mirror of
https://github.com/containers/skopeo.git
synced 2025-10-22 11:44:05 +00:00
b46d16f48c
This change fixes skopeo usage in restricted environment such as bubblewrap where it doesn't need extra capabilities or user namespace to perform its action. Close #649 Signed-off-by: Tristan Cacqueray <tdecacqu@redhat.com>
47 lines
1.3 KiB
Go
47 lines
1.3 KiB
Go
package main
|
|
|
|
import (
|
|
"github.com/containers/buildah/pkg/unshare"
|
|
"github.com/containers/image/storage"
|
|
"github.com/containers/image/transports/alltransports"
|
|
"github.com/pkg/errors"
|
|
"github.com/syndtr/gocapability/capability"
|
|
)
|
|
|
|
var neededCapabilities = []capability.Cap{
|
|
capability.CAP_CHOWN,
|
|
capability.CAP_DAC_OVERRIDE,
|
|
capability.CAP_FOWNER,
|
|
capability.CAP_FSETID,
|
|
capability.CAP_MKNOD,
|
|
capability.CAP_SETFCAP,
|
|
}
|
|
|
|
func maybeReexec() error {
|
|
// With Skopeo we need only the subset of the root capabilities necessary
|
|
// for pulling an image to the storage. Do not attempt to create a namespace
|
|
// if we already have the capabilities we need.
|
|
capabilities, err := capability.NewPid(0)
|
|
if err != nil {
|
|
return errors.Wrapf(err, "error reading the current capabilities sets")
|
|
}
|
|
for _, cap := range neededCapabilities {
|
|
if !capabilities.Get(capability.EFFECTIVE, cap) {
|
|
// We miss a capability we need, create a user namespaces
|
|
unshare.MaybeReexecUsingUserNamespace(true)
|
|
return nil
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func reexecIfNecessaryForImages(imageNames ...string) error {
|
|
// Check if container-storage are used before doing unshare
|
|
for _, imageName := range imageNames {
|
|
if alltransports.TransportFromImageName(imageName).Name() == storage.Transport.Name() {
|
|
return maybeReexec()
|
|
}
|
|
}
|
|
return nil
|
|
}
|