bf242e249b
This uses "," instead of spaces so that the flags are parsed correctly and also does not do a strings.Split on an empty string because strings.Split will return a slice with one element, and empty string causing parsing to fail when it validates that the cap exists. Docker-DCO-1.1-Signed-off-by: Michael Crosby <michael@docker.com> (github: crosbymichael) Upstream-commit: 47917135daa38b40a1a3ee11f31153b031ea7963 Component: engine
64 lines
1.4 KiB
Go
64 lines
1.4 KiB
Go
package execdriver
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/docker/libcontainer/security/capabilities"
|
|
"github.com/dotcloud/docker/utils"
|
|
)
|
|
|
|
func TweakCapabilities(basics, adds, drops []string) ([]string, error) {
|
|
var (
|
|
newCaps []string
|
|
allCaps = capabilities.GetAllCapabilities()
|
|
)
|
|
|
|
// look for invalid cap in the drop list
|
|
for _, cap := range drops {
|
|
if strings.ToLower(cap) == "all" {
|
|
continue
|
|
}
|
|
if !utils.StringsContainsNoCase(allCaps, cap) {
|
|
return nil, fmt.Errorf("Unknown capability drop: %q", cap)
|
|
}
|
|
}
|
|
|
|
// handle --cap-add=all
|
|
if utils.StringsContainsNoCase(adds, "all") {
|
|
basics = capabilities.GetAllCapabilities()
|
|
}
|
|
|
|
if !utils.StringsContainsNoCase(drops, "all") {
|
|
for _, cap := range basics {
|
|
// skip `all` aready handled above
|
|
if strings.ToLower(cap) == "all" {
|
|
continue
|
|
}
|
|
|
|
// if we don't drop `all`, add back all the non-dropped caps
|
|
if !utils.StringsContainsNoCase(drops, cap) {
|
|
newCaps = append(newCaps, cap)
|
|
}
|
|
}
|
|
}
|
|
|
|
for _, cap := range adds {
|
|
// skip `all` aready handled above
|
|
if strings.ToLower(cap) == "all" {
|
|
continue
|
|
}
|
|
|
|
if !utils.StringsContainsNoCase(allCaps, cap) {
|
|
return nil, fmt.Errorf("Unknown capability to add: %q", cap)
|
|
}
|
|
|
|
// add cap if not already in the list
|
|
if !utils.StringsContainsNoCase(newCaps, cap) {
|
|
newCaps = append(newCaps, cap)
|
|
}
|
|
}
|
|
|
|
return newCaps, nil
|
|
}
|