mirror of
https://github.com/criyle/go-sandbox.git
synced 2025-11-04 14:49:53 +08:00
*: bump dependency version & better align
This commit is contained in:
parent
cce22e7ac8
commit
25d0f22364
@ -13,11 +13,12 @@ import (
|
||||
|
||||
// cmd is the control message send into container
|
||||
type cmd struct {
|
||||
OpenCmd []OpenCmd // open argument
|
||||
DeleteCmd *deleteCmd // delete argument
|
||||
ExecCmd *execCmd // execve argument
|
||||
ConfCmd *confCmd // to set configuration
|
||||
|
||||
OpenCmd []OpenCmd // open argument
|
||||
|
||||
Cmd cmdType // type of the cmd
|
||||
}
|
||||
|
||||
@ -74,8 +75,8 @@ type reply struct {
|
||||
|
||||
// errorReply stores error returned back from container
|
||||
type errorReply struct {
|
||||
Msg string
|
||||
Errno *syscall.Errno
|
||||
Msg string
|
||||
}
|
||||
|
||||
// execReply stores execve result
|
||||
|
||||
4
go.mod
4
go.mod
@ -4,6 +4,6 @@ go 1.20
|
||||
|
||||
require (
|
||||
github.com/elastic/go-seccomp-bpf v1.3.0
|
||||
golang.org/x/net v0.7.0
|
||||
golang.org/x/sys v0.5.0
|
||||
golang.org/x/net v0.9.0
|
||||
golang.org/x/sys v0.7.0
|
||||
)
|
||||
|
||||
8
go.sum
8
go.sum
@ -3,8 +3,8 @@ github.com/elastic/go-seccomp-bpf v1.3.0 h1:e6teyX946lvPOnZERSYRrMYmsjxaQcWhoiGT
|
||||
github.com/elastic/go-seccomp-bpf v1.3.0/go.mod h1:wIMxjTbKpWGQk4CV9WltlG6haB4brjSH/dvAohBPM1I=
|
||||
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
|
||||
github.com/stretchr/testify v1.8.1 h1:w7B6lhMri9wdJUVmEZPGGhZzrYTPvgJArz7wNPgYKsk=
|
||||
golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
|
||||
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
|
||||
golang.org/x/sys v0.5.0 h1:MUK/U/4lj1t1oPg0HfuXDN/Z1wv31ZJ/YcPiGccS4DU=
|
||||
golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/net v0.9.0 h1:aWJ/m6xSmxWBx+V0XRHTlrYrPG56jKsLdTFmsSsCzOM=
|
||||
golang.org/x/net v0.9.0/go.mod h1:d48xBJpPfHeWQsugry2m+kC02ZBRGRgulfHnEXEuWns=
|
||||
golang.org/x/sys v0.7.0 h1:3jlCCIQZPdOYu1h8BkNvLz8Kgwtae2cagcG/VamtZRU=
|
||||
golang.org/x/sys v0.7.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
|
||||
|
||||
@ -31,21 +31,6 @@ type Runner struct {
|
||||
// seccomp syscall filter applied to child
|
||||
Seccomp *syscall.SockFprog
|
||||
|
||||
// ptrace controls child process to call ptrace(PTRACE_TRACEME)
|
||||
// runtime.LockOSThread is required for tracer to call ptrace syscalls
|
||||
Ptrace bool
|
||||
|
||||
// no_new_privs calls prctl(PR_SET_NO_NEW_PRIVS) to 0 to disable calls to
|
||||
// setuid processes. It is automatically enabled when seccomp filter is provided
|
||||
NoNewPrivs bool
|
||||
|
||||
// stop before seccomp calls kill(getpid(), SIGSTOP) to wait for tracer to continue
|
||||
// right before the calls to seccomp. It is automatically enabled when seccomp
|
||||
// filter and ptrace are provided since kill might not be available after
|
||||
// seccomp and execve might be traced by ptrace
|
||||
// cannot stop after seccomp since kill might not be allowed by seccomp filter
|
||||
StopBeforeSeccomp bool
|
||||
|
||||
// clone unshare flag to create linux namespace, effective when clone child
|
||||
// since unshare syscall does not join the new pid group
|
||||
CloneFlags uintptr
|
||||
@ -72,19 +57,10 @@ type Runner struct {
|
||||
// HostName and DomainName to be set after unshare UTS & user (CAP_SYS_ADMIN)
|
||||
HostName, DomainName string
|
||||
|
||||
// drop_caps calls cap_set(self, 0) to drop all capabilities
|
||||
// from effective, permitted, inheritable capability sets before execve
|
||||
// it should avoid calls to set ambient capabilities
|
||||
DropCaps bool
|
||||
|
||||
// UidMappings / GidMappings for unshared user namespaces, no-op if mapping is null
|
||||
UIDMappings []syscall.SysProcIDMap
|
||||
GIDMappings []syscall.SysProcIDMap
|
||||
|
||||
// GidMappingsEnableSetgroups allows / disallows setgroups syscall.
|
||||
// deny if GIDMappings is nil
|
||||
GIDMappingsEnableSetgroups bool
|
||||
|
||||
// Credential holds user and group identities to be assumed
|
||||
// by a child process started by StartProcess.
|
||||
Credential *syscall.Credential
|
||||
@ -95,6 +71,30 @@ type Runner struct {
|
||||
// SyncFunc is called right before execve, thus it could track cpu more accurately
|
||||
SyncFunc func(int) error
|
||||
|
||||
// ptrace controls child process to call ptrace(PTRACE_TRACEME)
|
||||
// runtime.LockOSThread is required for tracer to call ptrace syscalls
|
||||
Ptrace bool
|
||||
|
||||
// no_new_privs calls prctl(PR_SET_NO_NEW_PRIVS) to 0 to disable calls to
|
||||
// setuid processes. It is automatically enabled when seccomp filter is provided
|
||||
NoNewPrivs bool
|
||||
|
||||
// stop before seccomp calls kill(getpid(), SIGSTOP) to wait for tracer to continue
|
||||
// right before the calls to seccomp. It is automatically enabled when seccomp
|
||||
// filter and ptrace are provided since kill might not be available after
|
||||
// seccomp and execve might be traced by ptrace
|
||||
// cannot stop after seccomp since kill might not be allowed by seccomp filter
|
||||
StopBeforeSeccomp bool
|
||||
|
||||
// GidMappingsEnableSetgroups allows / disallows setgroups syscall.
|
||||
// deny if GIDMappings is nil
|
||||
GIDMappingsEnableSetgroups bool
|
||||
|
||||
// drop_caps calls cap_set(self, 0) to drop all capabilities
|
||||
// from effective, permitted, inheritable capability sets before execve
|
||||
// it should avoid calls to set ambient capabilities
|
||||
DropCaps bool
|
||||
|
||||
// UnshareCgroupAfterSync specifies whether to unshare cgroup namespace after
|
||||
// sync (the syncFunc might be add the child to the cgroup)
|
||||
UnshareCgroupAfterSync bool
|
||||
|
||||
@ -13,9 +13,9 @@ import (
|
||||
// at most max bytes to a buffer
|
||||
type Buffer struct {
|
||||
W *os.File
|
||||
Max int64
|
||||
Buffer *bytes.Buffer
|
||||
Done <-chan struct{}
|
||||
Max int64
|
||||
}
|
||||
|
||||
// NewPipe create a pipe with a goroutine to copy its read-end to writer
|
||||
|
||||
Loading…
Reference in New Issue
Block a user