Skip to content

Commit 3f81b49

Browse files
tonistiigitonistiigi
committed
Define readonly/mask paths in spec
This vendors in new spec/runc that supports setting readonly and masked paths in the configuration. Using this allows us to make an exception for `—-privileged`. Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
1 parent 35268ee commit 3f81b49

File tree

13 files changed

+40
-20
lines changed

13 files changed

+40
-20
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -248,7 +248,7 @@ RUN set -x \
248248
&& rm -rf "$GOPATH"
249249

250250
# Install runc
251-
ENV RUNC_COMMIT 0c1c615ebd6a15545b6a82ead01d2745ea49b242
251+
ENV RUNC_COMMIT 6c88a526cdd74aab90cc88018368c452c7294a06
252252
RUN set -x \
253253
&& export GOPATH="$(mktemp -d)" \
254254
&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \

‎Dockerfile.aarch64‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ RUN set -x \
181181
&& rm -rf "$GOPATH"
182182

183183
# Install runc
184-
ENV RUNC_COMMIT 0c1c615ebd6a15545b6a82ead01d2745ea49b242
184+
ENV RUNC_COMMIT 6c88a526cdd74aab90cc88018368c452c7294a06
185185
RUN set -x \
186186
&& export GOPATH="$(mktemp -d)" \
187187
&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \

‎Dockerfile.armhf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ RUN set -x \
198198
&& rm -rf "$GOPATH"
199199

200200
# Install runc
201-
ENV RUNC_COMMIT 0c1c615ebd6a15545b6a82ead01d2745ea49b242
201+
ENV RUNC_COMMIT 6c88a526cdd74aab90cc88018368c452c7294a06
202202
RUN set -x \
203203
&& export GOPATH="$(mktemp -d)" \
204204
&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \

‎Dockerfile.gccgo‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -74,13 +74,12 @@ WORKDIR /go/src/github.com/docker/docker
7474
ENV DOCKER_BUILDTAGS apparmor seccomp selinux
7575

7676
# Install runc
77-
ENV RUNC_COMMIT 0c1c615ebd6a15545b6a82ead01d2745ea49b242
77+
ENV RUNC_COMMIT 6c88a526cdd74aab90cc88018368c452c7294a06
7878
RUN set -x \
7979
&& export GOPATH="$(mktemp -d)" \
8080
&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \
8181
&& cd "$GOPATH/src/github.com/opencontainers/runc" \
8282
&& git checkout -q "$RUNC_COMMIT" \
83-
&& (find . -name "*_ffjson.go" | xargs rm) \
8483
&& make static BUILDTAGS="seccomp apparmor selinux" \
8584
&& cp runc /usr/local/bin/docker-runc
8685

‎Dockerfile.ppc64le‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ RUN set -x \
196196
&& rm -rf "$GOPATH"
197197

198198
# Install runc
199-
ENV RUNC_COMMIT 0c1c615ebd6a15545b6a82ead01d2745ea49b242
199+
ENV RUNC_COMMIT 6c88a526cdd74aab90cc88018368c452c7294a06
200200
RUN set -x \
201201
&& export GOPATH="$(mktemp -d)" \
202202
&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \

‎Dockerfile.s390x‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ RUN set -x \
178178
&& rm -rf "$GOPATH"
179179

180180
# Install runc
181-
ENV RUNC_COMMIT 0c1c615ebd6a15545b6a82ead01d2745ea49b242
181+
ENV RUNC_COMMIT 6c88a526cdd74aab90cc88018368c452c7294a06
182182
RUN set -x \
183183
&& export GOPATH="$(mktemp -d)" \
184184
&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \

‎Dockerfile.simple‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ ENV GOPATH /go:/go/src/github.com/docker/docker/vendor
5757
ENV CGO_LDFLAGS -L/lib
5858

5959
# Install runc
60-
ENV RUNC_COMMIT 0c1c615ebd6a15545b6a82ead01d2745ea49b242
60+
ENV RUNC_COMMIT 6c88a526cdd74aab90cc88018368c452c7294a06
6161
RUN set -x \
6262
&& export GOPATH="$(mktemp -d)" \
6363
&& git clone https://github.com/opencontainers/runc.git "$GOPATH/src/github.com/opencontainers/runc" \

‎daemon/oci_linux.go‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -536,6 +536,8 @@ func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []c
536536
}
537537
}
538538
}
539+
s.Linux.ReadonlyPaths = nil
540+
s.Linux.MaskedPaths = nil
539541
}
540542

541543
// TODO: until a kernel/mount solution exists for handling remount in a user namespace,
@@ -660,10 +662,10 @@ func (daemon *Daemon) createSpec(c *container.Container) (*libcontainerd.Spec, e
660662

661663
if apparmor.IsEnabled() {
662664
appArmorProfile := "docker-default"
663-
if c.HostConfig.Privileged {
664-
appArmorProfile = "unconfined"
665-
} else if len(c.AppArmorProfile) > 0 {
665+
if len(c.AppArmorProfile) > 0 {
666666
appArmorProfile = c.AppArmorProfile
667+
} else if c.HostConfig.Privileged {
668+
appArmorProfile = "unconfined"
667669
}
668670
s.Process.ApparmorProfile = appArmorProfile
669671
}

‎hack/vendor.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -60,7 +60,7 @@ clone git github.com/docker/go v1.5.1-1-1-gbaf439e
6060
clone git github.com/agl/ed25519 d2b94fd789ea21d12fac1a4443dd3a3f79cda72c
6161

6262
clone git github.com/opencontainers/runc 2441732d6fcc0fb0a542671a4372e0c7bc99c19e # libcontainer
63-
clone git github.com/opencontainers/specs 3ce138b1934bf227a418e241ead496c383eaba1c # specs
63+
clone git github.com/opencontainers/specs 93ca97e83ca7fb4fba6d9e30d5470f99ddc02d11 # specs
6464
clone git github.com/seccomp/libseccomp-golang 1b506fc7c24eec5a3693cdcbed40d9c226cfc6a1
6565
# libcontainer deps (see src/github.com/opencontainers/runc/Godeps/Godeps.json)
6666
clone git github.com/coreos/go-systemd v4

‎integration-cli/docker_cli_run_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1106,7 +1106,7 @@ func (s *DockerSuite) TestRunProcNotWritableInNonPrivilegedContainers(c *check.C
11061106
func (s *DockerSuite) TestRunProcWritableInPrivilegedContainers(c *check.C) {
11071107
// Not applicable for Windows as there is no concept of --privileged
11081108
testRequires(c, DaemonIsLinux, NotUserNamespace)
1109-
if _, code := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "umount /proc/sysrq-trigger && touch /proc/sysrq-trigger"); code != 0 {
1109+
if _, code := dockerCmd(c, "run", "--privileged", "busybox", "sh", "-c", "touch /proc/sysrq-trigger"); code != 0 {
11101110
c.Fatalf("proc should be writable in privileged container")
11111111
}
11121112
}

0 commit comments

Comments
 (0)