Add support for setting POSIX capabilities on the binary generated by Go#1098
Add support for setting POSIX capabilities on the binary generated by Go#1098inteon wants to merge 8 commits intoko-build:mainfrom
Conversation
inteon
force-pushed
the
posix_capabilities
branch
from
03e9ef9 to
603c08c
Compare
|
@cpanato Do you have an initial opinion on this PR? |
|
This change looks good! Sorry it's taken so long to review it. We'll want to regenerate the CLI docs to pass CI, and probably add docs to the website to describe how/why you'd use this. An e2e test that builds and runs Thanks for this contribution, and sorry again for taking so long to get to it. |
Codecov Report
❗ Your organization is not using the GitHub App Integration. As a result you may experience degraded service beginning May 15th. Please install the Github App Integration for your organization. Read more. @@ Coverage Diff @@
## main #1098 +/- ##
==========================================
- Coverage 49.19% 47.54% -1.65%
==========================================
Files 44 45 +1
Lines 3653 3786 +133
==========================================
+ Hits 1797 1800 +3
- Misses 1624 1752 +128
- Partials 232 234 +2
|
Signed-off-by: Tim Ramlot <[email protected]>
Signed-off-by: Tim Ramlot <[email protected]>
inteon
force-pushed
the
posix_capabilities
branch
from
4e32cdd to
207568f
Compare
Definitely a feature I'm interested in. Is there any prior art here re: the UX of this flag? |
Answering my own question: I see that |
Signed-off-by: Tim Ramlot <[email protected]>
Signed-off-by: Tim Ramlot <[email protected]>
Signed-off-by: Tim Ramlot <[email protected]>
| } | ||
| } | ||
|
|
||
| // WithPOSIXCapabilities is a functional option for overriding the POSIX capabilities encoded in the binary file. |
There was a problem hiding this comment.
Small nit: How would you feel about WithPOSIXCapabilities(caps ...Cap) so that callers don't have to wrap it in a []Cap themselves?
There was a problem hiding this comment.
Because WithPOSIXCapabilities overwrites the capabilities slice, I prefer the []Cap argument.
...Cap makes me think that the function will append the capabilities to the slice.
Maybe it's just me who thinks that. Please let me know if that is the case & I'll update the code.
| type Cap int | ||
|
|
||
| // POSIX-draft defined capabilities. | ||
| const ( |
There was a problem hiding this comment.
I think I'd feel comfortable taking a dependency on https://pkg.go.dev/github.com/syndtr/gocapability instead of having to maintain our own copy here. Or if there's a better package to depend on, let me know.
There was a problem hiding this comment.
I think that library does not have a good FromString method that we can use.
I found that containerd defines its list of capabilities here: https://github.com/containerd/containerd/blob/v1.7.3/pkg/cap/cap_linux.go#L133-L187
& added some capabilities to the file to match their list.
Signed-off-by: Tim Ramlot <[email protected]>
Signed-off-by: Tim Ramlot <[email protected]>
Signed-off-by: Tim Ramlot <[email protected]>
|
@imjasonh @jonjohnsonjr WDYT about the latest changes? Is this ready to be merged? |
|
This Pull Request is stale because it has been open for 90 days with |
5 participants
To prevent an application from being swapped to disk, we use
mlock(prevents writing private keys to disk).However, this requires the POSIX CAP_IPC_LOCK capability to be set on the binary file.
This PR adds the option to specify what capabilities to set on the binary file.
NOTE for reviewer:
Would it be possible to get some feedback on whether this feature would be accepted in ko (regardless of the implementation)?