Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

*: remove RHEL6 hack and loosen capability validation #359

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

cyphar
Copy link
Member

@cyphar cyphar commented Apr 11, 2017

The RHEL6 hack for CAP_LAST_CAP was causing us some annoyances, with the
inter-dependency of generate and validate only existing because of
CapValid (which then resulted in a bunch of build-time dependencies that
were never used by projects that vendored us).

To fix this issue, drop CapValid entirely so we don't have to touch it
anymore -- just assume that CAP_LAST_CAP works on all systems. And in
the case of validation we match new changes in the spec where
capabilities are now just plain strings (but for the HostSpecific case
we still do validation).

Fixes: 1a899a6 ("validate: optimize capabilites check")
Signed-off-by: Aleksa Sarai [email protected]

@cyphar cyphar force-pushed the generate-remove-validate-import branch from 5c1e0ab to cc52997 Compare April 11, 2017 13:42
// This is an exact copy of "validate/validate.go".lastCap.
func lastCap() capability.Cap {
last := capability.CAP_LAST_CAP
// hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sadly only some versions don't have it. That was back-ported at some point.

@Mashimiao
Copy link

I have moved them into common util package in #344

@cyphar
Copy link
Member Author

cyphar commented Apr 11, 2017

@Mashimiao Do you want to rebase that PR? In addition, this PR also removes the "validity" checks from generate because generate really shouldn't be checking the validity of it's arguments.

@wking
Copy link
Contributor

wking commented Apr 11, 2017 via email

@cyphar
Copy link
Member Author

cyphar commented Apr 11, 2017

@wking

So what is the use-case for “I want to set a known-invalid capability”?

As far as I'm aware the spec doesn't disallow you from defining your own "capabilities" that are not Linux capabilities. I could imagine that some cloud provider might require "capabilities" in order for you to access certain files or resources.

Sure, there's no reason that we must not check the validity of arguments we are provided, but the reason why generate is separate from validate is so that generation of a config is not conflated with its validation. At least, as a user that's what I would expect.

@wking
Copy link
Contributor

wking commented Apr 11, 2017 via email

@cyphar cyphar force-pushed the generate-remove-validate-import branch from cc52997 to 3d20a6a Compare July 15, 2017 11:28
@Mashimiao Mashimiao added this to the v0.6.0 milestone Sep 26, 2017
@cyphar
Copy link
Member Author

cyphar commented Sep 16, 2018

Since opencontainers/runtime-spec#766 was merged, now the strings are completely arbitrary and there's no need to do any validation. I'll rebase and remove validCap entirely then. I still feel that you could argue having an explicit "please tell me if I'm doing something wrong" validation is different from having an implicit "just add this value and don't ask too many questions" validation -- and so having different behaviour is justified. But I don't mind dropping it from both.

The RHEL6 hack for CAP_LAST_CAP was causing us some annoyances, with the
inter-dependency of generate and validate only existing because of
CapValid (which then resulted in a bunch of build-time dependencies that
were never used by projects that vendored us).

To fix this issue, drop CapValid entirely so we don't have to touch it
anymore -- just assume that CAP_LAST_CAP works on all systems. And in
the case of validation we match new changes in the spec where
capabilities are now just plain strings (but for the HostSpecific case
we still do validation).

Signed-off-by: Aleksa Sarai <[email protected]>
@cyphar cyphar force-pushed the generate-remove-validate-import branch from 3d20a6a to 24e0035 Compare September 16, 2018 13:21
@cyphar cyphar changed the title generate: remove validate dependency *: remove RHEL6 hack and loosen capability validation Sep 16, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants