✨Propagate capabilities to correct processes

[GitHK]

What do these changes do?

In theory capabilities appear to be very simple at a first glance. They do hide some awkward interactions.

Why were capabilities not being propagated before?

• the main docker process which has the capabilities when starting is switched out via gosu which drops them
• how to add them back? we grant them to the python executable

We can see the CapPrm fields containing only the given capability for the python interpreter started processes and subprocesses.

root@7d326212c50e:/home/scu# ps awx
    PID TTY      STAT   TIME COMMAND
      1 ?        Ss     0:00 /sbin/docker-init -- /bin/sh services/dynamic-sidecar/docker/entrypoint.sh /bin/sh services/dynamic-sidecar/docker/boot.sh
      7 ?        Sl     0:05 /home/scu/.venv/bin/python /home/scu/.venv/bin/uvicorn simcore_service_dynamic_sidecar.main:the_app --host 0.0.0.0 --log-level debug
    764 ?        Sl     0:00 /home/scu/.venv/bin/python /home/scu/.venv/bin/uvicorn simcore_service_dynamic_sidecar.main:the_app --host 0.0.0.0 --log-level debug
    766 ?        Sl     0:00 /home/scu/.venv/bin/python /home/scu/.venv/bin/uvicorn simcore_service_dynamic_sidecar.main:the_app --host 0.0.0.0 --log-level debug
    797 pts/0    Ss     0:00 bash
   1122 pts/0    R+     0:00 ps awx
root@7d326212c50e:/home/scu# cat /proc/1/status | grep Cap
CapInh:	0000000000000000
CapPrm:	00000000a80427fb
CapEff:	00000000a80427fb
CapBnd:	00000000a80427fb
CapAmb:	0000000000000000
root@7d326212c50e:/home/scu# cat /proc/7/status | grep Cap
CapInh:	0000000000000000
CapPrm:	0000000000000200
CapEff:	0000000000000200
CapBnd:	00000000a80427fb
CapAmb:	0000000000000000
root@7d326212c50e:/home/scu# cat /proc/766/status | grep Cap
CapInh:	0000000000000000
CapPrm:	0000000000000200
CapEff:	0000000000000200
CapBnd:	00000000a80427fb
CapAmb:	0000000000000000
root@7d326212c50e:/home/scu# cat /proc/764/status | grep Cap
CapInh:	0000000000000000
CapPrm:	0000000000000200
CapEff:	0000000000000200
CapBnd:	00000000a80427fb
CapAmb:	0000000000000000
root@7d326212c50e:/home/scu# cat /proc/797/status | grep Cap
CapInh:	0000000000000000
CapPrm:	00000000a80427fb
CapEff:	00000000a80427fb
CapBnd:	00000000a80427fb
CapAmb:	0000000000000000

Reference material:

• original issue on docker docker run with CAP_LINUX_IMMUTABLE not working moby/moby#45177
• capabilities tutorial https://blog.container-solutions.com/linux-capabilities-why-they-exist-and-how-they-work
• restrict and grant capabilities https://blog.siphos.be/2013/05/restricting-and-granting-capabilities/
• reliable way to list capabilities per process https://stackoverflow.com/a/64000118/2855718
• capabilities are not granted per user but per executable https://groups.google.com/g/linux.gentoo.user/c/ZeObN91IVK4

Related issue/s

• improving dynamic-sidecar design osparc-issues#638
• allows to recover ♻️ Volumes keep track if the data requires saving 🚨 #3974 which got reverted by Revert "♻️ Volumes keep track if the data requires saving 🚨 (#3974)" #4139

How to test

DevOps Checklist

[codecov]

Codecov Report

Merging #4225 (f05f124) into master (d9fd2da) will increase coverage by 1.1%.
The diff coverage is n/a.

@@            Coverage Diff            @@
##           master   #4225      +/-   ##
=========================================
+ Coverage    84.9%   86.0%    +1.1%     
=========================================
  Files         940     152     -788     
  Lines       41064    8265   -32799     
  Branches      953       0     -953     
=========================================
- Hits        34882    7112   -27770     
+ Misses       5978    1153    -4825     
+ Partials      204       0     -204     

Flag	Coverage Δ
integrationtests	?
unittests	86.0% <ø> (+3.3%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Impacted Files	Coverage Δ
...es/dynamic_sidecar/docker_service_specs/sidecar.py	79.1% <ø> (-8.4%)	⬇️

... and 815 files with indirect coverage changes

[sanderegg]

if possible remove the hard-coded 3.10

[codeclimate]

Code Climate has analyzed commit f05f124 and detected 0 issues on this pull request.

View more on Code Climate.

[sonarqubecloud]

Kudos, SonarCloud Quality Gate passed!   

0 Bugs
0 Vulnerabilities
0 Security Hotspots
0 Code Smells

No Coverage information
0.1% Duplication