Switch to github.com/moby/sys/capability by kolyshkin · Pull Request #777 · opencontainers/runtime-tools

kolyshkin · 2024-09-25T22:14:47Z

~~Currently a draft pending #776 merge.~~

The github.com/moby/sys/capability package is a fork of the original
one, which is apparently no longer maintained.

For changes since the fork took place, see
https://github.com/moby/sys/blob/main/capability/CHANGELOG.md

Also, bump Go to 1.21 as this is a minimally supported version for
github.com/moby/sys/capability, and update CI accordingly.

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

/proc/sys/kernel/cap_last_cap is available since RHEL 6.7
(kernel 2.6.32-573.el6), released 9 years ago (2015-07-22).
It incorrectly returns CAP_BLOCK_SUSPEND (36), which was only added
in kernel v3.5 and was never backported to RHEL6 kernels. The
correct value for RHEL6 would be CAP_MAC_ADMIN (33).
As far as upstream kernels go, /proc/sys/kernel/cap_last_cap was
added in kernel v3.2, and a correct value depends on the kernel
version. It could be CAP_WAKE_ALARM (35), added to kernel v3.0, or
CAP_SYSLOG (34), added to kernel v2.6.38, or possibly a lesser value
for even older kernels.

thaJeztah · 2024-11-19T10:26:40Z

@kolyshkin looks like you need to fix vendoring;

go build -tags "" -ldflags "-X main.gitCommit=012d045 -X main.version=0.9.0" -race -o oci-runtime-tool ./cmd/oci-runtime-tool
go: inconsistent vendoring in /home/runner/work/runtime-tools/runtime-tools:
	github.com/moby/sys/[email protected]: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
	github.com/moby/sys/[email protected]: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod

	To ignore the vendor directory, use -mod=readonly or -mod=mod.
	To sync the vendor directory, run:
		go mod vendor

thaJeztah · 2024-12-03T11:28:52Z

@kolyshkin gentle nudge 😄

kolyshkin · 2025-02-28T23:54:44Z

@thaJeztah @cyphar sorry for the delay; this is now ready

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <[email protected]>

thaJeztah · 2025-03-01T16:16:13Z

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

No strong opinions; I know Moby has dropped support for RHEL6 a long time ago, and I'm not sure if anyone would still be depending on this (I highly doubt other runtimes would still take RHEL6 into account).

thaJeztah

LGTM

thaJeztah · 2025-03-03T10:21:17Z

@kolyshkin this needs another rebase 🙈

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <[email protected]>

The github.com/moby/sys/capability package is a fork of the original one, which apparently is no longer maintained. Also, bump Go to 1.21 as this is a minimally supported version for github.com/moby/sys/capability, and update CI accordingly. Note that "workaround for RHEL6" is removed for a number of reasons. Feel free to choose the one you like the most, either is sufficient: 1. /proc/sys/kernel/cap_last_cap is available since RHEL 6.7 (kernel 2.6.32-573.el6), released 9 years ago (2015-07-22). 2. It incorrectly returns CAP_BLOCK_SUSPEND (36), which was only added in kernel v3.5 and was never backported to RHEL6 kernels. The correct value for RHEL6 would be CAP_MAC_ADMIN (33). 3. As far as upstream kernels go, /proc/sys/kernel/cap_last_cap was added in kernel v3.2, and a correct value depends on the kernel version. It could be CAP_WAKE_ALARM (35), added to kernel v3.0, or CAP_SYSLOG (34), added to kernel v2.6.38, or possibly a lesser value for even older kernels. Signed-off-by: Kir Kolyshkin <[email protected]>

kolyshkin · 2025-03-09T21:30:08Z

Rebased

kolyshkin · 2025-03-09T22:14:01Z

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

No strong opinions; I know Moby has dropped support for RHEL6 a long time ago, and I'm not sure if anyone would still be depending on this (I highly doubt other runtimes would still take RHEL6 into account).

I just did a detailed writeup on this because removing a hack always looks suspicious and raises some questions (and so I'm answering those in advance). I'm 100% sure this is no longer needed (even for RHEL6).

thaJeztah

LGTM

rhatdan · 2025-03-11T18:02:21Z

LGTM

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <[email protected]> GPG signed by Alexander Mikhalitsyn Signed-off-by: Alexander Mikhalitsyn <[email protected]>

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Related to: moby/sys#183

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <[email protected]> GPG signed by Alexander Mikhalitsyn Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit 1f4af84)

cyphar · 2025-05-23T06:00:57Z

Lucky number 777 😸

kolyshkin mentioned this pull request Sep 25, 2024

pgk/capabilities: modernize, switch to github.com/moby/sys/capability containers/common#2167

Merged

kolyshkin force-pushed the moby-cap branch from 4711642 to 54eac8a Compare September 25, 2024 22:21

kolyshkin marked this pull request as ready for review September 25, 2024 22:22

kolyshkin requested a review from a team as a code owner September 25, 2024 22:22

kolyshkin marked this pull request as draft September 25, 2024 22:22

This was referenced Sep 25, 2024

Add Go 1.22 and 1.23, rm old versions, bump CI actions, bump golangci-linter #776

Merged

Don't set ambient caps; switch to moby/sys/capability containers/buildah#5754

Merged

vendor: switch to moby/sys/capability containers/podman#24114

Merged

kolyshkin force-pushed the moby-cap branch from 54eac8a to 5b7a7fe Compare October 9, 2024 21:02

kolyshkin force-pushed the moby-cap branch from 5b7a7fe to bff7cf3 Compare November 8, 2024 23:31

kolyshkin marked this pull request as ready for review November 11, 2024 19:11

kolyshkin force-pushed the moby-cap branch from bff7cf3 to 4d1ff39 Compare November 11, 2024 19:13

thaJeztah mentioned this pull request Nov 27, 2024

release 0.9.1 #774

Open

kolyshkin force-pushed the moby-cap branch from 4d1ff39 to ae7f7d1 Compare February 28, 2025 23:53

This was referenced Mar 1, 2025

*: remove RHEL6 hack and loosen capability validation #359

Closed

replace hashicorp/go-multierror with errors.Join #778

Open

This was referenced Mar 1, 2025

deps: switch to github.com/moby/sys/capability canonical/lxd#15091

Merged

Switch users to moby/sys/capability moby/sys#183

Closed

thaJeztah previously approved these changes Mar 1, 2025

View reviewed changes

kolyshkin dismissed thaJeztah’s stale review via c2dadba March 9, 2025 21:30

kolyshkin force-pushed the moby-cap branch from ae7f7d1 to c2dadba Compare March 9, 2025 21:30

kolyshkin requested a review from thaJeztah March 9, 2025 22:10

thaJeztah approved these changes Mar 9, 2025

View reviewed changes

cyphar approved these changes May 23, 2025

View reviewed changes

cyphar merged commit 0ea5ed0 into opencontainers:master May 23, 2025
9 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Switch to github.com/moby/sys/capability#777

Switch to github.com/moby/sys/capability#777
cyphar merged 1 commit intoopencontainers:masterfrom
kolyshkin:moby-cap

kolyshkin commented Sep 25, 2024 •

edited

Loading

Uh oh!

thaJeztah commented Nov 19, 2024

Uh oh!

thaJeztah commented Dec 3, 2024

Uh oh!

kolyshkin commented Feb 28, 2025

Uh oh!

thaJeztah commented Mar 1, 2025

Uh oh!

thaJeztah left a comment

Uh oh!

thaJeztah commented Mar 3, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

thaJeztah left a comment

Uh oh!

rhatdan commented Mar 11, 2025

Uh oh!

cyphar commented May 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

kolyshkin commented Sep 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thaJeztah commented Nov 19, 2024

Uh oh!

thaJeztah commented Dec 3, 2024

Uh oh!

kolyshkin commented Feb 28, 2025

Uh oh!

thaJeztah commented Mar 1, 2025

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Mar 3, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

rhatdan commented Mar 11, 2025

Uh oh!

cyphar commented May 23, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kolyshkin commented Sep 25, 2024 •

edited

Loading