Skip to content
This repository was archived by the owner on Dec 13, 2018. It is now read-only.

namespaces: allow to use pid namespace without mount namespace #358

Merged
vmarmol merged 2 commits into from
Feb 3, 2015
Merged

namespaces: allow to use pid namespace without mount namespace #358

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
444cc29
namespaces: allow to use pid namespace without mount namespace
avagin Jan 27, 2015
21c344a
update vendor/src/github.com/syndtr/gocapability/
avagin Feb 3, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 2 additions & 4 deletions security/capabilities/capabilities.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
package capabilities

import (
"os"

"github.com/syndtr/gocapability/capability"
)

Expand All @@ -11,7 +9,7 @@ const allCapabilityTypes = capability.CAPS | capability.BOUNDS
// DropBoundingSet drops the capability bounding set to those specified in the
// container configuration.
func DropBoundingSet(capabilities []string) error {
c, err := capability.NewPid(os.Getpid())
c, err := capability.NewPid(0)
Copy link
Contributor

@crosbymichael crosbymichael Feb 3, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

what does 0 mean here?

Copy link
Contributor Author

@avagin avagin Feb 3, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@crosbymichael Change capabilities of the calling process. os.Getpid() and 0 are the same except the case, when you try to access /proc from another pidns

Copy link
Contributor

@LK4D4 LK4D4 Feb 3, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems like drone failing because of this

Copy link
Contributor Author

@avagin avagin Feb 3, 2015

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@LK4D4 I have not commited changes in the vendor direcotry.

if err != nil {
return err
}
Expand All @@ -29,7 +27,7 @@ func DropBoundingSet(capabilities []string) error {

// DropCapabilities drops all capabilities for the current process except those specified in the container configuration.
func DropCapabilities(capList []string) error {
c, err := capability.NewPid(os.Getpid())
c, err := capability.NewPid(0)
if err != nil {
return err
}
Expand Down
2 changes: 1 addition & 1 deletion update-vendor.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,6 @@ clone() {
clone git github.com/codegangsta/cli 1.1.0
clone git github.com/coreos/go-systemd v2
clone git github.com/godbus/dbus v2
clone git github.com/syndtr/gocapability 3c85049eae
clone git github.com/syndtr/gocapability 1cf3ac4dc4

# intentionally not vendoring Docker itself... that'd be a circle :)
3 changes: 2 additions & 1 deletion vendor/src/github.com/syndtr/gocapability/capability/capability.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,8 @@ type Capabilities interface {
Apply(kind CapType) error
}

// NewPid create new initialized Capabilities object for given pid.
// NewPid create new initialized Capabilities object for given pid when it
// is nonzero, or for the current pid if pid is 0
func NewPid(pid int) (Capabilities, error) {
return newPid(pid)
}
Expand Down
10 changes: 9 additions & 1 deletion vendor/src/github.com/syndtr/gocapability/capability/capability_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -351,7 +351,15 @@ func (c *capsV3) Load() (err error) {
return
}

f, err := os.Open(fmt.Sprintf("/proc/%d/status", c.hdr.pid))
var status_path string

if c.hdr.pid == 0 {
status_path = fmt.Sprintf("/proc/self/status")
} else {
status_path = fmt.Sprintf("/proc/%d/status", c.hdr.pid)
}

f, err := os.Open(status_path)
if err != nil {
return
}
Expand Down