Skip to content

Commit 01d1a78

Browse files
apostasieapostasie
committed
Replace indirect syndtr/gocapability
Signed-off-by: apostasie <spam_blackhole@farcloser.world>
1 parent 8d7539a commit 01d1a78

File tree

7 files changed

+386
-2
lines changed

7 files changed

+386
-2
lines changed

‎go.mod‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -152,3 +152,5 @@ require (
152152
)
153153

154154
replace github.com/containerd/nerdctl/mod/tigron v0.0.0 => ./mod/tigron
155+
156+
replace github.com/syndtr/gocapability => ./internal/replace/gocapability

‎go.sum‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -306,8 +306,6 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
306306
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
307307
github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
308308
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
309-
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
310-
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
311309
github.com/tinylib/msgp v1.2.0 h1:0uKB/662twsVBpYUPbokj4sTSKhWFKB7LopO2kWK8lY=
312310
github.com/tinylib/msgp v1.2.0/go.mod h1:2vIGs3lcUo8izAATNobrCHevYZC/LMsJtw4JPiYPHro=
313311
github.com/urfave/cli v1.19.1/go.mod h1:70zkFmudgCuE/ngEzBv17Jvp/497gISqfk5gWijbERA=

‎internal/replace/gocapability/LICENSE‎

Lines changed: 202 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,202 @@
1+
2+
Apache License
3+
Version 2.0, January 2004
4+
http://www.apache.org/licenses/
5+
6+
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
7+
8+
1. Definitions.
9+
10+
"License" shall mean the terms and conditions for use, reproduction,
11+
and distribution as defined by Sections 1 through 9 of this document.
12+
13+
"Licensor" shall mean the copyright owner or entity authorized by
14+
the copyright owner that is granting the License.
15+
16+
"Legal Entity" shall mean the union of the acting entity and all
17+
other entities that control, are controlled by, or are under common
18+
control with that entity. For the purposes of this definition,
19+
"control" means (i) the power, direct or indirect, to cause the
20+
direction or management of such entity, whether by contract or
21+
otherwise, or (ii) ownership of fifty percent (50%) or more of the
22+
outstanding shares, or (iii) beneficial ownership of such entity.
23+
24+
"You" (or "Your") shall mean an individual or Legal Entity
25+
exercising permissions granted by this License.
26+
27+
"Source" form shall mean the preferred form for making modifications,
28+
including but not limited to software source code, documentation
29+
source, and configuration files.
30+
31+
"Object" form shall mean any form resulting from mechanical
32+
transformation or translation of a Source form, including but
33+
not limited to compiled object code, generated documentation,
34+
and conversions to other media types.
35+
36+
"Work" shall mean the work of authorship, whether in Source or
37+
Object form, made available under the License, as indicated by a
38+
copyright notice that is included in or attached to the work
39+
(an example is provided in the Appendix below).
40+
41+
"Derivative Works" shall mean any work, whether in Source or Object
42+
form, that is based on (or derived from) the Work and for which the
43+
editorial revisions, annotations, elaborations, or other modifications
44+
represent, as a whole, an original work of authorship. For the purposes
45+
of this License, Derivative Works shall not include works that remain
46+
separable from, or merely link (or bind by name) to the interfaces of,
47+
the Work and Derivative Works thereof.
48+
49+
"Contribution" shall mean any work of authorship, including
50+
the original version of the Work and any modifications or additions
51+
to that Work or Derivative Works thereof, that is intentionally
52+
submitted to Licensor for inclusion in the Work by the copyright owner
53+
or by an individual or Legal Entity authorized to submit on behalf of
54+
the copyright owner. For the purposes of this definition, "submitted"
55+
means any form of electronic, verbal, or written communication sent
56+
to the Licensor or its representatives, including but not limited to
57+
communication on electronic mailing lists, source code control systems,
58+
and issue tracking systems that are managed by, or on behalf of, the
59+
Licensor for the purpose of discussing and improving the Work, but
60+
excluding communication that is conspicuously marked or otherwise
61+
designated in writing by the copyright owner as "Not a Contribution."
62+
63+
"Contributor" shall mean Licensor and any individual or Legal Entity
64+
on behalf of whom a Contribution has been received by Licensor and
65+
subsequently incorporated within the Work.
66+
67+
2. Grant of Copyright License. Subject to the terms and conditions of
68+
this License, each Contributor hereby grants to You a perpetual,
69+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
70+
copyright license to reproduce, prepare Derivative Works of,
71+
publicly display, publicly perform, sublicense, and distribute the
72+
Work and such Derivative Works in Source or Object form.
73+
74+
3. Grant of Patent License. Subject to the terms and conditions of
75+
this License, each Contributor hereby grants to You a perpetual,
76+
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
77+
(except as stated in this section) patent license to make, have made,
78+
use, offer to sell, sell, import, and otherwise transfer the Work,
79+
where such license applies only to those patent claims licensable
80+
by such Contributor that are necessarily infringed by their
81+
Contribution(s) alone or by combination of their Contribution(s)
82+
with the Work to which such Contribution(s) was submitted. If You
83+
institute patent litigation against any entity (including a
84+
cross-claim or counterclaim in a lawsuit) alleging that the Work
85+
or a Contribution incorporated within the Work constitutes direct
86+
or contributory patent infringement, then any patent licenses
87+
granted to You under this License for that Work shall terminate
88+
as of the date such litigation is filed.
89+
90+
4. Redistribution. You may reproduce and distribute copies of the
91+
Work or Derivative Works thereof in any medium, with or without
92+
modifications, and in Source or Object form, provided that You
93+
meet the following conditions:
94+
95+
(a) You must give any other recipients of the Work or
96+
Derivative Works a copy of this License; and
97+
98+
(b) You must cause any modified files to carry prominent notices
99+
stating that You changed the files; and
100+
101+
(c) You must retain, in the Source form of any Derivative Works
102+
that You distribute, all copyright, patent, trademark, and
103+
attribution notices from the Source form of the Work,
104+
excluding those notices that do not pertain to any part of
105+
the Derivative Works; and
106+
107+
(d) If the Work includes a "NOTICE" text file as part of its
108+
distribution, then any Derivative Works that You distribute must
109+
include a readable copy of the attribution notices contained
110+
within such NOTICE file, excluding those notices that do not
111+
pertain to any part of the Derivative Works, in at least one
112+
of the following places: within a NOTICE text file distributed
113+
as part of the Derivative Works; within the Source form or
114+
documentation, if provided along with the Derivative Works; or,
115+
within a display generated by the Derivative Works, if and
116+
wherever such third-party notices normally appear. The contents
117+
of the NOTICE file are for informational purposes only and
118+
do not modify the License. You may add Your own attribution
119+
notices within Derivative Works that You distribute, alongside
120+
or as an addendum to the NOTICE text from the Work, provided
121+
that such additional attribution notices cannot be construed
122+
as modifying the License.
123+
124+
You may add Your own copyright statement to Your modifications and
125+
may provide additional or different license terms and conditions
126+
for use, reproduction, or distribution of Your modifications, or
127+
for any such Derivative Works as a whole, provided Your use,
128+
reproduction, and distribution of the Work otherwise complies with
129+
the conditions stated in this License.
130+
131+
5. Submission of Contributions. Unless You explicitly state otherwise,
132+
any Contribution intentionally submitted for inclusion in the Work
133+
by You to the Licensor shall be under the terms and conditions of
134+
this License, without any additional terms or conditions.
135+
Notwithstanding the above, nothing herein shall supersede or modify
136+
the terms of any separate license agreement you may have executed
137+
with Licensor regarding such Contributions.
138+
139+
6. Trademarks. This License does not grant permission to use the trade
140+
names, trademarks, service marks, or product names of the Licensor,
141+
except as required for reasonable and customary use in describing the
142+
origin of the Work and reproducing the content of the NOTICE file.
143+
144+
7. Disclaimer of Warranty. Unless required by applicable law or
145+
agreed to in writing, Licensor provides the Work (and each
146+
Contributor provides its Contributions) on an "AS IS" BASIS,
147+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
148+
implied, including, without limitation, any warranties or conditions
149+
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
150+
PARTICULAR PURPOSE. You are solely responsible for determining the
151+
appropriateness of using or redistributing the Work and assume any
152+
risks associated with Your exercise of permissions under this License.
153+
154+
8. Limitation of Liability. In no event and under no legal theory,
155+
whether in tort (including negligence), contract, or otherwise,
156+
unless required by applicable law (such as deliberate and grossly
157+
negligent acts) or agreed to in writing, shall any Contributor be
158+
liable to You for damages, including any direct, indirect, special,
159+
incidental, or consequential damages of any character arising as a
160+
result of this License or out of the use or inability to use the
161+
Work (including but not limited to damages for loss of goodwill,
162+
work stoppage, computer failure or malfunction, or any and all
163+
other commercial damages or losses), even if such Contributor
164+
has been advised of the possibility of such damages.
165+
166+
9. Accepting Warranty or Additional Liability. While redistributing
167+
the Work or Derivative Works thereof, You may choose to offer,
168+
and charge a fee for, acceptance of support, warranty, indemnity,
169+
or other liability obligations and/or rights consistent with this
170+
License. However, in accepting such obligations, You may act only
171+
on Your own behalf and on Your sole responsibility, not on behalf
172+
of any other Contributor, and only if You agree to indemnify,
173+
defend, and hold each Contributor harmless for any liability
174+
incurred by, or claims asserted against, such Contributor by reason
175+
of your accepting any such warranty or additional liability.
176+
177+
END OF TERMS AND CONDITIONS
178+
179+
APPENDIX: How to apply the Apache License to your work.
180+
181+
To apply the Apache License to your work, attach the following
182+
boilerplate notice, with the fields enclosed by brackets "[]"
183+
replaced with your own identifying information. (Don't include
184+
the brackets!) The text should be enclosed in the appropriate
185+
comment syntax for the file format. We also recommend that a
186+
file or class name and description of purpose be included on the
187+
same "printed page" as the copyright notice for easier
188+
identification within third-party archives.
189+
190+
Copyright [yyyy] [name of copyright owner]
191+
192+
Licensed under the Apache License, Version 2.0 (the "License");
193+
you may not use this file except in compliance with the License.
194+
You may obtain a copy of the License at
195+
196+
http://www.apache.org/licenses/LICENSE-2.0
197+
198+
Unless required by applicable law or agreed to in writing, software
199+
distributed under the License is distributed on an "AS IS" BASIS,
200+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
201+
See the License for the specific language governing permissions and
202+
limitations under the License.

‎internal/replace/gocapability/README.md‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# ./gocapability
2+
3+
`./gocapability` is a replacement for https://github.com/syndtr/gocapability providing just
4+
what is currently required to fulfill:
5+
- https://github.com/cncf-tags/container-device-interface
6+
- via https://github.com/opencontainers/runtime-tools
7+
(originally added as a dependency in the early days of opencontainers by RH Patel:
8+
https://github.com/opencontainers/runtime-tools/commit/b462307c920f3a3e4f9a294ebf716f160a08ed44#diff-daddc66424f674dc57b411e63fce1f1bd231a27a77e39d25c781b4a8ca6f6062)
9+
10+
The original repository unfortunately makes unnecessary use of `init()`, resulting
11+
in systematically attempting to open and read `/proc/sys/kernel/cap_last_cap`
12+
even (especially) when not required.
13+
14+
This issue affects any project linking it (runc, containerd, etc).
15+
16+
It has been reported a year ago without reaction from the maintainer
17+
(https://github.com/syndtr/gocapability/issues/26), and the project
18+
looks very much abandoned at this point (maintainer seem to have all but vanished into crypto circa 2022).
19+
20+
While the performance impact is likely marginal, the security impact, less so:
21+
for `gomodjail` to work, `gocapability` would have to be marked as unconfined,
22+
which is made even more problematic precisely because it seems abandoned
23+
(hence more likely to be taken over).
24+
25+
As far as nerdctl is concerned, the only thing that we actually need from it is the static list of linux capabilities
26+
and consts, which this is providing.

‎internal/replace/gocapability/capability/list.go‎

Lines changed: 126 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,126 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package capability
18+
19+
type Cap int
20+
21+
var capabilities = []string{
22+
"chown",
23+
"dac_override",
24+
"dac_read_search",
25+
"fowner",
26+
"fsetid",
27+
"kill",
28+
"setgid",
29+
"setuid",
30+
"setpcap",
31+
"linux_immutable",
32+
"net_bind_service",
33+
"net_broadcast",
34+
"net_admin",
35+
"net_raw",
36+
"ipc_lock",
37+
"ipc_owner",
38+
"sys_module",
39+
"sys_rawio",
40+
"sys_chroot",
41+
"sys_ptrace",
42+
"sys_pacct",
43+
"sys_admin",
44+
"sys_boot",
45+
"sys_nice",
46+
"sys_resource",
47+
"sys_time",
48+
"sys_tty_config",
49+
"mknod",
50+
"lease",
51+
"audit_write",
52+
"audit_control",
53+
"setfcap",
54+
"mac_override",
55+
"mac_admin",
56+
"syslog",
57+
"wake_alarm",
58+
"block_suspend",
59+
"audit_read",
60+
"perfmon",
61+
"bpf",
62+
"checkpoint_restore",
63+
}
64+
65+
// From https://github.com/torvalds/linux/blob/master/include/uapi/linux/capability.h
66+
const (
67+
CAP_CHOWN Cap = iota
68+
CAP_DAC_OVERRIDE
69+
CAP_DAC_READ_SEARCH
70+
CAP_FOWNER
71+
CAP_FSETID
72+
CAP_KILL
73+
CAP_SETGID
74+
CAP_SETUID
75+
CAP_SETPCAP
76+
CAP_LINUX_IMMUTABLE
77+
CAP_NET_BIND_SERVICE
78+
CAP_NET_BROADCAST
79+
CAP_NET_ADMIN
80+
CAP_NET_RAW
81+
CAP_IPC_LOCK
82+
CAP_IPC_OWNER
83+
CAP_SYS_MODULE
84+
CAP_SYS_RAWIO
85+
CAP_SYS_CHROOT
86+
CAP_SYS_PTRACE
87+
CAP_SYS_PACCT
88+
CAP_SYS_ADMIN
89+
CAP_SYS_BOOT
90+
CAP_SYS_NICE
91+
CAP_SYS_RESOURCE
92+
CAP_SYS_TIME
93+
CAP_SYS_TTY_CONFIG
94+
CAP_MKNOD
95+
CAP_LEASE
96+
CAP_AUDIT_WRITE
97+
CAP_AUDIT_CONTROL
98+
CAP_SETFCAP
99+
CAP_MAC_OVERRIDE
100+
CAP_MAC_ADMIN
101+
CAP_SYSLOG
102+
CAP_WAKE_ALARM
103+
CAP_BLOCK_SUSPEND
104+
CAP_AUDIT_READ
105+
CAP_PERFMON
106+
CAP_BPF
107+
CAP_CHECKPOINT_RESTORE
108+
)
109+
110+
var CAP_LAST_CAP = Cap(63)
111+
112+
func (c Cap) String() string {
113+
if c < 0 || c > 40 {
114+
return "unknown"
115+
}
116+
117+
return capabilities[c]
118+
}
119+
120+
func List() []Cap {
121+
caps := make([]Cap, 40)
122+
for i := range 40 {
123+
caps[i] = Cap(i)
124+
}
125+
return caps
126+
}

‎internal/replace/gocapability/capability/list_test.go‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
Copyright The containerd Authors.
3+
4+
Licensed under the Apache License, Version 2.0 (the "License");
5+
you may not use this file except in compliance with the License.
6+
You may obtain a copy of the License at
7+
8+
http://www.apache.org/licenses/LICENSE-2.0
9+
10+
Unless required by applicable law or agreed to in writing, software
11+
distributed under the License is distributed on an "AS IS" BASIS,
12+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
See the License for the specific language governing permissions and
14+
limitations under the License.
15+
*/
16+
17+
package capability
18+
19+
import (
20+
"gotest.tools/v3/assert"
21+
"testing"
22+
)
23+
24+
func TestCapToString(t *testing.T) {
25+
// Just a sanity check
26+
assert.Equal(t, Cap(32).String(), "mac_override")
27+
}

0 commit comments

Comments
 (0)