From b96be3af1b9d00662758211420c955becbaf2f9e Mon Sep 17 00:00:00 2001 From: baude Date: Wed, 20 Jun 2018 13:23:24 -0500 Subject: changes to allow for darwin compilation Signed-off-by: baude Closes: #1015 Approved by: baude --- pkg/spec/config_linux.go | 84 ++++++++++++++++++++++++++++++++++++++++++ pkg/spec/config_unsupported.go | 12 ++++++ pkg/spec/createconfig.go | 17 --------- pkg/spec/parse.go | 15 -------- pkg/spec/spec.go | 43 +++------------------ 5 files changed, 101 insertions(+), 70 deletions(-) create mode 100644 pkg/spec/config_linux.go create mode 100644 pkg/spec/config_unsupported.go (limited to 'pkg/spec') diff --git a/pkg/spec/config_linux.go b/pkg/spec/config_linux.go new file mode 100644 index 000000000..69b99232f --- /dev/null +++ b/pkg/spec/config_linux.go @@ -0,0 +1,84 @@ +// +build linux + +package createconfig + +import ( + "io/ioutil" + + "github.com/docker/docker/profiles/seccomp" + "github.com/opencontainers/runc/libcontainer/configs" + "github.com/opencontainers/runc/libcontainer/devices" + spec "github.com/opencontainers/runtime-spec/specs-go" + "github.com/opencontainers/runtime-tools/generate" + "github.com/pkg/errors" +) + +// Device transforms a libcontainer configs.Device to a specs.LinuxDevice object. +func Device(d *configs.Device) spec.LinuxDevice { + return spec.LinuxDevice{ + Type: string(d.Type), + Path: d.Path, + Major: d.Major, + Minor: d.Minor, + FileMode: fmPtr(int64(d.FileMode)), + UID: u32Ptr(int64(d.Uid)), + GID: u32Ptr(int64(d.Gid)), + } +} + +func addDevice(g *generate.Generator, device string) error { + dev, err := devices.DeviceFromPath(device, "rwm") + if err != nil { + return errors.Wrapf(err, "%s is not a valid device", device) + } + linuxdev := spec.LinuxDevice{ + Path: dev.Path, + Type: string(dev.Type), + Major: dev.Major, + Minor: dev.Minor, + FileMode: &dev.FileMode, + UID: &dev.Uid, + GID: &dev.Gid, + } + g.AddDevice(linuxdev) + g.AddLinuxResourcesDevice(true, string(dev.Type), &dev.Major, &dev.Minor, dev.Permissions) + return nil +} + +// AddPrivilegedDevices iterates through host devices and adds all +// host devices to the spec +func (c *CreateConfig) AddPrivilegedDevices(g *generate.Generator) error { + hostDevices, err := devices.HostDevices() + if err != nil { + return err + } + g.ClearLinuxDevices() + for _, d := range hostDevices { + g.AddDevice(Device(d)) + } + g.AddLinuxResourcesDevice(true, "", nil, nil, "rwm") + return nil +} + +func getSeccompConfig(config *CreateConfig, configSpec *spec.Spec) (*spec.LinuxSeccomp, error) { + var seccompConfig *spec.LinuxSeccomp + var err error + + if config.SeccompProfilePath != "" { + seccompProfile, err := ioutil.ReadFile(config.SeccompProfilePath) + if err != nil { + return nil, errors.Wrapf(err, "opening seccomp profile (%s) failed", config.SeccompProfilePath) + } + seccompConfig, err = seccomp.LoadProfile(string(seccompProfile), configSpec) + if err != nil { + return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", config.SeccompProfilePath) + } + } else { + seccompConfig, err = seccomp.GetDefaultProfile(configSpec) + if err != nil { + return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", config.SeccompProfilePath) + } + } + + return seccompConfig, nil +} diff --git a/pkg/spec/config_unsupported.go b/pkg/spec/config_unsupported.go new file mode 100644 index 000000000..b3b05acea --- /dev/null +++ b/pkg/spec/config_unsupported.go @@ -0,0 +1,12 @@ +// +build !linux + +package createconfig + +import ( + spec "github.com/opencontainers/runtime-spec/specs-go" + "github.com/pkg/errors" +) + +func getSeccompConfig(config *CreateConfig, configSpec *spec.Spec) (*spec.LinuxSeccomp, error) { + return nil, errors.New("function not supported on non-linux OS's") +} diff --git a/pkg/spec/createconfig.go b/pkg/spec/createconfig.go index 27df0c395..451c09eb3 100644 --- a/pkg/spec/createconfig.go +++ b/pkg/spec/createconfig.go @@ -10,9 +10,7 @@ import ( "github.com/cri-o/ocicni/pkg/ocicni" "github.com/docker/docker/api/types/container" "github.com/docker/go-connections/nat" - "github.com/opencontainers/runc/libcontainer/devices" spec "github.com/opencontainers/runtime-spec/specs-go" - "github.com/opencontainers/runtime-tools/generate" "github.com/opencontainers/selinux/go-selinux/label" "github.com/pkg/errors" "github.com/projectatomic/libpod/libpod" @@ -488,21 +486,6 @@ func (c *CreateConfig) CreatePortBindings() ([]ocicni.PortMapping, error) { return portBindings, nil } -// AddPrivilegedDevices iterates through host devices and adds all -// host devices to the spec -func (c *CreateConfig) AddPrivilegedDevices(g *generate.Generator) error { - hostDevices, err := devices.HostDevices() - if err != nil { - return err - } - g.ClearLinuxDevices() - for _, d := range hostDevices { - g.AddDevice(Device(d)) - } - g.AddLinuxResourcesDevice(true, "", nil, nil, "rwm") - return nil -} - func getStatFromPath(path string) (unix.Stat_t, error) { s := unix.Stat_t{} err := unix.Stat(path, &s) diff --git a/pkg/spec/parse.go b/pkg/spec/parse.go index 920674b10..82ca92dff 100644 --- a/pkg/spec/parse.go +++ b/pkg/spec/parse.go @@ -6,8 +6,6 @@ import ( "strings" "github.com/docker/go-units" - "github.com/opencontainers/runc/libcontainer/configs" - spec "github.com/opencontainers/runtime-spec/specs-go" ) // weightDevice is a structure that holds device:weight pair @@ -113,16 +111,3 @@ func getLoggingPath(opts []string) string { } return "" } - -// Device transforms a libcontainer configs.Device to a specs.LinuxDevice object. -func Device(d *configs.Device) spec.LinuxDevice { - return spec.LinuxDevice{ - Type: string(d.Type), - Path: d.Path, - Major: d.Major, - Minor: d.Minor, - FileMode: fmPtr(int64(d.FileMode)), - UID: u32Ptr(int64(d.Uid)), - GID: u32Ptr(int64(d.Gid)), - } -} diff --git a/pkg/spec/spec.go b/pkg/spec/spec.go index 2faa3c2cd..f9c60fdfa 100644 --- a/pkg/spec/spec.go +++ b/pkg/spec/spec.go @@ -6,14 +6,11 @@ import ( "github.com/docker/docker/daemon/caps" "github.com/docker/docker/pkg/mount" "github.com/docker/go-units" - "github.com/opencontainers/runc/libcontainer/devices" spec "github.com/opencontainers/runtime-spec/specs-go" "github.com/opencontainers/runtime-tools/generate" "github.com/pkg/errors" "github.com/projectatomic/libpod/pkg/rootless" - seccomp "github.com/seccomp/containers-golang" "github.com/sirupsen/logrus" - "io/ioutil" ) const cpuPeriod = 100000 @@ -236,24 +233,13 @@ func CreateConfigToOCISpec(config *CreateConfig) (*spec.Spec, error) { //nolint } // HANDLE SECCOMP + if config.SeccompProfilePath != "unconfined" { - if config.SeccompProfilePath != "" { - seccompProfile, err := ioutil.ReadFile(config.SeccompProfilePath) - if err != nil { - return nil, errors.Wrapf(err, "opening seccomp profile (%s) failed", config.SeccompProfilePath) - } - seccompConfig, err := seccomp.LoadProfile(string(seccompProfile), configSpec) - if err != nil { - return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", config.SeccompProfilePath) - } - configSpec.Linux.Seccomp = seccompConfig - } else { - seccompConfig, err := seccomp.GetDefaultProfile(configSpec) - if err != nil { - return nil, errors.Wrapf(err, "loading seccomp profile (%s) failed", config.SeccompProfilePath) - } - configSpec.Linux.Seccomp = seccompConfig + seccompConfig, err := getSeccompConfig(config, configSpec) + if err != nil { + return nil, err } + configSpec.Linux.Seccomp = seccompConfig } // Clear default Seccomp profile from Generator for privileged containers @@ -429,22 +415,3 @@ func setupCapabilities(config *CreateConfig, configSpec *spec.Spec) error { configSpec.Process.Capabilities.Bounding = caplist return nil } - -func addDevice(g *generate.Generator, device string) error { - dev, err := devices.DeviceFromPath(device, "rwm") - if err != nil { - return errors.Wrapf(err, "%s is not a valid device", device) - } - linuxdev := spec.LinuxDevice{ - Path: dev.Path, - Type: string(dev.Type), - Major: dev.Major, - Minor: dev.Minor, - FileMode: &dev.FileMode, - UID: &dev.Uid, - GID: &dev.Gid, - } - g.AddDevice(linuxdev) - g.AddLinuxResourcesDevice(true, string(dev.Type), &dev.Major, &dev.Minor, dev.Permissions) - return nil -} -- cgit v1.2.3-54-g00ecf