Skip to content

Commit fb002f5

Browse files
kunalkushwahakunalkushwaha
committed
security entitlement support
Signed-off-by: Kunal Kushwaha <[email protected]>
1 parent dee72e1 commit fb002f5

File tree

17 files changed

+110
-20
lines changed

17 files changed

+110
-20
lines changed

‎api/services/control/control.proto

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -62,11 +62,7 @@ message SolveRequest {
6262
string Frontend = 6;
6363
map<string, string> FrontendAttrs = 7;
6464
CacheOptions Cache = 8 [(gogoproto.nullable) = false];
65-
<<<<<<< af46188e9b3e8c78cfee8a223919498680276122
6665
repeated string Entitlements = 9 [(gogoproto.customtype) = "github.com/moby/buildkit/util/entitlements.Entitlement" ];
67-
=======
68-
repeated string Entitlements = 9 [(gogoproto.customtype) = "github.com/moby/buildkit/util/entitlements.Entitlement"];
69-
>>>>>>> proto defination
7066
}
7167

7268
message CacheOptions {

‎client/llb/exec.go

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ type Meta struct {
1818
ProxyEnv *ProxyEnv
1919
ExtraHosts []HostIP
2020
Network pb.NetMode
21+
Security pb.SecMode
2122
}
2223

2324
func NewExecOp(root Output, meta Meta, readOnly bool, c Constraints) *ExecOp {
@@ -526,3 +527,8 @@ const (
526527
NetModeHost = pb.NetMode_HOST
527528
NetModeNone = pb.NetMode_NONE
528529
)
530+
531+
const (
532+
SecurityModeUnconfined = pb.SecMode_UNCONFINED
533+
SecurityModeConfined = pb.SecMode_CONFINED
534+
)

‎client/llb/meta.go

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ var (
2121
keyExtraHost = contextKeyT("llb.exec.extrahost")
2222
keyPlatform = contextKeyT("llb.platform")
2323
keyNetwork = contextKeyT("llb.network")
24+
keySecurity = contextKeyT("llb.security")
2425
)
2526

2627
func addEnv(key, value string) StateOption {
@@ -152,7 +153,6 @@ func network(v pb.NetMode) StateOption {
152153
return s.WithValue(keyNetwork, v)
153154
}
154155
}
155-
156156
func getNetwork(s State) pb.NetMode {
157157
v := s.Value(keyNetwork)
158158
if v != nil {
@@ -162,6 +162,20 @@ func getNetwork(s State) pb.NetMode {
162162
return NetModeSandbox
163163
}
164164

165+
func security(v pb.SecMode) StateOption {
166+
return func(s State) State {
167+
return s.WithValue(keySecurity, v)
168+
}
169+
}
170+
func getSecurity(s State) pb.SecMode {
171+
v := s.Value(keySecurity)
172+
if v != nil {
173+
n := v.(pb.SecMode)
174+
return n
175+
}
176+
return SecurityModeConfined
177+
}
178+
165179
type EnvList []KeyValue
166180

167181
type KeyValue struct {

‎client/llb/state.go

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -189,6 +189,7 @@ func (s State) Run(ro ...RunOption) ExecState {
189189
ProxyEnv: ei.ProxyEnv,
190190
ExtraHosts: getExtraHosts(ei.State),
191191
Network: getNetwork(ei.State),
192+
Security: getSecurity(ei.State),
192193
}
193194

194195
exec := NewExecOp(s.Output(), meta, ei.ReadonlyRootFS, ei.Constraints)
@@ -257,6 +258,13 @@ func (s State) Network(n pb.NetMode) State {
257258
func (s State) GetNetwork() pb.NetMode {
258259
return getNetwork(s)
259260
}
261+
func (s State) Security(n pb.SecMode) State {
262+
return security(n)(s)
263+
}
264+
265+
func (s State) GetSecurity() pb.SecMode {
266+
return getSecurity(s)
267+
}
260268

261269
func (s State) With(so ...StateOption) State {
262270
for _, o := range so {

‎executor/containerdexecutor/executor.go

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ import (
88

99
"github.com/containerd/containerd"
1010
"github.com/containerd/containerd/cio"
11-
"github.com/containerd/containerd/contrib/seccomp"
1211
containerdoci "github.com/containerd/containerd/oci"
1312
"github.com/moby/buildkit/cache"
1413
"github.com/moby/buildkit/executor"
@@ -17,7 +16,6 @@ import (
1716
"github.com/moby/buildkit/snapshot"
1817
"github.com/moby/buildkit/solver/pb"
1918
"github.com/moby/buildkit/util/network"
20-
"github.com/moby/buildkit/util/system"
2119
"github.com/pkg/errors"
2220
"github.com/sirupsen/logrus"
2321
)
@@ -105,9 +103,7 @@ func (w containerdExecutor) Exec(ctx context.Context, meta executor.Meta, root c
105103
if meta.ReadonlyRootFS {
106104
opts = append(opts, containerdoci.WithRootFSReadonly())
107105
}
108-
if system.SeccompSupported() {
109-
opts = append(opts, seccomp.WithDefaultProfile())
110-
}
106+
111107
spec, cleanup, err := oci.GenerateSpec(ctx, meta, mounts, id, resolvConf, hostsFile, meta.NetMode == pb.NetMode_HOST, opts...)
112108
if err != nil {
113109
return err

‎executor/executor.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ type Meta struct {
1818
ReadonlyRootFS bool
1919
ExtraHosts []HostIP
2020
NetMode pb.NetMode
21+
SecMode pb.SecMode
2122
}
2223

2324
type Mount struct {

‎executor/oci/spec_unix.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,16 @@ import (
88
"sync"
99

1010
"github.com/containerd/containerd/containers"
11+
"github.com/containerd/containerd/contrib/seccomp"
1112
"github.com/containerd/containerd/mount"
1213
"github.com/containerd/containerd/namespaces"
1314
"github.com/containerd/containerd/oci"
1415
"github.com/mitchellh/hashstructure"
1516
"github.com/moby/buildkit/executor"
1617
"github.com/moby/buildkit/snapshot"
18+
"github.com/moby/buildkit/solver/pb"
19+
"github.com/moby/buildkit/util/entitlements"
20+
"github.com/moby/buildkit/util/system"
1721
specs "github.com/opencontainers/runtime-spec/specs-go"
1822
"github.com/pkg/errors"
1923
)
@@ -34,12 +38,22 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
3438
opts = append(opts, oci.WithHostNamespace(specs.NetworkNamespace))
3539
}
3640

41+
if system.SeccompSupported() {
42+
if meta.SecMode == pb.SecMode_CONFINED {
43+
opts = append(opts, seccomp.WithDefaultProfile())
44+
}
45+
if meta.SecMode == pb.SecMode_UNCONFINED {
46+
opts = append(opts, entitlements.WithDefaultAdminProfile())
47+
}
48+
}
49+
3750
// Note that containerd.GenerateSpec is namespaced so as to make
3851
// specs.Linux.CgroupsPath namespaced
3952
s, err := oci.GenerateSpec(ctx, nil, c, opts...)
4053
if err != nil {
4154
return nil, nil, err
4255
}
56+
4357
s.Process.Args = meta.Args
4458
s.Process.Env = meta.Env
4559
s.Process.Cwd = meta.Cwd

‎executor/runcexecutor/executor.go

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ import (
1313
"sync"
1414
"syscall"
1515

16-
"github.com/containerd/containerd/contrib/seccomp"
1716
"github.com/containerd/containerd/mount"
1817
containerdoci "github.com/containerd/containerd/oci"
1918
"github.com/containerd/continuity/fs"
@@ -25,7 +24,6 @@ import (
2524
"github.com/moby/buildkit/solver/pb"
2625
"github.com/moby/buildkit/util/network"
2726
rootlessspecconv "github.com/moby/buildkit/util/rootless/specconv"
28-
"github.com/moby/buildkit/util/system"
2927
runcsystem "github.com/opencontainers/runc/libcontainer/system"
3028
specs "github.com/opencontainers/runtime-spec/specs-go"
3129
"github.com/pkg/errors"
@@ -181,9 +179,7 @@ func (w *runcExecutor) Exec(ctx context.Context, meta executor.Meta, root cache.
181179
defer f.Close()
182180

183181
opts := []containerdoci.SpecOpts{oci.WithUIDGID(uid, gid, sgids)}
184-
if system.SeccompSupported() {
185-
opts = append(opts, seccomp.WithDefaultProfile())
186-
}
182+
187183
if meta.ReadonlyRootFS {
188184
opts = append(opts, containerdoci.WithRootFSReadonly())
189185
}

‎frontend/dockerfile/builder/build.go

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -471,3 +471,17 @@ func parseNetMode(v string) (pb.NetMode, error) {
471471
return 0, errors.Errorf("invalid netmode %s", v)
472472
}
473473
}
474+
475+
func parseSecMode(v string) (pb.SecMode, error) {
476+
if v == "" {
477+
return llb.SecurityModeConfined, nil
478+
}
479+
switch v {
480+
case "confined":
481+
return llb.SecurityModeConfined, nil
482+
case "unconfined":
483+
return llb.SecurityModeUnconfined, nil
484+
default:
485+
return 0, errors.Errorf("invalid secmode %s", v)
486+
}
487+
}

‎frontend/dockerfile/dockerfile2llb/convert.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -55,6 +55,7 @@ type ConvertOpt struct {
5555
PrefixPlatform bool
5656
ExtraHosts []llb.HostIP
5757
ForceNetMode pb.NetMode
58+
ForceSecMode pb.SecMode
5859
}
5960

6061
func Dockerfile2LLB(ctx context.Context, dt []byte, opt ConvertOpt) (*llb.State, *Image, error) {

0 commit comments

Comments
 (0)