mirror of
https://github.com/linuxkit/linuxkit.git
synced 2025-07-22 18:41:37 +00:00
Merge pull request #1496 from justincormack/all-caps
Allow setting capabilities to "all"
This commit is contained in:
commit
a7bda72430
@ -193,6 +193,49 @@ func ConfigInspectToOCI(image *MobyImage, inspect types.ImageInspect) ([]byte, e
|
|||||||
}
|
}
|
||||||
// TODO user, cgroup namespaces, maybe mount=host if useful
|
// TODO user, cgroup namespaces, maybe mount=host if useful
|
||||||
namespaces = append(namespaces, specs.LinuxNamespace{Type: specs.MountNamespace})
|
namespaces = append(namespaces, specs.LinuxNamespace{Type: specs.MountNamespace})
|
||||||
|
caps := image.Capabilities
|
||||||
|
if len(caps) == 1 && strings.ToLower(caps[0]) == "all" {
|
||||||
|
caps = []string{
|
||||||
|
"CAP_AUDIT_CONTROL",
|
||||||
|
"CAP_AUDIT_READ",
|
||||||
|
"CAP_AUDIT_WRITE",
|
||||||
|
"CAP_BLOCK_SUSPEND",
|
||||||
|
"CAP_CHOWN",
|
||||||
|
"CAP_DAC_OVERRIDE",
|
||||||
|
"CAP_DAC_READ_SEARCH",
|
||||||
|
"CAP_FOWNER",
|
||||||
|
"CAP_FSETID",
|
||||||
|
"CAP_IPC_LOCK",
|
||||||
|
"CAP_IPC_OWNER",
|
||||||
|
"CAP_KILL",
|
||||||
|
"CAP_LEASE",
|
||||||
|
"CAP_LINUX_IMMUTABLE",
|
||||||
|
"CAP_MAC_ADMIN",
|
||||||
|
"CAP_MAC_OVERRIDE",
|
||||||
|
"CAP_MKNOD",
|
||||||
|
"CAP_NET_ADMIN",
|
||||||
|
"CAP_NET_BIND_SERVICE",
|
||||||
|
"CAP_NET_BROADCAST",
|
||||||
|
"CAP_NET_RAW",
|
||||||
|
"CAP_SETFCAP",
|
||||||
|
"CAP_SETGID",
|
||||||
|
"CAP_SETPCAP",
|
||||||
|
"CAP_SETUID",
|
||||||
|
"CAP_SYSLOG",
|
||||||
|
"CAP_SYS_ADMIN",
|
||||||
|
"CAP_SYS_BOOT",
|
||||||
|
"CAP_SYS_CHROOT",
|
||||||
|
"CAP_SYS_MODULE",
|
||||||
|
"CAP_SYS_NICE",
|
||||||
|
"CAP_SYS_PACCT",
|
||||||
|
"CAP_SYS_PTRACE",
|
||||||
|
"CAP_SYS_RAWIO",
|
||||||
|
"CAP_SYS_RESOURCE",
|
||||||
|
"CAP_SYS_TIME",
|
||||||
|
"CAP_SYS_TTY_CONFIG",
|
||||||
|
"CAP_WAKE_ALARM",
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
oci.Version = specs.Version
|
oci.Version = specs.Version
|
||||||
|
|
||||||
@ -214,10 +257,10 @@ func ConfigInspectToOCI(image *MobyImage, inspect types.ImageInspect) ([]byte, e
|
|||||||
Env: env,
|
Env: env,
|
||||||
Cwd: cwd,
|
Cwd: cwd,
|
||||||
Capabilities: &specs.LinuxCapabilities{
|
Capabilities: &specs.LinuxCapabilities{
|
||||||
Bounding: image.Capabilities,
|
Bounding: caps,
|
||||||
Effective: image.Capabilities,
|
Effective: caps,
|
||||||
Inheritable: image.Capabilities,
|
Inheritable: caps,
|
||||||
Permitted: image.Capabilities,
|
Permitted: caps,
|
||||||
Ambient: []string{},
|
Ambient: []string{},
|
||||||
},
|
},
|
||||||
Rlimits: []specs.LinuxRlimit{},
|
Rlimits: []specs.LinuxRlimit{},
|
||||||
|
Loading…
Reference in New Issue
Block a user