@@ -34,112 +34,13 @@ type ExportOptions struct {
3434func New () Generator {
3535 spec := rspec.Spec {
3636 Version : rspec .Version ,
37- Root : rspec.Root {
38- Path : "" ,
39- Readonly : false ,
40- },
4137 Process : rspec.Process {
42- Terminal : false ,
43- User : rspec.User {},
38+ User : rspec.User {},
4439 Args : []string {
4540 "sh" ,
4641 },
47- Env : []string {
48- "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin" ,
49- "TERM=xterm" ,
50- },
5142 Cwd : "/" ,
52- Capabilities : & rspec.LinuxCapabilities {
53- Bounding : []string {
54- "CAP_CHOWN" ,
55- "CAP_DAC_OVERRIDE" ,
56- "CAP_FSETID" ,
57- "CAP_FOWNER" ,
58- "CAP_MKNOD" ,
59- "CAP_NET_RAW" ,
60- "CAP_SETGID" ,
61- "CAP_SETUID" ,
62- "CAP_SETFCAP" ,
63- "CAP_SETPCAP" ,
64- "CAP_NET_BIND_SERVICE" ,
65- "CAP_SYS_CHROOT" ,
66- "CAP_KILL" ,
67- "CAP_AUDIT_WRITE" ,
68- },
69- Permitted : []string {
70- "CAP_CHOWN" ,
71- "CAP_DAC_OVERRIDE" ,
72- "CAP_FSETID" ,
73- "CAP_FOWNER" ,
74- "CAP_MKNOD" ,
75- "CAP_NET_RAW" ,
76- "CAP_SETGID" ,
77- "CAP_SETUID" ,
78- "CAP_SETFCAP" ,
79- "CAP_SETPCAP" ,
80- "CAP_NET_BIND_SERVICE" ,
81- "CAP_SYS_CHROOT" ,
82- "CAP_KILL" ,
83- "CAP_AUDIT_WRITE" ,
84- },
85- Inheritable : []string {
86- "CAP_CHOWN" ,
87- "CAP_DAC_OVERRIDE" ,
88- "CAP_FSETID" ,
89- "CAP_FOWNER" ,
90- "CAP_MKNOD" ,
91- "CAP_NET_RAW" ,
92- "CAP_SETGID" ,
93- "CAP_SETUID" ,
94- "CAP_SETFCAP" ,
95- "CAP_SETPCAP" ,
96- "CAP_NET_BIND_SERVICE" ,
97- "CAP_SYS_CHROOT" ,
98- "CAP_KILL" ,
99- "CAP_AUDIT_WRITE" ,
100- },
101- Effective : []string {
102- "CAP_CHOWN" ,
103- "CAP_DAC_OVERRIDE" ,
104- "CAP_FSETID" ,
105- "CAP_FOWNER" ,
106- "CAP_MKNOD" ,
107- "CAP_NET_RAW" ,
108- "CAP_SETGID" ,
109- "CAP_SETUID" ,
110- "CAP_SETFCAP" ,
111- "CAP_SETPCAP" ,
112- "CAP_NET_BIND_SERVICE" ,
113- "CAP_SYS_CHROOT" ,
114- "CAP_KILL" ,
115- "CAP_AUDIT_WRITE" ,
116- },
117- Ambient : []string {
118- "CAP_CHOWN" ,
119- "CAP_DAC_OVERRIDE" ,
120- "CAP_FSETID" ,
121- "CAP_FOWNER" ,
122- "CAP_MKNOD" ,
123- "CAP_NET_RAW" ,
124- "CAP_SETGID" ,
125- "CAP_SETUID" ,
126- "CAP_SETFCAP" ,
127- "CAP_SETPCAP" ,
128- "CAP_NET_BIND_SERVICE" ,
129- "CAP_SYS_CHROOT" ,
130- "CAP_KILL" ,
131- "CAP_AUDIT_WRITE" ,
132- },
133- },
134- Rlimits : []rspec.LinuxRlimit {
135- {
136- Type : "RLIMIT_NOFILE" ,
137- Hard : uint64 (1024 ),
138- Soft : uint64 (1024 ),
139- },
140- },
14143 },
142- Hostname : "mrsdalloway" ,
14344 Mounts : []rspec.Mount {
14445 {
14546 Destination : "/proc" ,
@@ -157,57 +58,22 @@ func New() Generator {
15758 Destination : "/dev/pts" ,
15859 Type : "devpts" ,
15960 Source : "devpts" ,
160- Options : []string {"nosuid" , "noexec" , "newinstance" , "ptmxmode=0666" , "mode=0620" , "gid=5" },
61+ Options : []string {"nosuid" , "noexec" , "newinstance" , "ptmxmode=0666" , "mode=0620" },
16162 },
16263 {
16364 Destination : "/dev/shm" ,
16465 Type : "tmpfs" ,
16566 Source : "shm" ,
16667 Options : []string {"nosuid" , "noexec" , "nodev" , "mode=1777" , "size=65536k" },
16768 },
168- {
169- Destination : "/dev/mqueue" ,
170- Type : "mqueue" ,
171- Source : "mqueue" ,
172- Options : []string {"nosuid" , "noexec" , "nodev" },
173- },
17469 {
17570 Destination : "/sys" ,
17671 Type : "sysfs" ,
17772 Source : "sysfs" ,
17873 Options : []string {"nosuid" , "noexec" , "nodev" , "ro" },
17974 },
18075 },
181- Linux : & rspec.Linux {
182- Resources : & rspec.LinuxResources {
183- Devices : []rspec.LinuxDeviceCgroup {
184- {
185- Allow : false ,
186- Access : "rwm" ,
187- },
188- },
189- },
190- Namespaces : []rspec.LinuxNamespace {
191- {
192- Type : "pid" ,
193- },
194- {
195- Type : "network" ,
196- },
197- {
198- Type : "ipc" ,
199- },
200- {
201- Type : "uts" ,
202- },
203- {
204- Type : "mount" ,
205- },
206- },
207- Devices : []rspec.LinuxDevice {},
208- },
20976 }
210- spec .Linux .Seccomp = seccomp .DefaultProfile (& spec )
21177 return Generator {
21278 spec : & spec ,
21379 }
0 commit comments