Docker的Privileged和Cap
docker使用--privileged --cap-add --cap-drop来控制容器的权限，能控制哪些权限，是怎样实现的？
参考代码版本：docker-1.12.0
cap
首先，caplist有两个基准范围：
①默认Cap集合
[CAP_CHOWN CAP_DAC_OVERRIDE CAP_FSETID CAP_FOWNER CAP_MKNOD CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SETFCAP CAP_SETPCAP CAP_NET_BIND_SERVICE CAP_SYS_CHROOT CAP_KILL CAP_AUDIT_WRITE]
src/oci/default_linux.go
s.Process.Capabilities = []string{
"CAP_CHOWN",
"CAP_DAC_OVERRIDE",
"CAP_FSETID",
"CAP_FOWNER",
"CAP_MKNOD",
"CAP_NET_RAW",
"CAP_SETGID",
"CAP_SETUID",
"CAP_SETFCAP",
"CAP_SETPCAP",
"CAP_NET_BIND_SERVICE",
"CAP_SYS_CHROOT",
"CAP_KILL",
"CAP_AUDIT_WRITE",
}
②最大Cap集合
[CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_FSETID CAP_KILL CAP_SETGID CAP_SETUID CAP_SETPCAP CAP_LINUX_IMMUTABLE CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_ADMIN CAP_NET_RAW CAP_IPC_LOCK CAP_IPC_OWNER CAP_SYS_MODULE CAP_SYS_RAWIO CAP_SYS_CHROOT CAP_SYS_PTRACE CAP_SYS_PACCT CAP_SYS_ADMIN CAP_SYS_BOOT CAP_SYS_NICE CAP_SYS_RESOURCE CAP_SYS_TIME CAP_SYS_TTY_CONFIG CAP_MKNOD CAP_LEASE CAP_AUDIT_WRITE CAP_AUDIT_CONTROL CAP_SETFCAP CAP_MAC_OVERRIDE CAP_MAC_ADMIN CAP_SYSLOG CAP_WAKE_ALARM CAP_BLOCK_SUSPEND]
定义在这里：src/vender/src/github.com/syndtr/gocapability/capability/enum.go
其次，怎样决定容器启动时有哪些cap？
src/daemon/oci_linux.go
func setCapabilities(s *specs.Spec, c *container.Container) error {
var caplist []string
var err error
if c.HostConfig.Privileged {
caplist = caps.GetAllCapabilities()
} else {
caplist, err = caps.TweakCapabilities(s.Process.Capabilities, c.HostConfig.CapAdd, c.HostConfig.CapDrop)
if err != nil {
return err
}
}
s.Process.Capabilities = caplist
return nil
}
也就是说，如果是--privileged启动，那么你就获得最大的cap，如果不是，就根据--cap-add和--cap-drop ++--
最后，每个cap代表什么含义：
例如SYS_ADMIN，代表着container进程允许使用clone、mount、sethostname等系统调用
src/profile/seccomp/seccomp_default.go
case "CAP_SYS_ADMIN":
capSysAdmin = true
syscalls = append(syscalls, []*types.Syscall{
{
Name: "bpf",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "clone",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "fanotify_init",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "lookup_dcookie",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "mount",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "perf_event_open",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "setdomainname",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "sethostname",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "setns",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "umount",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "umount2",
Action: types.ActAllow,
Args: []*types.Arg{},
},
{
Name: "unshare",
Action: types.ActAllow,
Args: []*types.Arg{},
},
}...)
试一下：
[root@cc101 ~]# docker run -it autodeploy.chinacloud.com:4000/kollaglue/centos-binary-nova-compute:2.0.1 /bin/bash
()[root@a69e2a3cdea3 /]# hostname
a69e2a3cdea3
()[root@a69e2a3cdea3 /]# hostname test
hostname: you must be root to change the host name
默认权限下，不能使用sethostname系统调用
加上CAP_SYS_ADMIN
[root@cc101 ~]# docker run -it --rm -u root --cap-add SYS_ADMIN autodeploy.chinacloud.com:4000/kollaglue/centos-binary-nova-compute:2.0.1 /bin/bash
()[root@5c973256f09b /]# hostname
5c973256f09b
()[root@5c973256f09b /]# hostname test
()[root@5c973256f09b /]# hostname
test
这次sethostname成功
privileged
翻译为“特权”，代表container可以使用的最大权利，除了前述的获得最多cap这个功能外，privileged还有哪些特权呢？
sysfs和cgroup文件系统的权限ro->rw
src/daemon/oci_linux.go
func setMounts(daemon *Daemon, s *specs.Spec, c *container.Container, mounts []container.Mount) error {
...
if c.HostConfig.Privileged {
if !s.Root.Readonly {
// clear readonly for /sys
for i := range s.Mounts {
if s.Mounts[i].Destination == "/sys" {
clearReadOnly(&s.Mounts[i])
}
}
}
s.Linux.ReadonlyPaths = nil
s.Linux.MaskedPaths = nil
}
// TODO: until a kernel/mount solution exists for handling remount in a user namespace,
// we must clear the readonly flag for the cgroups mount (@mrunalp concurs)
if uidMap, _ := daemon.GetUIDGIDMaps(); uidMap != nil || c.HostConfig.Privileged {
for i, m := range s.Mounts {
if m.Type == "cgroup" {
clearReadOnly(&s.Mounts[i])
}
}
}
...
}
获得主机的device
src/daemon/oci_linux.go
func setDevices(s *specs.Spec, c *container.Container) error {
// Build lists of devices allowed and created within the container.
var devs []specs.Device
devPermissions := s.Linux.Resources.Devices
if c.HostConfig.Privileged {
hostDevices, err := devices.HostDevices()
if err != nil {
return err
}
for _, d := range hostDevices {
devs = append(devs, specDevice(d))
}
rwm := "rwm"
devPermissions = []specs.DeviceCgroup{
{
Allow: true,
Access: &rwm,
},
}
} else {
for _, deviceMapping := range c.HostConfig.Devices {
d, dPermissions, err := getDevicesFromPath(deviceMapping)
if err != nil {
return err
}
devs = append(devs, d...)
devPermissions = append(devPermissions, dPermissions...)
}
}
试一下
[root@cc101 ~]# docker run -it --rm -u root autodeploy.chinacloud.com:4000/kollaglue/centos-binary-nova-compute:2.0.1 /bin/bash
()[root@bf2849514850 /]#
()[root@bf2849514850 /]# ls /dev
console fd full fuse kcore mqueue null ptmx pts random shm stderr stdin stdout tty urandom zero
()[root@bf2849514850 /]# exit
exit
这次加上特权
[root@cc101 ~]# docker run -it --rm -u root --privileged autodeploy.chinacloud.com:4000/kollaglue/centos-binary-nova-compute:2.0.1 /bin/bash
()[root@f30d3af44de4 /]# ls /dev
autofs dm-14 dm-27 dm-9 loop0 ppp sdb tty11 tty24 tty37 tty5 tty62 usbmon2 vcsa6
bsg dm-15 dm-28 dri loop1 ptmx sdb1 tty12 tty25 tty38 tty50 tty63 vcs vfio
btrfs-control dm-16 dm-29 fb0 loop-control ptp0 sg0 tty13 tty26 tty39 tty51 tty7 vcs1 vga_arbiter
bus dm-17 dm-3 fd mapper ptp1 sg1 tty14 tty27 tty4 tty52 tty8 vcs2 vhost-net
console dm-18 dm-30 full mcelog ptp2 shm tty15 tty28 tty40 tty53 tty9 vcs3 zero
cpu dm-19 dm-31 fuse mem ptp3 snapshot tty16 tty29 tty41 tty54 ttyS0 vcs4
cpu_dma_latency dm-2 dm-32 hidraw0 mqueue pts snd tty17 tty3 tty42 tty55 ttyS1 vcs5
crash dm-20 dm-33 hidraw1 net random stderr tty18 tty30 tty43 tty56 ttyS2 vcs6
dm-0 dm-21 dm-34 hidraw2 network_latency raw stdin tty19 tty31 tty44 tty57 ttyS3 vcsa
dm-1 dm-22 dm-4 hpet network_throughput rtc0 stdout tty2 tty32 tty45 tty58 uhid vcsa1
dm-10 dm-23 dm-5 input null sda tty tty20 tty33 tty46 tty59 uinput vcsa2
dm-11 dm-24 dm-6 kcore nvram sda1 tty0 tty21 tty34 tty47 tty6 urandom vcsa3
dm-12 dm-25 dm-7 kmsg oldmem sda2 tty1 tty22 tty35 tty48 tty60 usbmon0 vcsa4
dm-13 dm-26 dm-8 kvm port sda3 tty10 tty23 tty36 tty49 tty61 usbmon1 vcsa5
最后，相关数据结构定义：src/vendor/src/github.com/opencontainers/specs/specs-go/config.go
// Spec is the base configuration for the container.
type Spec struct {
// Version is the version of the specification that is supported.
Version string `json:"ociVersion"`
// Platform is the host information for OS and Arch.
Platform Platform `json:"platform"`
// Process is the container's main process.
Process Process `json:"process"`
// Root is the root information for the container's filesystem.
Root Root `json:"root"`
// Hostname is the container's host name.
Hostname string `json:"hostname,omitempty"`
// Mounts profile configuration for adding mounts to the container's filesystem.
Mounts []Mount `json:"mounts,omitempty"`
// Hooks are the commands run at various lifecycle events of the container.
Hooks Hooks `json:"hooks"`
// Annotations is an unstructured key value map that may be set by external tools to store and retrieve arbitrary metadata.
Annotations map[string]string `json:"annotations,omitempty"`
// Linux is platform specific configuration for Linux based containers.
Linux Linux `json:"linux" platform:"linux,omitempty"`
// Solaris is platform specific configuration for Solaris containers.
Solaris Solaris `json:"solaris" platform:"solaris,omitempty"`
}
...
正文到此结束
热门推荐
相关文章
近期评论
-
文章和留言都翻到11页了 没有OOM
-
-
朋友，翻页到11页，及以后，会出现OOM，无法访问
-
-
搞个gitee的项目
-
-
版本号是多少，你可以下载哪个代码仓库，jdk选1.8 直接跑就行
-
-
-
Loading...
![[HBLOG]公众号](https://www.liuhaihua.cn/img/qrcode_gzh.jpg)
