4e7cf5413d
This is to check if runc 1.0.0 (to be released shortly) works with k8s. The commands used were (roughly): hack/pin-dependency.sh github.com/opencontainers/runc v1.0.0 hack/lint-dependencies.sh # Follow its recommendations. hack/pin-dependency.sh github.com/cilium/ebpf v0.6.1 hack/pin-dependency.sh github.com/opencontainers/selinux v1.8.2 hack/pin-dependency.sh github.com/sirupsen/logrus v1.8.1 # Recheck. hack/lint-dependencies.sh GO111MODULE=on go mod edit -dropreplace github.com/willf/bitset hack/update-vendor.sh # Recheck. hack/lint-dependencies.sh hack/update-internal-modules.sh # Recheck. hack/lint-dependencies.sh [v2: rebased, updated runc 3a0234e1fe2e82 -> 2f8e8e9d977500] [v3: testing master + runc pr 3019] [v4: updated to 93a01cd4d0b7a0f08a] [v5: updated to f093cca13d3cf8a484] [v6: rebased] [v7: updated to runc v1.0.0] [v8: rebased] Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
48 lines
1.0 KiB
Go
48 lines
1.0 KiB
Go
// +build linux
|
|
|
|
package keys
|
|
|
|
import (
|
|
"strconv"
|
|
"strings"
|
|
|
|
"github.com/pkg/errors"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
type KeySerial uint32
|
|
|
|
func JoinSessionKeyring(name string) (KeySerial, error) {
|
|
sessKeyID, err := unix.KeyctlJoinSessionKeyring(name)
|
|
if err != nil {
|
|
return 0, errors.Wrap(err, "create session key")
|
|
}
|
|
return KeySerial(sessKeyID), nil
|
|
}
|
|
|
|
// ModKeyringPerm modifies permissions on a keyring by reading the current permissions,
|
|
// anding the bits with the given mask (clearing permissions) and setting
|
|
// additional permission bits
|
|
func ModKeyringPerm(ringID KeySerial, mask, setbits uint32) error {
|
|
dest, err := unix.KeyctlString(unix.KEYCTL_DESCRIBE, int(ringID))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
res := strings.Split(dest, ";")
|
|
if len(res) < 5 {
|
|
return errors.New("Destination buffer for key description is too small")
|
|
}
|
|
|
|
// parse permissions
|
|
perm64, err := strconv.ParseUint(res[3], 16, 32)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
perm := (uint32(perm64) & mask) | setbits
|
|
|
|
return unix.KeyctlSetperm(int(ringID), perm)
|
|
}
|