mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-07-24 11:25:40 +00:00
ima: use ima-utils package instead of new init
Signed-off-by: Tycho Andersen <tycho@docker.com>
This commit is contained in:
parent
4b29c738e0
commit
3fd6337a45
@ -2,7 +2,7 @@
|
|||||||
run: ima-namespace-kernel
|
run: ima-namespace-kernel
|
||||||
../../bin/linuxkit run ima-namespace
|
../../bin/linuxkit run ima-namespace
|
||||||
|
|
||||||
ima-namespace-kernel:
|
ima-namespace-kernel: ima-namespace.yml
|
||||||
../../bin/moby build ima-namespace
|
../../bin/moby build ima-namespace
|
||||||
|
|
||||||
.PHONY: clean
|
.PHONY: clean
|
||||||
|
@ -1,26 +1,60 @@
|
|||||||
kernel:
|
kernel:
|
||||||
image: "linuxkit/kernel-ima:4.11.x"
|
image: "linuxkit/kernel-ima:4.11.1-"
|
||||||
cmdline: "console=ttyS0 page_poison=1 ima_appraise=enforce_ns"
|
cmdline: "console=ttyS0 console=tty0 page_poison=1 ima_appraise=enforce_ns"
|
||||||
init:
|
init:
|
||||||
- linuxkit/init-ima:1bf49efd6df8d137813884211860607c58ff383e
|
- linuxkit/init:b3740303f3d1e5689a84c87b7dfb48fd2a40a192
|
||||||
- mobylinux/runc:b0fb122e10dbb7e4e45115177a61a3f8d68c19a9
|
- linuxkit/runc:47b1c38d63468c0f3078f8b1b055d07965a1895d
|
||||||
- mobylinux/containerd:18eaf72f3f4f9a9f29ca1951f66df701f873060b
|
- linuxkit/containerd:cf2614f5a96c569a0bd4bd54e054a65ba17d167f
|
||||||
- mobylinux/ca-certificates:eabc5a6e59f05aa91529d80e9a595b85b046f935
|
- linuxkit/ca-certificates:3344cdca1bc59fdfa17bd7f0fcbf491b9dbaa288
|
||||||
|
- linuxkit/ima-utils:fe119c7dac08884f4144cd106dc279ddd8b37517
|
||||||
onboot:
|
onboot:
|
||||||
- name: sysctl
|
- name: sysctl
|
||||||
image: "mobylinux/sysctl:2cf2f9d5b4d314ba1bfc22b2fe931924af666d8c"
|
image: "linuxkit/sysctl:2cf2f9d5b4d314ba1bfc22b2fe931924af666d8c"
|
||||||
net: host
|
net: host
|
||||||
pid: host
|
pid: host
|
||||||
ipc: host
|
ipc: host
|
||||||
capabilities:
|
capabilities:
|
||||||
- CAP_SYS_ADMIN
|
- CAP_SYS_ADMIN
|
||||||
readonly: true
|
readonly: true
|
||||||
|
- name: binfmt
|
||||||
|
image: "linuxkit/binfmt:131026c0cf6084467316395fed3b358f64bda00c"
|
||||||
|
binds:
|
||||||
|
- /proc/sys/fs/binfmt_misc:/binfmt_misc
|
||||||
|
readonly: true
|
||||||
|
- name: dhcpcd
|
||||||
|
image: "linuxkit/dhcpcd:2def74ab3f9233b4c09ebb196ba47c27c08b0ed8"
|
||||||
|
binds:
|
||||||
|
- /var:/var
|
||||||
|
- /tmp/etc:/etc
|
||||||
|
capabilities:
|
||||||
|
- CAP_NET_ADMIN
|
||||||
|
- CAP_NET_BIND_SERVICE
|
||||||
|
- CAP_NET_RAW
|
||||||
|
net: host
|
||||||
|
command: ["/sbin/dhcpcd", "--nobackground", "-f", "/dhcpcd.conf", "-1"]
|
||||||
services:
|
services:
|
||||||
- name: rngd
|
- name: rngd
|
||||||
image: "mobylinux/rngd:3dad6dd43270fa632ac031e99d1947f20b22eec9"
|
image: "linuxkit/rngd:61a07ced77a9747708223ca16a4aec621eacf518"
|
||||||
capabilities:
|
capabilities:
|
||||||
- CAP_SYS_ADMIN
|
- CAP_SYS_ADMIN
|
||||||
oomScoreAdj: -800
|
oomScoreAdj: -800
|
||||||
readonly: true
|
readonly: true
|
||||||
|
- name: nginx
|
||||||
|
image: "nginx:alpine"
|
||||||
|
capabilities:
|
||||||
|
- CAP_NET_BIND_SERVICE
|
||||||
|
- CAP_CHOWN
|
||||||
|
- CAP_SETUID
|
||||||
|
- CAP_SETGID
|
||||||
|
- CAP_DAC_OVERRIDE
|
||||||
|
net: host
|
||||||
|
files:
|
||||||
|
- path: etc/docker/daemon.json
|
||||||
|
contents: '{"debug": true}'
|
||||||
|
trust:
|
||||||
|
image:
|
||||||
|
- linuxkit/kernel
|
||||||
|
- linuxkit/binfmt
|
||||||
|
- linuxkit/rngd
|
||||||
outputs:
|
outputs:
|
||||||
- format: kernel+initrd
|
- format: kernel+initrd
|
||||||
|
9
projects/ima-namespace/ima-utils/Dockerfile
Normal file
9
projects/ima-namespace/ima-utils/Dockerfile
Normal file
@ -0,0 +1,9 @@
|
|||||||
|
FROM alpine:edge as utils
|
||||||
|
RUN apk add --no-cache attr openssl
|
||||||
|
|
||||||
|
FROM scratch
|
||||||
|
ENTRYPOINT []
|
||||||
|
CMD []
|
||||||
|
WORKDIR /
|
||||||
|
COPY --from=utils /usr/bin/openssl /usr/bin/setfattr /usr/bin/
|
||||||
|
COPY --from=utils /lib/libattr.so* /lib/libssl.so* /lib/libcrypto.so* /lib/
|
@ -1,8 +1,8 @@
|
|||||||
.PHONY: tag push
|
.PHONY: tag push
|
||||||
default: push
|
default: push
|
||||||
|
|
||||||
IMAGE=init-ima
|
IMAGE=ima-utils
|
||||||
DEPS=Dockerfile init $(wildcard etc/*) $(wildcard etc/init.d/*)
|
DEPS=Dockerfile
|
||||||
|
|
||||||
HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
|
HASH?=$(shell git ls-tree HEAD -- ../$(notdir $(CURDIR)) | awk '{print $$3}')
|
||||||
|
|
@ -1,12 +0,0 @@
|
|||||||
# Use sha256 here to get a fixed version
|
|
||||||
FROM alpine:edge
|
|
||||||
ENTRYPOINT []
|
|
||||||
CMD []
|
|
||||||
WORKDIR /
|
|
||||||
COPY init /
|
|
||||||
COPY etc etc/
|
|
||||||
|
|
||||||
RUN ip a
|
|
||||||
RUN apk update
|
|
||||||
RUN apk add --no-cache attr openssl
|
|
||||||
RUN rm -rf /mirror /etc/apk/repositories /etc/apk/keys
|
|
@ -1,9 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
# bring up containerd
|
|
||||||
ulimit -n 1048576
|
|
||||||
ulimit -p unlimited
|
|
||||||
|
|
||||||
printf "\nStarting containerd\n"
|
|
||||||
mkdir -p /var/log
|
|
||||||
exec /usr/bin/containerd
|
|
@ -1,32 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
# start onboot containers, run to completion
|
|
||||||
|
|
||||||
if [ -d /containers/onboot ]
|
|
||||||
then
|
|
||||||
for f in $(find /containers/onboot -mindepth 1 -maxdepth 1 | sort)
|
|
||||||
do
|
|
||||||
base="$(basename $f)"
|
|
||||||
/bin/mount --bind "$f/rootfs" "$f/rootfs"
|
|
||||||
mount -o remount,rw "$f/rootfs"
|
|
||||||
/usr/bin/runc run --bundle "$f" "$(basename $f)"
|
|
||||||
printf " - $base\n"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
# start service containers
|
|
||||||
|
|
||||||
if [ -d /containers/services ]
|
|
||||||
then
|
|
||||||
for f in $(find /containers/services -mindepth 1 -maxdepth 1 | sort)
|
|
||||||
do
|
|
||||||
base="$(basename $f)"
|
|
||||||
/bin/mount --bind "$f/rootfs" "$f/rootfs"
|
|
||||||
mount -o remount,rw "$f/rootfs"
|
|
||||||
log="/var/log/$base.log"
|
|
||||||
ctr run --runtime-config "$f/config.json" --rootfs "$f/rootfs" --id "$(basename $f)" </dev/null 2>$log >$log &
|
|
||||||
printf " - $base\n"
|
|
||||||
done
|
|
||||||
fi
|
|
||||||
|
|
||||||
wait
|
|
@ -1,112 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
# mount filesystems
|
|
||||||
mount -n -t proc proc /proc -o nodev,nosuid,noexec,relatime
|
|
||||||
|
|
||||||
mount -n -t tmpfs tmpfs /run -o nodev,nosuid,noexec,relatime,size=10%,mode=755
|
|
||||||
mount -n -t tmpfs tmpfs /tmp -o nodev,nosuid,noexec,relatime,size=10%,mode=1777
|
|
||||||
|
|
||||||
# mount devfs
|
|
||||||
mount -n -t devtmpfs dev /dev -o nosuid,noexec,relatime,size=10m,nr_inodes=248418,mode=755
|
|
||||||
# devices
|
|
||||||
[ -c /dev/console ] || mknod -m 600 /dev/console c 5 1
|
|
||||||
[ -c /dev/tty1 ] || mknod -m 620 /dev/tty1 c 4 1
|
|
||||||
[ -c /dev/tty ] || mknod -m 666 /dev/tty c 5 0
|
|
||||||
|
|
||||||
[ -c /dev/null ] || mknod -m 666 /dev/null c 1 3
|
|
||||||
[ -c /dev/kmsg ] || mknod -m 660 /dev/kmsg c 1 11
|
|
||||||
|
|
||||||
# extra symbolic links not provided by default
|
|
||||||
[ -e /dev/fd ] || ln -snf /proc/self/fd /dev/fd
|
|
||||||
[ -e /dev/stdin ] || ln -snf /proc/self/fd/0 /dev/stdin
|
|
||||||
[ -e /dev/stdout ] || ln -snf /proc/self/fd/1 /dev/stdout
|
|
||||||
[ -e /dev/stderr ] || ln -snf /proc/self/fd/2 /dev/stderr
|
|
||||||
[ -e /proc/kcore ] && ln -snf /proc/kcore /dev/core
|
|
||||||
|
|
||||||
# devfs filesystems
|
|
||||||
mkdir -p -m 1777 /dev/mqueue
|
|
||||||
mkdir -p -m 1777 /dev/shm
|
|
||||||
mkdir -p -m 0755 /dev/pts
|
|
||||||
mount -n -t mqueue -o noexec,nosuid,nodev mqueue /dev/mqueue
|
|
||||||
mount -n -t tmpfs -o noexec,nosuid,nodev,mode=1777 shm /dev/shm
|
|
||||||
mount -n -t devpts -o noexec,nosuid,gid=5,mode=0620 devpts /dev/pts
|
|
||||||
|
|
||||||
# mount sysfs
|
|
||||||
sysfs_opts=nodev,noexec,nosuid
|
|
||||||
mount -n -t sysfs -o ${sysfs_opts} sysfs /sys
|
|
||||||
[ -d /sys/kernel/security ] && mount -n -t securityfs -o ${sysfs_opts} securityfs /sys/kernel/security
|
|
||||||
[ -d /sys/kernel/debug ] && mount -n -t debugfs -o ${sysfs_opts} debugfs /sys/kernel/debug
|
|
||||||
[ -d /sys/kernel/config ] && mount -n -t configfs -o ${sysfs_opts} configfs /sys/kernel/config
|
|
||||||
[ -d /sys/fs/fuse/connections ] && mount -n -t fusectl -o ${sysfs_opts} fusectl /sys/fs/fuse/connections
|
|
||||||
[ -d /sys/fs/selinux ] && mount -n -t selinuxfs -o nosuid,noexec selinuxfs /sys/fs/selinux
|
|
||||||
[ -d /sys/fs/pstore ] && mount -n -t pstore pstore -o ${sysfs_opts} /sys/fs/pstore
|
|
||||||
[ -d /sys/firmware/efi/efivars ] && mount -n -t efivarfs -o ro,${sysfs_opts} efivarfs /sys/firmware/efi/efivars
|
|
||||||
|
|
||||||
# misc /proc mounted fs
|
|
||||||
[ -d /proc/sys/fs/binfmt_misc ] && mount -t binfmt_misc -o nodev,noexec,nosuid binfmt_misc /proc/sys/fs/binfmt_misc
|
|
||||||
|
|
||||||
# mount cgroups
|
|
||||||
mount -n -t tmpfs -o nodev,noexec,nosuid,mode=755,size=10m cgroup_root /sys/fs/cgroup
|
|
||||||
|
|
||||||
while read name hier groups enabled rest
|
|
||||||
do
|
|
||||||
case "${enabled}" in
|
|
||||||
1) mkdir -p /sys/fs/cgroup/${name}
|
|
||||||
mount -n -t cgroup -o ${sysfs_opts},${name} ${name} /sys/fs/cgroup/${name}
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
done < /proc/cgroups
|
|
||||||
|
|
||||||
# use hierarchy for memory
|
|
||||||
echo 1 > /sys/fs/cgroup/memory/memory.use_hierarchy
|
|
||||||
|
|
||||||
# for compatibility
|
|
||||||
mkdir -p /sys/fs/cgroup/systemd
|
|
||||||
mount -t cgroup -o none,name=systemd cgroup /sys/fs/cgroup/systemd
|
|
||||||
|
|
||||||
# start mdev for hotplug
|
|
||||||
echo "/sbin/mdev" > /proc/sys/kernel/hotplug
|
|
||||||
|
|
||||||
# mdev -s will not create /dev/usb[1-9] devices with recent kernels
|
|
||||||
# so we trigger hotplug events for usb for now
|
|
||||||
for i in $(find /sys/devices -name 'usb[0-9]*'); do
|
|
||||||
[ -e $i/uevent ] && echo add > $i/uevent
|
|
||||||
done
|
|
||||||
|
|
||||||
mdev -s
|
|
||||||
|
|
||||||
# set hostname
|
|
||||||
if [ -s /etc/hostname ]
|
|
||||||
then
|
|
||||||
hostname -F /etc/hostname
|
|
||||||
fi
|
|
||||||
|
|
||||||
if [ $(hostname) = "(none)" -a -f /sys/class/net/eth0/address ]
|
|
||||||
then
|
|
||||||
mac=$(cat /sys/class/net/eth0/address)
|
|
||||||
hostname linuxkit-$(echo $mac | sed 's/://g')
|
|
||||||
fi
|
|
||||||
|
|
||||||
# set system clock from hwclock
|
|
||||||
hwclock --hctosys --utc
|
|
||||||
|
|
||||||
# bring up loopback interface
|
|
||||||
ip addr add 127.0.0.1/8 dev lo brd + scope host
|
|
||||||
ip route add 127.0.0.0/8 dev lo scope host
|
|
||||||
ip link set lo up
|
|
||||||
|
|
||||||
# for containerising dhcpcd and other containers that need writable etc
|
|
||||||
mkdir /tmp/etc
|
|
||||||
mv /etc/resolv.conf /tmp/etc/resolv.conf
|
|
||||||
ln -snf /tmp/etc/resolv.conf /etc/resolv.conf
|
|
||||||
|
|
||||||
# remount rootfs as readonly
|
|
||||||
mount -o remount,ro /
|
|
||||||
|
|
||||||
# make /var writeable and shared
|
|
||||||
mount -o bind /var /var
|
|
||||||
mount -o remount,rw,nodev,nosuid,noexec,relatime /var /var
|
|
||||||
mount --make-rshared /var
|
|
||||||
|
|
||||||
# make / rshared
|
|
||||||
mount --make-rshared /
|
|
@ -1,15 +0,0 @@
|
|||||||
# /etc/inittab
|
|
||||||
|
|
||||||
::sysinit:/etc/init.d/rcS
|
|
||||||
::once:/etc/init.d/containerd
|
|
||||||
::once:/etc/init.d/containers
|
|
||||||
|
|
||||||
# Stuff to do for the 3-finger salute
|
|
||||||
::ctrlaltdel:/sbin/reboot
|
|
||||||
|
|
||||||
# Stuff to do before rebooting
|
|
||||||
::shutdown:/usr/sbin/killall5 -15
|
|
||||||
::shutdown:/bin/sleep 5
|
|
||||||
::shutdown:/usr/sbin/killall5 -9
|
|
||||||
::shutdown:/bin/echo "Unmounting filesystems"
|
|
||||||
::shutdown:/bin/umount -a -r
|
|
@ -1,12 +0,0 @@
|
|||||||
|
|
||||||
Welcome to LinuxKit
|
|
||||||
|
|
||||||
## .
|
|
||||||
## ## ## ==
|
|
||||||
## ## ## ## ## ===
|
|
||||||
/"""""""""""""""""\___/ ===
|
|
||||||
~~~ {~~ ~~~~ ~~~ ~~~~ ~~~ ~ / ===- ~~~
|
|
||||||
\______ o __/
|
|
||||||
\ \ __/
|
|
||||||
\____\_______/
|
|
||||||
|
|
@ -1,45 +0,0 @@
|
|||||||
#!/bin/sh
|
|
||||||
|
|
||||||
setup_console() {
|
|
||||||
tty=${1%,*}
|
|
||||||
speed=${1#*,}
|
|
||||||
inittab="$2"
|
|
||||||
securetty="$3"
|
|
||||||
line=
|
|
||||||
term="linux"
|
|
||||||
[ "$speed" = "$1" ] && speed=115200
|
|
||||||
|
|
||||||
case "$tty" in
|
|
||||||
ttyS*|ttyAMA*|ttyUSB*|ttyMFD*)
|
|
||||||
line="-L"
|
|
||||||
term="vt100"
|
|
||||||
;;
|
|
||||||
tty?)
|
|
||||||
line=""
|
|
||||||
speed="38400"
|
|
||||||
term=""
|
|
||||||
;;
|
|
||||||
esac
|
|
||||||
# skip consoles already in inittab
|
|
||||||
grep -q "^$tty:" "$inittab" && return
|
|
||||||
|
|
||||||
echo "$tty::once:cat /etc/issue" >> "$inittab"
|
|
||||||
echo "$tty::respawn:/sbin/getty -n -l /bin/sh $line $speed $tty $term" >> "$inittab"
|
|
||||||
if ! grep -q -w "$tty" "$securetty"; then
|
|
||||||
echo "$tty" >> "$securetty"
|
|
||||||
fi
|
|
||||||
}
|
|
||||||
|
|
||||||
/bin/mount -t tmpfs tmpfs /mnt
|
|
||||||
|
|
||||||
/bin/cp -a / /mnt 2>/dev/null
|
|
||||||
|
|
||||||
/bin/mount -t proc -o noexec,nosuid,nodev proc /proc
|
|
||||||
for opt in $(cat /proc/cmdline); do
|
|
||||||
case "$opt" in
|
|
||||||
console=*)
|
|
||||||
setup_console ${opt#console=} /mnt/etc/inittab /mnt/etc/securetty;;
|
|
||||||
esac
|
|
||||||
done
|
|
||||||
|
|
||||||
exec /bin/busybox switch_root /mnt /sbin/init
|
|
Loading…
Reference in New Issue
Block a user