*: bump dependency version & better align

This commit is contained in:
criyle 2023-04-12 01:19:47 -07:00
parent cce22e7ac8
commit 25d0f22364
5 changed files with 34 additions and 33 deletions

View File

@ -13,11 +13,12 @@ import (
// cmd is the control message send into container // cmd is the control message send into container
type cmd struct { type cmd struct {
OpenCmd []OpenCmd // open argument
DeleteCmd *deleteCmd // delete argument DeleteCmd *deleteCmd // delete argument
ExecCmd *execCmd // execve argument ExecCmd *execCmd // execve argument
ConfCmd *confCmd // to set configuration ConfCmd *confCmd // to set configuration
OpenCmd []OpenCmd // open argument
Cmd cmdType // type of the cmd Cmd cmdType // type of the cmd
} }
@ -74,8 +75,8 @@ type reply struct {
// errorReply stores error returned back from container // errorReply stores error returned back from container
type errorReply struct { type errorReply struct {
Msg string
Errno *syscall.Errno Errno *syscall.Errno
Msg string
} }
// execReply stores execve result // execReply stores execve result

4
go.mod
View File

@ -4,6 +4,6 @@ go 1.20
require ( require (
github.com/elastic/go-seccomp-bpf v1.3.0 github.com/elastic/go-seccomp-bpf v1.3.0
golang.org/x/net v0.7.0 golang.org/x/net v0.9.0
golang.org/x/sys v0.5.0 golang.org/x/sys v0.7.0
) )

8
go.sum
View File

@ -3,8 +3,8 @@ github.com/elastic/go-seccomp-bpf v1.3.0 h1:e6teyX946lvPOnZERSYRrMYmsjxaQcWhoiGT
github.com/elastic/go-seccomp-bpf v1.3.0/go.mod h1:wIMxjTbKpWGQk4CV9WltlG6haB4brjSH/dvAohBPM1I= github.com/elastic/go-seccomp-bpf v1.3.0/go.mod h1:wIMxjTbKpWGQk4CV9WltlG6haB4brjSH/dvAohBPM1I=
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk= github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU= golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=

View File

@ -31,21 +31,6 @@ type Runner struct {
// seccomp syscall filter applied to child // seccomp syscall filter applied to child
Seccomp *syscall.SockFprog Seccomp *syscall.SockFprog
// ptrace controls child process to call ptrace(PTRACE_TRACEME)
// runtime.LockOSThread is required for tracer to call ptrace syscalls
Ptrace bool
// no_new_privs calls prctl(PR_SET_NO_NEW_PRIVS) to 0 to disable calls to
// setuid processes. It is automatically enabled when seccomp filter is provided
NoNewPrivs bool
// stop before seccomp calls kill(getpid(), SIGSTOP) to wait for tracer to continue
// right before the calls to seccomp. It is automatically enabled when seccomp
// filter and ptrace are provided since kill might not be available after
// seccomp and execve might be traced by ptrace
// cannot stop after seccomp since kill might not be allowed by seccomp filter
StopBeforeSeccomp bool
// clone unshare flag to create linux namespace, effective when clone child // clone unshare flag to create linux namespace, effective when clone child
// since unshare syscall does not join the new pid group // since unshare syscall does not join the new pid group
CloneFlags uintptr CloneFlags uintptr
@ -72,19 +57,10 @@ type Runner struct {
// HostName and DomainName to be set after unshare UTS & user (CAP_SYS_ADMIN) // HostName and DomainName to be set after unshare UTS & user (CAP_SYS_ADMIN)
HostName, DomainName string HostName, DomainName string
// drop_caps calls cap_set(self, 0) to drop all capabilities
// from effective, permitted, inheritable capability sets before execve
// it should avoid calls to set ambient capabilities
DropCaps bool
// UidMappings / GidMappings for unshared user namespaces, no-op if mapping is null // UidMappings / GidMappings for unshared user namespaces, no-op if mapping is null
UIDMappings []syscall.SysProcIDMap UIDMappings []syscall.SysProcIDMap
GIDMappings []syscall.SysProcIDMap GIDMappings []syscall.SysProcIDMap
// GidMappingsEnableSetgroups allows / disallows setgroups syscall.
// deny if GIDMappings is nil
GIDMappingsEnableSetgroups bool
// Credential holds user and group identities to be assumed // Credential holds user and group identities to be assumed
// by a child process started by StartProcess. // by a child process started by StartProcess.
Credential *syscall.Credential Credential *syscall.Credential
@ -95,6 +71,30 @@ type Runner struct {
// SyncFunc is called right before execve, thus it could track cpu more accurately // SyncFunc is called right before execve, thus it could track cpu more accurately
SyncFunc func(int) error SyncFunc func(int) error
// ptrace controls child process to call ptrace(PTRACE_TRACEME)
// runtime.LockOSThread is required for tracer to call ptrace syscalls
Ptrace bool
// no_new_privs calls prctl(PR_SET_NO_NEW_PRIVS) to 0 to disable calls to
// setuid processes. It is automatically enabled when seccomp filter is provided
NoNewPrivs bool
// stop before seccomp calls kill(getpid(), SIGSTOP) to wait for tracer to continue
// right before the calls to seccomp. It is automatically enabled when seccomp
// filter and ptrace are provided since kill might not be available after
// seccomp and execve might be traced by ptrace
// cannot stop after seccomp since kill might not be allowed by seccomp filter
StopBeforeSeccomp bool
// GidMappingsEnableSetgroups allows / disallows setgroups syscall.
// deny if GIDMappings is nil
GIDMappingsEnableSetgroups bool
// drop_caps calls cap_set(self, 0) to drop all capabilities
// from effective, permitted, inheritable capability sets before execve
// it should avoid calls to set ambient capabilities
DropCaps bool
// UnshareCgroupAfterSync specifies whether to unshare cgroup namespace after // UnshareCgroupAfterSync specifies whether to unshare cgroup namespace after
// sync (the syncFunc might be add the child to the cgroup) // sync (the syncFunc might be add the child to the cgroup)
UnshareCgroupAfterSync bool UnshareCgroupAfterSync bool

View File

@ -13,9 +13,9 @@ import (
// at most max bytes to a buffer // at most max bytes to a buffer
type Buffer struct { type Buffer struct {
W *os.File W *os.File
Max int64
Buffer *bytes.Buffer Buffer *bytes.Buffer
Done <-chan struct{} Done <-chan struct{}
Max int64
} }
// NewPipe create a pipe with a goroutine to copy its read-end to writer // NewPipe create a pipe with a goroutine to copy its read-end to writer