defaults_linux.go 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176
  1. package oci
  2. import (
  3. "os"
  4. "runtime"
  5. "github.com/opencontainers/runtime-spec/specs-go"
  6. )
  7. func iPtr(i int64) *int64 { return &i }
  8. func u32Ptr(i int64) *uint32 { u := uint32(i); return &u }
  9. func fmPtr(i int64) *os.FileMode { fm := os.FileMode(i); return &fm }
  10. func defaultCapabilities() []string {
  11. return []string{
  12. "CAP_CHOWN",
  13. "CAP_DAC_OVERRIDE",
  14. "CAP_FSETID",
  15. "CAP_FOWNER",
  16. "CAP_MKNOD",
  17. "CAP_NET_RAW",
  18. "CAP_SETGID",
  19. "CAP_SETUID",
  20. "CAP_SETFCAP",
  21. "CAP_SETPCAP",
  22. "CAP_NET_BIND_SERVICE",
  23. "CAP_SYS_CHROOT",
  24. "CAP_KILL",
  25. "CAP_AUDIT_WRITE",
  26. }
  27. }
  28. // DefaultSpec returns default oci spec used by docker.
  29. func DefaultSpec() specs.Spec {
  30. s := specs.Spec{
  31. Version: specs.Version,
  32. Platform: specs.Platform{
  33. OS: runtime.GOOS,
  34. Arch: runtime.GOARCH,
  35. },
  36. }
  37. s.Mounts = []specs.Mount{
  38. {
  39. Destination: "/proc",
  40. Type: "proc",
  41. Source: "proc",
  42. Options: []string{"nosuid", "noexec", "nodev"},
  43. },
  44. {
  45. Destination: "/dev",
  46. Type: "tmpfs",
  47. Source: "tmpfs",
  48. Options: []string{"nosuid", "strictatime", "mode=755"},
  49. },
  50. {
  51. Destination: "/dev/pts",
  52. Type: "devpts",
  53. Source: "devpts",
  54. Options: []string{"nosuid", "noexec", "newinstance", "ptmxmode=0666", "mode=0620", "gid=5"},
  55. },
  56. {
  57. Destination: "/sys",
  58. Type: "sysfs",
  59. Source: "sysfs",
  60. Options: []string{"nosuid", "noexec", "nodev", "ro"},
  61. },
  62. {
  63. Destination: "/sys/fs/cgroup",
  64. Type: "cgroup",
  65. Source: "cgroup",
  66. Options: []string{"ro", "nosuid", "noexec", "nodev"},
  67. },
  68. {
  69. Destination: "/dev/mqueue",
  70. Type: "mqueue",
  71. Source: "mqueue",
  72. Options: []string{"nosuid", "noexec", "nodev"},
  73. },
  74. }
  75. s.Process.Capabilities = &specs.LinuxCapabilities{
  76. Bounding: defaultCapabilities(),
  77. Permitted: defaultCapabilities(),
  78. Inheritable: defaultCapabilities(),
  79. Effective: defaultCapabilities(),
  80. }
  81. s.Linux = &specs.Linux{
  82. MaskedPaths: []string{
  83. "/proc/kcore",
  84. "/proc/latency_stats",
  85. "/proc/timer_list",
  86. "/proc/timer_stats",
  87. "/proc/sched_debug",
  88. "/sys/firmware",
  89. },
  90. ReadonlyPaths: []string{
  91. "/proc/asound",
  92. "/proc/bus",
  93. "/proc/fs",
  94. "/proc/irq",
  95. "/proc/sys",
  96. "/proc/sysrq-trigger",
  97. },
  98. Namespaces: []specs.LinuxNamespace{
  99. {Type: "mount"},
  100. {Type: "network"},
  101. {Type: "uts"},
  102. {Type: "pid"},
  103. {Type: "ipc"},
  104. },
  105. // Devices implicitly contains the following devices:
  106. // null, zero, full, random, urandom, tty, console, and ptmx.
  107. // ptmx is a bind-mount or symlink of the container's ptmx.
  108. // See also: https://github.com/opencontainers/runtime-spec/blob/master/config-linux.md#default-devices
  109. Devices: []specs.LinuxDevice{},
  110. Resources: &specs.LinuxResources{
  111. Devices: []specs.LinuxDeviceCgroup{
  112. {
  113. Allow: false,
  114. Access: "rwm",
  115. },
  116. {
  117. Allow: true,
  118. Type: "c",
  119. Major: iPtr(1),
  120. Minor: iPtr(5),
  121. Access: "rwm",
  122. },
  123. {
  124. Allow: true,
  125. Type: "c",
  126. Major: iPtr(1),
  127. Minor: iPtr(3),
  128. Access: "rwm",
  129. },
  130. {
  131. Allow: true,
  132. Type: "c",
  133. Major: iPtr(1),
  134. Minor: iPtr(9),
  135. Access: "rwm",
  136. },
  137. {
  138. Allow: true,
  139. Type: "c",
  140. Major: iPtr(1),
  141. Minor: iPtr(8),
  142. Access: "rwm",
  143. },
  144. {
  145. Allow: true,
  146. Type: "c",
  147. Major: iPtr(5),
  148. Minor: iPtr(0),
  149. Access: "rwm",
  150. },
  151. {
  152. Allow: true,
  153. Type: "c",
  154. Major: iPtr(5),
  155. Minor: iPtr(1),
  156. Access: "rwm",
  157. },
  158. {
  159. Allow: false,
  160. Type: "c",
  161. Major: iPtr(10),
  162. Minor: iPtr(229),
  163. Access: "rwm",
  164. },
  165. },
  166. },
  167. }
  168. return s
  169. }