search

opencontainers / runtime-tools

OCI Runtime Tools
https://www.opencontainers.org/
Apache License 2.0
434 stars 141 forks source link

Switch to github.com/moby/sys/capability #777

Open kolyshkin opened 2 months ago

kolyshkin commented 2 months ago

Currently a draft pending #776 merge.

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained.

For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md

Note that "workaround for RHEL6" is removed for a number of reasons. Feel free to choose the one you like the most, either is sufficient:

  1. /proc/sys/kernel/cap_last_cap is available since RHEL 6.7 (kernel 2.6.32-573.el6), released 9 years ago (2015-07-22).

  2. It incorrectly returns CAP_BLOCK_SUSPEND (36), which was only added in kernel v3.5 and was never backported to RHEL6 kernels. The correct value for RHEL6 would be CAP_MAC_ADMIN (33).

  3. As far as upstream kernels go, /proc/sys/kernel/cap_last_cap was added in kernel v3.2, and a correct value depends on the kernel version. It could be CAP_WAKE_ALARM (35), added to kernel v3.0, or CAP_SYSLOG (34), added to kernel v2.6.38, or possibly a lesser value for even older kernels.

thaJeztah commented 2 weeks ago

@kolyshkin looks like you need to fix vendoring;

go build -tags "" -ldflags "-X main.gitCommit=012d045 -X main.version=0.9.0" -race -o oci-runtime-tool ./cmd/oci-runtime-tool
go: inconsistent vendoring in /home/runner/work/runtime-tools/runtime-tools:
    github.com/moby/sys/capability@v0.4.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
    github.com/moby/sys/capability@v0.3.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod

    To ignore the vendor directory, use -mod=readonly or -mod=mod.
    To sync the vendor directory, run:
        go mod vendor
thaJeztah commented 14 hours ago

@kolyshkin gentle nudge 😄