpgrp",
@@ -274,9 +274,9 @@ func DefaultProfile() *Seccomp {
"nanosleep",
"newfstatat",
"open",
+ "open_tree",
"openat",
"openat2",
- "open_tree",
"pause",
"pidfd_getfd",
"pidfd_open",
@@ -296,8 +296,11 @@ func DefaultProfile() *Seccomp {
"preadv2",
"prlimit64",
"process_mrelease",
+ "process_vm_readv",
+ "process_vm_writev",
"pselect6",
"pselect6_time64",
+ "ptrace",
"pwrite64",
"pwritev",
"pwritev2",
@@ -356,7 +359,6 @@ func DefaultProfile() *Seccomp {
"sendmmsg",
"sendmsg",
"sendto",
- "setns",
"set_mempolicy",
"set_robust_list",
"set_thread_area",
@@ -370,6 +372,7 @@ func DefaultProfile() *Seccomp {
"setgroups",
"setgroups32",
"setitimer",
+ "setns",
"setpgid",
"setpriority",
"setregid",
@@ -527,10 +530,10 @@ func DefaultProfile() *Seccomp {
Names: []string{
"arm_fadvise64_64",
"arm_sync_file_range",
- "sync_file_range2",
"breakpoint",
"cacheflush",
"set_tls",
+ "sync_file_range2",
},
Action: ActAllow,
Args: []*Arg{},
@@ -653,8 +656,8 @@ func DefaultProfile() *Seccomp {
{
Names: []string{
"delete_module",
- "init_module",
"finit_module",
+ "init_module",
"query_module",
},
Action: ActAllow,
@@ -666,8 +669,8 @@ func DefaultProfile() *Seccomp {
{
Names: []string{
"delete_module",
- "init_module",
"finit_module",
+ "init_module",
"query_module",
},
Action: ActErrno,
@@ -704,9 +707,6 @@ func DefaultProfile() *Seccomp {
Names: []string{
"kcmp",
"process_madvise",
- "process_vm_readv",
- "process_vm_writev",
- "ptrace",
},
Action: ActAllow,
Args: []*Arg{},
@@ -718,9 +718,6 @@ func DefaultProfile() *Seccomp {
Names: []string{
"kcmp",
"process_madvise",
- "process_vm_readv",
- "process_vm_writev",
- "ptrace",
},
Action: ActErrno,
Errno: "EPERM",
@@ -732,8 +729,8 @@ func DefaultProfile() *Seccomp {
},
{
Names: []string{
- "iopl",
"ioperm",
+ "iopl",
},
Action: ActAllow,
Args: []*Arg{},
@@ -743,8 +740,8 @@ func DefaultProfile() *Seccomp {
},
{
Names: []string{
- "iopl",
"ioperm",
+ "iopl",
},
Action: ActErrno,
Errno: "EPERM",
@@ -756,10 +753,10 @@ func DefaultProfile() *Seccomp {
},
{
Names: []string{
- "settimeofday",
- "stime",
"clock_settime",
"clock_settime64",
+ "settimeofday",
+ "stime",
},
Action: ActAllow,
Args: []*Arg{},
@@ -769,10 +766,10 @@ func DefaultProfile() *Seccomp {
},
{
Names: []string{
- "settimeofday",
- "stime",
"clock_settime",
"clock_settime64",
+ "settimeofday",
+ "stime",
},
Action: ActErrno,
Errno: "EPERM",
diff --git a/vendor/github.com/containers/common/pkg/seccomp/seccomp.json b/vendor/github.com/containers/common/pkg/seccomp/seccomp.json
index 793f9bdac..442632e7d 100644
--- a/vendor/github.com/containers/common/pkg/seccomp/seccomp.json
+++ b/vendor/github.com/containers/common/pkg/seccomp/seccomp.json
@@ -176,6 +176,7 @@
"futex",
"futex_time64",
"futimesat",
+ "get_mempolicy",
"get_robust_list",
"get_thread_area",
"getcpu",
@@ -191,7 +192,6 @@
"getgroups",
"getgroups32",
"getitimer",
- "get_mempolicy",
"getpeername",
"getpgid",
"getpgrp",
@@ -281,9 +281,9 @@
"nanosleep",
"newfstatat",
"open",
+ "open_tree",
"openat",
"openat2",
- "open_tree",
"pause",
"pidfd_getfd",
"pidfd_open",
@@ -303,8 +303,11 @@
"preadv2",
"prlimit64",
"process_mrelease",
+ "process_vm_readv",
+ "process_vm_writev",
"pselect6",
"pselect6_time64",
+ "ptrace",
"pwrite64",
"pwritev",
"pwritev2",
@@ -363,7 +366,6 @@
"sendmmsg",
"sendmsg",
"sendto",
- "setns",
"set_mempolicy",
"set_robust_list",
"set_thread_area",
@@ -377,6 +379,7 @@
"setgroups",
"setgroups32",
"setitimer",
+ "setns",
"setpgid",
"setpriority",
"setregid",
@@ -571,10 +574,10 @@
"names": [
"arm_fadvise64_64",
"arm_sync_file_range",
- "sync_file_range2",
"breakpoint",
"cacheflush",
- "set_tls"
+ "set_tls",
+ "sync_file_range2"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
@@ -742,8 +745,8 @@
{
"names": [
"delete_module",
- "init_module",
"finit_module",
+ "init_module",
"query_module"
],
"action": "SCMP_ACT_ALLOW",
@@ -759,8 +762,8 @@
{
"names": [
"delete_module",
- "init_module",
"finit_module",
+ "init_module",
"query_module"
],
"action": "SCMP_ACT_ERRNO",
@@ -808,10 +811,7 @@
{
"names": [
"kcmp",
- "process_madvise",
- "process_vm_readv",
- "process_vm_writev",
- "ptrace"
+ "process_madvise"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
@@ -826,10 +826,7 @@
{
"names": [
"kcmp",
- "process_madvise",
- "process_vm_readv",
- "process_vm_writev",
- "ptrace"
+ "process_madvise"
],
"action": "SCMP_ACT_ERRNO",
"args": [],
@@ -845,8 +842,8 @@
},
{
"names": [
- "iopl",
- "ioperm"
+ "ioperm",
+ "iopl"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
@@ -860,8 +857,8 @@
},
{
"names": [
- "iopl",
- "ioperm"
+ "ioperm",
+ "iopl"
],
"action": "SCMP_ACT_ERRNO",
"args": [],
@@ -877,10 +874,10 @@
},
{
"names": [
- "settimeofday",
- "stime",
"clock_settime",
- "clock_settime64"
+ "clock_settime64",
+ "settimeofday",
+ "stime"
],
"action": "SCMP_ACT_ALLOW",
"args": [],
@@ -894,10 +891,10 @@
},
{
"names": [
- "settimeofday",
- "stime",
"clock_settime",
- "clock_settime64"
+ "clock_settime64",
+ "settimeofday",
+ "stime"
],
"action": "SCMP_ACT_ERRNO",
"args": [],