mirror of
https://github.com/aljazceru/kata-containers.git
synced 2026-02-22 15:04:32 +01:00
ef4c3844a3
The target is to guarantee that containers couldn't escape to access extra devices, like vm rootfs, etc. Assume that there is a cgroup, such as `/A/B`. The `B` is container cgroup, and the `A` is what we called pod cgroup. No matter what permissions are set for the container (`B`), the `A`'s permission is always `a *:* rwm`. It leads that containers could acquire permission to access to other devices in VM that not belongs to themselves. In order to set devices cgroup properly, the order of setting cgroups is that the pod cgroup comes first and the container cgroup comes after. The `Sandbox` has a new field, `devcg_info`, to save cgroup states. To avoid setting container cgroup too early, an initialization should be done carefully. `inited`, one of the states, is a boolean to indicate if the pod cgroup is initialized. If no, the pod cgroup should be created firstly, and set default permissions. After that, the pause container cgroup is created and inherits the permissions from the pod cgroup. If whitelist mode which allows containers to access all devices in VM is enabled, then device resources from OCI spec are ignored. This feature not supports systemd cgroup and cgroup v2, since: - Systemd cgroup implemented on Agent hasn't supported devices subsystem so far, see: https://github.com/kata-containers/kata-containers/issues/7506. - Cgroup v2's device controller depends on eBPF programs, which is out of scope of cgroup. Fixes: #7507 Signed-off-by: Xuewei Niu <niuxuewei.nxw@antgroup.com>
97 lines
2.4 KiB
TOML
97 lines
2.4 KiB
TOML
[package]
|
|
name = "kata-agent"
|
|
version = "0.1.0"
|
|
authors = ["The Kata Containers community <kata-dev@lists.katacontainers.io>"]
|
|
edition = "2018"
|
|
license = "Apache-2.0"
|
|
|
|
[dependencies]
|
|
oci = { path = "../libs/oci" }
|
|
rustjail = { path = "rustjail" }
|
|
protocols = { path = "../libs/protocols", features = ["async", "with-serde"] }
|
|
lazy_static = "1.3.0"
|
|
ttrpc = { version = "0.7.1", features = ["async"], default-features = false }
|
|
protobuf = "3.2.0"
|
|
libc = "0.2.58"
|
|
nix = "0.24.2"
|
|
capctl = "0.2.0"
|
|
serde_json = "1.0.39"
|
|
scan_fmt = "0.2.3"
|
|
scopeguard = "1.0.0"
|
|
thiserror = "1.0.26"
|
|
regex = "1.5.6"
|
|
serial_test = "0.5.1"
|
|
kata-sys-util = { path = "../libs/kata-sys-util" }
|
|
kata-types = { path = "../libs/kata-types" }
|
|
|
|
# Async helpers
|
|
async-trait = "0.1.42"
|
|
async-recursion = "0.3.2"
|
|
futures = "0.3.17"
|
|
|
|
# Async runtime
|
|
tokio = { version = "1.28.1", features = ["full"] }
|
|
tokio-vsock = "0.3.1"
|
|
|
|
netlink-sys = { version = "0.7.0", features = ["tokio_socket",]}
|
|
rtnetlink = "0.8.0"
|
|
netlink-packet-utils = "0.4.1"
|
|
ipnetwork = "0.17.0"
|
|
|
|
# Note: this crate sets the slog 'max_*' features which allows the log level
|
|
# to be modified at runtime.
|
|
logging = { path = "../libs/logging" }
|
|
slog = "2.5.2"
|
|
slog-scope = "4.1.2"
|
|
slog-term = "2.9.0"
|
|
|
|
# Redirect ttrpc log calls
|
|
slog-stdlog = "4.0.0"
|
|
log = "0.4.11"
|
|
|
|
cfg-if = "1.0.0"
|
|
prometheus = { version = "0.13.0", features = ["process"] }
|
|
procfs = "0.12.0"
|
|
anyhow = "1.0.32"
|
|
cgroups = { package = "cgroups-rs", version = "0.3.3" }
|
|
|
|
# Tracing
|
|
tracing = "0.1.26"
|
|
tracing-subscriber = "0.2.18"
|
|
tracing-opentelemetry = "0.13.0"
|
|
opentelemetry = { version = "0.14.0", features = ["rt-tokio-current-thread"]}
|
|
vsock-exporter = { path = "vsock-exporter" }
|
|
|
|
# Configuration
|
|
serde = { version = "1.0.129", features = ["derive"] }
|
|
toml = "0.5.8"
|
|
clap = { version = "3.0.1", features = ["derive"] }
|
|
|
|
# Communication with the OPA service
|
|
http = { version = "0.2.8", optional = true }
|
|
reqwest = { version = "0.11.14", optional = true }
|
|
# The "vendored" feature for openssl is required for musl build
|
|
openssl = { version = "0.10.54", features = ["vendored"], optional = true }
|
|
|
|
[dev-dependencies]
|
|
tempfile = "3.1.0"
|
|
test-utils = { path = "../libs/test-utils" }
|
|
which = "4.3.0"
|
|
|
|
[workspace]
|
|
members = [
|
|
"rustjail",
|
|
]
|
|
|
|
[profile.release]
|
|
lto = true
|
|
|
|
[features]
|
|
seccomp = ["rustjail/seccomp"]
|
|
standard-oci-runtime = ["rustjail/standard-oci-runtime"]
|
|
agent-policy = ["http", "openssl", "reqwest"]
|
|
|
|
[[bin]]
|
|
name = "kata-agent"
|
|
path = "src/main.rs"
|