Affected by GO-2022-0396 and 7 other vulnerabilities

GO-2022-0396: Devices resource list treated as a blacklist by default in github.com/opencontainers/runc

GO-2022-0452: Default inheritable capabilities for linux container should be empty in github.com/opencontainers/runc

GO-2022-0914: Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc

GO-2023-1682: Rootless: /sys/fs/cgroup is writable when cgroupns isn't unshared in github.com/opencontainers/runc

GO-2023-1683: AppArmor bypass with symlinked /proc in github.com/opencontainers/runc

GO-2024-3110: Can be confused to create empty files/directories on the host in github.com/opencontainers/runc

GO-2025-3543: WITHDRAWN: Libcontainer is affected by capabilities elevation in github.com/opencontainers/runc

GO-2025-4098: Container escape and DDoS due to arbitrary write gadgets and procfs write redirects in github.com/opencontainers/runc

specconv

package

v1.0.0-rc7 Latest Latest Go to latest Published: Mar 28, 2019 License: Apache-2.0 Imports: 9 Imported by: 163

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/opencontainers/runc

Links

Documentation ¶

Rendered for

Overview ¶

Package specconv implements conversion of specifications to libcontainer configurations

Index ¶

func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error)
func Example() *specs.Spec
func SetupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error)
func ToRootless(spec *specs.Spec)
type CreateOpts

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func CreateLibcontainerConfig ¶

func CreateLibcontainerConfig(opts *CreateOpts) (*configs.Config, error)

CreateLibcontainerConfig creates a new libcontainer configuration from a given specification and a cgroup name

func Example ¶ added in v1.0.0

func Example() *specs.Spec

Example returns an example spec file, with many options set so a user can see what a standard spec file looks like.

func SetupSeccomp ¶ added in v1.0.0

func SetupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error)

func ToRootless ¶ added in v1.0.0

func ToRootless(spec *specs.Spec)

ToRootless converts the given spec file into one that should work with rootless containers (euid != 0), by removing incompatible options and adding others that are needed.

Types ¶

type CreateOpts ¶

type CreateOpts struct {
	CgroupName       string
	UseSystemdCgroup bool
	NoPivotRoot      bool
	NoNewKeyring     bool
	Spec             *specs.Spec
	RootlessEUID     bool
	RootlessCgroups  bool
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL