Switch to github.com/moby/sys/capability by kolyshkin · Pull Request #777 · opencontainers/runtime-tools

kolyshkin · 2024-09-25T22:14:47Z

~~Currently a draft pending #776 merge.~~

The github.com/moby/sys/capability package is a fork of the original
one, which is apparently no longer maintained.

For changes since the fork took place, see
https://github.com/moby/sys/blob/main/capability/CHANGELOG.md

Also, bump Go to 1.21 as this is a minimally supported version for
github.com/moby/sys/capability, and update CI accordingly.

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

/proc/sys/kernel/cap_last_cap is available since RHEL 6.7
(kernel 2.6.32-573.el6), released 9 years ago (2015-07-22).
It incorrectly returns CAP_BLOCK_SUSPEND (36), which was only added
in kernel v3.5 and was never backported to RHEL6 kernels. The
correct value for RHEL6 would be CAP_MAC_ADMIN (33).
As far as upstream kernels go, /proc/sys/kernel/cap_last_cap was
added in kernel v3.2, and a correct value depends on the kernel
version. It could be CAP_WAKE_ALARM (35), added to kernel v3.0, or
CAP_SYSLOG (34), added to kernel v2.6.38, or possibly a lesser value
for even older kernels.

thaJeztah · 2024-11-19T10:26:40Z

@kolyshkin looks like you need to fix vendoring;

go build -tags "" -ldflags "-X main.gitCommit=012d045 -X main.version=0.9.0" -race -o oci-runtime-tool ./cmd/oci-runtime-tool
go: inconsistent vendoring in /home/runner/work/runtime-tools/runtime-tools:
github.com/moby/sys/capability@v0.4.0: is explicitly required in go.mod, but not marked as explicit in vendor/modules.txt
github.com/moby/sys/capability@v0.3.0: is marked as explicit in vendor/modules.txt, but not explicitly required in go.mod
To ignore the vendor directory, use -mod=readonly or -mod=mod.
To sync the vendor directory, run:
go mod vendor

thaJeztah · 2024-12-03T11:28:52Z

@kolyshkin gentle nudge 😄

kolyshkin · 2025-02-28T23:54:44Z

@thaJeztah @cyphar sorry for the delay; this is now ready

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

thaJeztah · 2025-03-01T16:16:13Z

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:

No strong opinions; I know Moby has dropped support for RHEL6 a long time ago, and I'm not sure if anyone would still be depending on this (I highly doubt other runtimes would still take RHEL6 into account).

thaJeztah

LGTM

thaJeztah · 2025-03-03T10:21:17Z

@kolyshkin this needs another rebase 🙈

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

The github.com/moby/sys/capability package is a fork of the original one, which apparently is no longer maintained. Also, bump Go to 1.21 as this is a minimally supported version for github.com/moby/sys/capability, and update CI accordingly. Note that "workaround for RHEL6" is removed for a number of reasons. Feel free to choose the one you like the most, either is sufficient: 1. /proc/sys/kernel/cap_last_cap is available since RHEL 6.7 (kernel 2.6.32-573.el6), released 9 years ago (2015-07-22). 2. It incorrectly returns CAP_BLOCK_SUSPEND (36), which was only added in kernel v3.5 and was never backported to RHEL6 kernels. The correct value for RHEL6 would be CAP_MAC_ADMIN (33). 3. As far as upstream kernels go, /proc/sys/kernel/cap_last_cap was added in kernel v3.2, and a correct value depends on the kernel version. It could be CAP_WAKE_ALARM (35), added to kernel v3.0, or CAP_SYSLOG (34), added to kernel v2.6.38, or possibly a lesser value for even older kernels. Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>

kolyshkin · 2025-03-09T21:30:08Z

Rebased

kolyshkin · 2025-03-09T22:14:01Z

Note that "workaround for RHEL6" is removed for a number of reasons.
Feel free to choose the one you like the most, either is sufficient:
No strong opinions; I know Moby has dropped support for RHEL6 a long time ago, and I'm not sure if anyone would still be depending on this (I highly doubt other runtimes would still take RHEL6 into account).

I just did a detailed writeup on this because removing a hack always looks suspicious and raises some questions (and so I'm answering those in advance). I'm 100% sure this is no longer needed (even for RHEL6).

thaJeztah

LGTM

rhatdan · 2025-03-11T18:02:21Z

LGTM

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> GPG signed by Alexander Mikhalitsyn Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com>

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Related to: moby/sys#183

The github.com/moby/sys/capability package is a fork of the original one, which is apparently no longer maintained. For changes since the fork took place, see https://github.com/moby/sys/blob/main/capability/CHANGELOG.md (The indirect dependency still remains because of runtime-tools; this is being fixed in opencontainers/runtime-tools#777). Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com> GPG signed by Alexander Mikhalitsyn Signed-off-by: Alexander Mikhalitsyn <aleksandr.mikhalitsyn@canonical.com> (cherry picked from commit 1f4af84)

cyphar · 2025-05-23T06:00:57Z

Lucky number 777 😸

kolyshkin mentioned this pull request Sep 25, 2024
pgk/capabilities: modernize, switch to github.com/moby/sys/capability containers/common#2167
Merged

kolyshkin force-pushed the moby-cap branch from 4711642 to 54eac8aCompare September 25, 2024 22:21

kolyshkin marked this pull request as ready for review September 25, 2024 22:22

kolyshkin requested a review from a team as a code owner September 25, 2024 22:22

kolyshkin marked this pull request as draft September 25, 2024 22:22

This was referenced Sep 25, 2024
Add Go 1.22 and 1.23, rm old versions, bump CI actions, bump golangci-linter #776
Merged
Don't set ambient caps; switch to moby/sys/capability podman-container-tools/buildah#5754
Merged
vendor: switch to moby/sys/capability podman-container-tools/podman#24114
Merged

kolyshkin force-pushed the moby-cap branch from 54eac8a to 5b7a7feCompare October 9, 2024 21:02

kolyshkin force-pushed the moby-cap branch from 5b7a7fe to bff7cf3Compare November 8, 2024 23:31

kolyshkin marked this pull request as ready for review November 11, 2024 19:11

kolyshkin force-pushed the moby-cap branch from bff7cf3 to 4d1ff39Compare November 11, 2024 19:13

thaJeztah mentioned this pull request Nov 27, 2024
release 0.9.1 #774
Open

kolyshkin force-pushed the moby-cap branch from 4d1ff39 to ae7f7d1Compare February 28, 2025 23:53

This was referenced Mar 1, 2025
*: remove RHEL6 hack and loosen capability validation #359
Closed
replace hashicorp/go-multierror with errors.Join #778
Open

This was referenced Mar 1, 2025
deps: switch to github.com/moby/sys/capability canonical/lxd#15091
Merged
Switch users to moby/sys/capability moby/sys#183
Closed

thaJeztah previously approved these changes Mar 1, 2025
View reviewed changes

kolyshkin dismissed thaJeztah’s stale review via c2dadbaMarch 9, 2025 21:30

kolyshkin force-pushed the moby-cap branch from ae7f7d1 to c2dadbaCompare March 9, 2025 21:30

kolyshkin requested a review from thaJeztah March 9, 2025 22:10

thaJeztah approved these changes Mar 9, 2025
View reviewed changes

cyphar approved these changes May 23, 2025
View reviewed changes

cyphar merged commit 0ea5ed0 into opencontainers:masterMay 23, 2025

Navigation Menu

Uh oh!

Switch to github.com/moby/sys/capability - #777

Switch to github.com/moby/sys/capability#777
cyphar merged 1 commit into
opencontainers:masterfrom
kolyshkin:moby-cap

kolyshkin commented Sep 25, 2024•
edited
Loading

Uh oh!

thaJeztah commented Nov 19, 2024

Uh oh!

thaJeztah commented Dec 3, 2024

Uh oh!

kolyshkin commented Feb 28, 2025

Uh oh!

thaJeztah commented Mar 1, 2025

Uh oh!

thaJeztah left a comment

Uh oh!

thaJeztah commented Mar 3, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

thaJeztah left a comment

Uh oh!

rhatdan commented Mar 11, 2025

Uh oh!

cyphar commented May 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

kolyshkin commented Sep 25, 2024• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

thaJeztah commented Nov 19, 2024

Uh oh!

thaJeztah commented Dec 3, 2024

Uh oh!

kolyshkin commented Feb 28, 2025

Uh oh!

thaJeztah commented Mar 1, 2025

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Mar 3, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

kolyshkin commented Mar 9, 2025

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

rhatdan commented Mar 11, 2025

Uh oh!

cyphar commented May 23, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

kolyshkin commented Sep 25, 2024•
edited
Loading