vendor c/common@main

[vrothberg]

Adjust the capabilities e2e tests since some have recently been dropped.

Signed-off-by: Valentin Rothberg [email protected]

Does this PR introduce a user-facing change?

None

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vrothberg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [vrothberg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[vrothberg]

@flouthoc @giuseppe @Luap99 PTAL

[flouthoc]

Tests are blowing up.

[vrothberg]

@rhatdan PTAL

[vrothberg]

A bug in computing the dropped caps? Need to figure that out before 4.4.

[Luap99]

This was changed in containers/common#1240

[vrothberg]

But why are they listed as dropped? There are over 30 capabilities and other ones we don't enable by default aren't listed as dropped.

[Luap99]

Ah I see what you mean, looks like inspect uses not the container.conf default but rather the oci runtime spec default:

podman/libpod/container_inspect_linux.go

Lines 129 to 177 in 34cc61d

	// Cap add and cap drop.
	// We need a default set of capabilities to compare against.
	// The OCI generate package has one, and is commonly used, so we'll
	// use it.
	// Problem: there are 5 sets of capabilities.
	// Use the bounding set for this computation, it's the most encompassing
	// (but still not perfect).
	capAdd := []string{}
	capDrop := []string{}
	// No point in continuing if we got a spec without a Process block...
	if ctrSpec.Process != nil {
	// Max an O(1) lookup table for default bounding caps.
	boundingCaps := make(map[string]bool)
	g, err := generate.New("linux")
	if err != nil {
	return err
	}
	if !hostConfig.Privileged {
	for _, cap := range g.Config.Process.Capabilities.Bounding {
	boundingCaps[cap] = true
	}
	} else {
	// If we are privileged, use all caps.
	for _, cap := range capability.List() {
	if g.HostSpecific && cap > validate.LastCap() {
	continue
	}
	boundingCaps[fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String()))] = true
	}
	}
	// Iterate through spec caps.
	// If it's not in default bounding caps, it was added.
	// If it is, delete from the default set. Whatever remains after
	// we finish are the dropped caps.
	for _, cap := range ctrSpec.Process.Capabilities.Bounding {
	if _, ok := boundingCaps[cap]; ok {
	delete(boundingCaps, cap)
	} else {
	capAdd = append(capAdd, cap)
	}
	}
	for cap := range boundingCaps {
	capDrop = append(capDrop, cap)
	}
	// Sort CapDrop so it displays in consistent order (GH #9490)
	sort.Strings(capDrop)
	}
	hostConfig.CapAdd = capAdd
	hostConfig.CapDrop = capDrop

[Luap99]

LGTM

[vrothberg]

I'll clean up tomorrow. I am sure we can get inspect right, thanks @Luap99

[vrothberg]

It looks like NET_RAW is needed for some tests to pass using ping etc. At that point, I think its best to revert the change in c/common to unblock ongoing work.

[vrothberg]

containers/common#1245 reverts the caps changes.