docker
/
docs
mirror of https://github.com/docker/docs.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Generate capabilityList automatically 

Generation based on CAP_LAST_CAP, I hardcoded
capability.CAP_BLOCK_SUSPEND as last for systems which has no
/proc/sys/kernel/cap_last_cap

Signed-off-by: Alexander Morozov <lk4d4@docker.com>
This commit is contained in:
Alexander Morozov 2015-05-08 09:40:05 -07:00
parent 5a2d592c27
commit a559c1145a
1 changed files with 19 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
daemon/execdriver/utils.go
View File

@ -8,44 +8,25 @@ import (
"github.com/syndtr/gocapability/capability" "github.com/syndtr/gocapability/capability"
) )
var capabilityList = Capabilities{ var capabilityList Capabilities
{Key: "SETPCAP", Value: capability.CAP_SETPCAP},
{Key: "SYS_MODULE", Value: capability.CAP_SYS_MODULE}, func init() {
{Key: "SYS_RAWIO", Value: capability.CAP_SYS_RAWIO}, last := capability.CAP_LAST_CAP
{Key: "SYS_PACCT", Value: capability.CAP_SYS_PACCT}, // hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
{Key: "SYS_ADMIN", Value: capability.CAP_SYS_ADMIN}, if last == capability.Cap(63) {
{Key: "SYS_NICE", Value: capability.CAP_SYS_NICE}, last = capability.CAP_BLOCK_SUSPEND
{Key: "SYS_RESOURCE", Value: capability.CAP_SYS_RESOURCE}, }
{Key: "SYS_TIME", Value: capability.CAP_SYS_TIME}, for _, cap := range capability.List() {
{Key: "SYS_TTY_CONFIG", Value: capability.CAP_SYS_TTY_CONFIG}, if cap > last {
{Key: "MKNOD", Value: capability.CAP_MKNOD}, continue
{Key: "AUDIT_WRITE", Value: capability.CAP_AUDIT_WRITE}, }
{Key: "AUDIT_CONTROL", Value: capability.CAP_AUDIT_CONTROL}, capabilityList = append(capabilityList,
{Key: "MAC_OVERRIDE", Value: capability.CAP_MAC_OVERRIDE}, &CapabilityMapping{
{Key: "MAC_ADMIN", Value: capability.CAP_MAC_ADMIN}, Key: strings.ToUpper(cap.String()),
{Key: "NET_ADMIN", Value: capability.CAP_NET_ADMIN}, Value: cap,
{Key: "SYSLOG", Value: capability.CAP_SYSLOG}, },
{Key: "CHOWN", Value: capability.CAP_CHOWN}, )
{Key: "NET_RAW", Value: capability.CAP_NET_RAW}, }
{Key: "DAC_OVERRIDE", Value: capability.CAP_DAC_OVERRIDE},
{Key: "FOWNER", Value: capability.CAP_FOWNER},
{Key: "DAC_READ_SEARCH", Value: capability.CAP_DAC_READ_SEARCH},
{Key: "FSETID", Value: capability.CAP_FSETID},
{Key: "KILL", Value: capability.CAP_KILL},
{Key: "SETGID", Value: capability.CAP_SETGID},
{Key: "SETUID", Value: capability.CAP_SETUID},
{Key: "LINUX_IMMUTABLE", Value: capability.CAP_LINUX_IMMUTABLE},
{Key: "NET_BIND_SERVICE", Value: capability.CAP_NET_BIND_SERVICE},
{Key: "NET_BROADCAST", Value: capability.CAP_NET_BROADCAST},
{Key: "IPC_LOCK", Value: capability.CAP_IPC_LOCK},
{Key: "IPC_OWNER", Value: capability.CAP_IPC_OWNER},
{Key: "SYS_CHROOT", Value: capability.CAP_SYS_CHROOT},
{Key: "SYS_PTRACE", Value: capability.CAP_SYS_PTRACE},
{Key: "SYS_BOOT", Value: capability.CAP_SYS_BOOT},
{Key: "LEASE", Value: capability.CAP_LEASE},
{Key: "SETFCAP", Value: capability.CAP_SETFCAP},
{Key: "WAKE_ALARM", Value: capability.CAP_WAKE_ALARM},
{Key: "BLOCK_SUSPEND", Value: capability.CAP_BLOCK_SUSPEND},
} }
type ( type (