|
| 1 | +package bake |
| 2 | + |
| 3 | +import ( |
| 4 | + "bufio" |
| 5 | + "context" |
| 6 | + "fmt" |
| 7 | + "io" |
| 8 | + "os" |
| 9 | + "slices" |
| 10 | + "strings" |
| 11 | + |
| 12 | + "github.com/containerd/console" |
| 13 | + "github.com/docker/buildx/build" |
| 14 | + "github.com/moby/buildkit/util/entitlements" |
| 15 | + "github.com/pkg/errors" |
| 16 | +) |
| 17 | + |
| 18 | +type EntitlementKey string |
| 19 | + |
| 20 | +const ( |
| 21 | + EntitlementKeyNetworkHost EntitlementKey = "network.host" |
| 22 | + EntitlementKeySecurityInsecure EntitlementKey = "security.insecure" |
| 23 | + EntitlementKeyFSRead EntitlementKey = "fs.read" |
| 24 | + EntitlementKeyFSWrite EntitlementKey = "fs.write" |
| 25 | + EntitlementKeyFS EntitlementKey = "fs" |
| 26 | + EntitlementKeyImagePush EntitlementKey = "image.push" |
| 27 | + EntitlementKeyImageLoad EntitlementKey = "image.load" |
| 28 | + EntitlementKeyImage EntitlementKey = "image" |
| 29 | + EntitlementKeySSH EntitlementKey = "ssh" |
| 30 | +) |
| 31 | + |
| 32 | +type EntitlementConf struct { |
| 33 | + NetworkHost bool |
| 34 | + SecurityInsecure bool |
| 35 | + FSRead []string |
| 36 | + FSWrite []string |
| 37 | + ImagePush []string |
| 38 | + ImageLoad []string |
| 39 | + SSH bool |
| 40 | +} |
| 41 | + |
| 42 | +func ParseEntitlements(in []string) (EntitlementConf, error) { |
| 43 | + var conf EntitlementConf |
| 44 | + for _, e := range in { |
| 45 | + switch e { |
| 46 | + case string(EntitlementKeyNetworkHost): |
| 47 | + conf.NetworkHost = true |
| 48 | + case string(EntitlementKeySecurityInsecure): |
| 49 | + conf.SecurityInsecure = true |
| 50 | + case string(EntitlementKeySSH): |
| 51 | + conf.SSH = true |
| 52 | + default: |
| 53 | + k, v, _ := strings.Cut(e, "=") |
| 54 | + switch k { |
| 55 | + case string(EntitlementKeyFSRead): |
| 56 | + conf.FSRead = append(conf.FSRead, v) |
| 57 | + case string(EntitlementKeyFSWrite): |
| 58 | + conf.FSWrite = append(conf.FSWrite, v) |
| 59 | + case string(EntitlementKeyFS): |
| 60 | + conf.FSRead = append(conf.FSRead, v) |
| 61 | + conf.FSWrite = append(conf.FSWrite, v) |
| 62 | + case string(EntitlementKeyImagePush): |
| 63 | + conf.ImagePush = append(conf.ImagePush, v) |
| 64 | + case string(EntitlementKeyImageLoad): |
| 65 | + conf.ImageLoad = append(conf.ImageLoad, v) |
| 66 | + case string(EntitlementKeyImage): |
| 67 | + conf.ImagePush = append(conf.ImagePush, v) |
| 68 | + conf.ImageLoad = append(conf.ImageLoad, v) |
| 69 | + default: |
| 70 | + return conf, errors.Errorf("uknown entitlement key %q", k) |
| 71 | + } |
| 72 | + |
| 73 | + // TODO: dedupe slices and parent paths |
| 74 | + } |
| 75 | + } |
| 76 | + return conf, nil |
| 77 | +} |
| 78 | + |
| 79 | +func (c EntitlementConf) Validate(m map[string]build.Options) (EntitlementConf, error) { |
| 80 | + var expected EntitlementConf |
| 81 | + |
| 82 | + for _, v := range m { |
| 83 | + if err := c.check(v, &expected); err != nil { |
| 84 | + return EntitlementConf{}, err |
| 85 | + } |
| 86 | + } |
| 87 | + |
| 88 | + return expected, nil |
| 89 | +} |
| 90 | + |
| 91 | +func (c EntitlementConf) check(bo build.Options, expected *EntitlementConf) error { |
| 92 | + for _, e := range bo.Allow { |
| 93 | + switch e { |
| 94 | + case entitlements.EntitlementNetworkHost: |
| 95 | + if !c.NetworkHost { |
| 96 | + expected.NetworkHost = true |
| 97 | + } |
| 98 | + case entitlements.EntitlementSecurityInsecure: |
| 99 | + if !c.SecurityInsecure { |
| 100 | + expected.SecurityInsecure = true |
| 101 | + } |
| 102 | + } |
| 103 | + } |
| 104 | + return nil |
| 105 | +} |
| 106 | + |
| 107 | +func (c EntitlementConf) Prompt(ctx context.Context, out io.Writer) error { |
| 108 | + var term bool |
| 109 | + if _, err := console.ConsoleFromFile(os.Stdin); err == nil { |
| 110 | + term = true |
| 111 | + } |
| 112 | + |
| 113 | + var msgs []string |
| 114 | + var flags []string |
| 115 | + |
| 116 | + if c.NetworkHost { |
| 117 | + msgs = append(msgs, " - Running build containers that can access host network") |
| 118 | + flags = append(flags, "network.host") |
| 119 | + } |
| 120 | + if c.SecurityInsecure { |
| 121 | + msgs = append(msgs, " - Running privileged containers that can make system changes") |
| 122 | + flags = append(flags, "security.insecure") |
| 123 | + } |
| 124 | + |
| 125 | + if len(msgs) == 0 { |
| 126 | + return nil |
| 127 | + } |
| 128 | + |
| 129 | + fmt.Fprintf(out, "Your build is requesting privileges for following possibly insecure capabilities:\n\n") |
| 130 | + for _, m := range msgs { |
| 131 | + fmt.Fprintf(out, "%s\n", m) |
| 132 | + } |
| 133 | + |
| 134 | + for i, f := range flags { |
| 135 | + flags[i] = "--allow=" + f |
| 136 | + } |
| 137 | + |
| 138 | + if term { |
| 139 | + fmt.Fprintf(out, "\nIn order to not see this message in the future pass %q to grant requested privileges.\n", strings.Join(flags, " ")) |
| 140 | + } else { |
| 141 | + fmt.Fprintf(out, "\nPass %q to grant requested privileges.\n", strings.Join(flags, " ")) |
| 142 | + } |
| 143 | + |
| 144 | + args := append([]string(nil), os.Args...) |
| 145 | + if v, ok := os.LookupEnv("DOCKER_CLI_PLUGIN_ORIGINAL_CLI_COMMAND"); ok && v != "" { |
| 146 | + args[0] = v |
| 147 | + } |
| 148 | + idx := slices.Index(args, "bake") |
| 149 | + |
| 150 | + if idx != -1 { |
| 151 | + fmt.Fprintf(out, "\nYour full command with requested privileges:\n\n") |
| 152 | + fmt.Fprintf(out, "%s %s %s\n\n", strings.Join(args[:idx+1], " "), strings.Join(flags, " "), strings.Join(args[idx+1:], " ")) |
| 153 | + } |
| 154 | + |
| 155 | + if term { |
| 156 | + fmt.Fprintf(out, "Do you want to grant requested privileges and continue? [y/N] ") |
| 157 | + reader := bufio.NewReader(os.Stdin) |
| 158 | + answerCh := make(chan string, 1) |
| 159 | + go func() { |
| 160 | + answer, _, _ := reader.ReadLine() |
| 161 | + answerCh <- string(answer) |
| 162 | + close(answerCh) |
| 163 | + }() |
| 164 | + |
| 165 | + select { |
| 166 | + case <-ctx.Done(): |
| 167 | + case answer := <-answerCh: |
| 168 | + if strings.ToLower(string(answer)) == "y" { |
| 169 | + return nil |
| 170 | + } |
| 171 | + } |
| 172 | + } |
| 173 | + |
| 174 | + return errors.Errorf("additional privileges requested") |
| 175 | +} |
0 commit comments