-
Notifications
You must be signed in to change notification settings - Fork 784
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
11da010
commit 9e378a5
Showing
77 changed files
with
1,048 additions
and
268 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| From 6583648f325f98bf5aed35b3a90ef9132bead309 Mon Sep 17 00:00:00 2001 | ||
| From 3198c607c243bd4363eadc7d9223e3a743f85215 Mon Sep 17 00:00:00 2001 | ||
| From: Konstantinos Tsakalozos <[email protected]> | ||
| Date: Wed, 3 Mar 2021 18:19:37 +0200 | ||
| Subject: [PATCH] Kubelite integration | ||
|
|
@@ -19,10 +19,10 @@ Subject: [PATCH] Kubelite integration | |
| create mode 100644 cmd/kubelite/kubelite.go | ||
|
|
||
| diff --git a/cmd/kube-apiserver/app/server.go b/cmd/kube-apiserver/app/server.go | ||
| index 8c2d2a94d99..2351c86fa78 100644 | ||
| index 411567a4175..a871cc9c975 100644 | ||
| --- a/cmd/kube-apiserver/app/server.go | ||
| +++ b/cmd/kube-apiserver/app/server.go | ||
| @@ -91,7 +91,7 @@ func checkNonZeroInsecurePort(fs *pflag.FlagSet) error { | ||
| @@ -96,7 +96,7 @@ func checkNonZeroInsecurePort(fs *pflag.FlagSet) error { | ||
| } | ||
|
|
||
| // NewAPIServerCommand creates a *cobra.Command object with default parameters | ||
|
|
@@ -31,7 +31,7 @@ index 8c2d2a94d99..2351c86fa78 100644 | |
| s := options.NewServerRunOptions() | ||
| cmd := &cobra.Command{ | ||
| Use: "kube-apiserver", | ||
| @@ -127,8 +127,11 @@ cluster's shared state through which all other components interact.`, | ||
| @@ -138,8 +138,11 @@ cluster's shared state through which all other components interact.`, | ||
| if errs := completedOptions.Validate(); len(errs) != 0 { | ||
| return utilerrors.NewAggregate(errs) | ||
| } | ||
|
|
@@ -46,10 +46,10 @@ index 8c2d2a94d99..2351c86fa78 100644 | |
| Args: func(cmd *cobra.Command, args []string) error { | ||
| for _, arg := range args { | ||
| diff --git a/cmd/kube-scheduler/app/server.go b/cmd/kube-scheduler/app/server.go | ||
| index dc6cc055415..d7674db4b01 100644 | ||
| index b65f4e74d09..0885de22da1 100644 | ||
| --- a/cmd/kube-scheduler/app/server.go | ||
| +++ b/cmd/kube-scheduler/app/server.go | ||
| @@ -117,7 +117,11 @@ func runCommand(cmd *cobra.Command, opts *options.Options, registryOptions ...Op | ||
| @@ -120,7 +120,11 @@ func runCommand(cmd *cobra.Command, opts *options.Options, registryOptions ...Op | ||
| ctx, cancel := context.WithCancel(context.Background()) | ||
| defer cancel() | ||
| go func() { | ||
|
|
@@ -63,7 +63,7 @@ index dc6cc055415..d7674db4b01 100644 | |
| cancel() | ||
| }() | ||
| diff --git a/cmd/kubelet/app/server.go b/cmd/kubelet/app/server.go | ||
| index 59662e425bb..c3e4408685a 100644 | ||
| index 43dfd8d4f45..015a3df23f3 100644 | ||
| --- a/cmd/kubelet/app/server.go | ||
| +++ b/cmd/kubelet/app/server.go | ||
| @@ -112,7 +112,7 @@ const ( | ||
|
|
@@ -75,7 +75,7 @@ index 59662e425bb..c3e4408685a 100644 | |
| cleanFlagSet := pflag.NewFlagSet(componentKubelet, pflag.ContinueOnError) | ||
| cleanFlagSet.SetNormalizeFunc(cliflag.WordSepNormalizeFunc) | ||
| kubeletFlags := options.NewKubeletFlags() | ||
| @@ -279,7 +279,12 @@ HTTP server: The kubelet can also listen for HTTP and respond to a simple API | ||
| @@ -287,7 +287,12 @@ HTTP server: The kubelet can also listen for HTTP and respond to a simple API | ||
| klog.ErrorS(err, "kubelet running with insufficient permissions") | ||
| } | ||
| // set up signal context here in order to be reused by kubelet and docker shim | ||
|
|
@@ -89,8 +89,8 @@ index 59662e425bb..c3e4408685a 100644 | |
|
|
||
| // make the kubelet's config safe for logging | ||
| config := kubeletServer.KubeletConfiguration.DeepCopy() | ||
| @@ -290,7 +295,7 @@ HTTP server: The kubelet can also listen for HTTP and respond to a simple API | ||
| klog.V(5).InfoS("KubeletConfiguration", "configuration", kubeletServer.KubeletConfiguration) | ||
| @@ -298,7 +303,7 @@ HTTP server: The kubelet can also listen for HTTP and respond to a simple API | ||
| klog.V(5).InfoS("KubeletConfiguration", "configuration", config) | ||
|
|
||
| // run the kubelet | ||
| - if err := Run(ctx, kubeletServer, kubeletDeps, utilfeature.DefaultFeatureGate); err != nil { | ||
|
|
@@ -394,10 +394,10 @@ index 00000000000..667b24f68e6 | |
| + println("Stopping kubelite") | ||
| +} | ||
| diff --git a/pkg/volume/csi/csi_plugin.go b/pkg/volume/csi/csi_plugin.go | ||
| index e48b3d6deb7..a64d9d045e0 100644 | ||
| index 0ae6d084f0e..f27f9e1b812 100644 | ||
| --- a/pkg/volume/csi/csi_plugin.go | ||
| +++ b/pkg/volume/csi/csi_plugin.go | ||
| @@ -237,20 +237,24 @@ func (p *csiPlugin) Init(host volume.VolumeHost) error { | ||
| @@ -243,20 +243,24 @@ func (p *csiPlugin) Init(host volume.VolumeHost) error { | ||
| } | ||
|
|
||
| // Initializing the label management channels | ||
|
|
||
36 changes: 36 additions & 0 deletions
36
build-scripts/patches/runc/0001-apparmor-change-profile-immediately-not-on-exec.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,36 @@ | ||
| From 08607d16c6f9ef393e18e0f62fcd967e91c5f7c9 Mon Sep 17 00:00:00 2001 | ||
| From: Alberto Mardegan <[email protected]> | ||
| Date: Wed, 16 Jun 2021 15:04:16 +0300 | ||
| Subject: [PATCH 1/3] apparmor: change profile immediately, not on exec | ||
|
|
||
| --- | ||
| libcontainer/apparmor/apparmor_linux.go | 8 ++++---- | ||
| 1 file changed, 4 insertions(+), 4 deletions(-) | ||
|
|
||
| diff --git a/libcontainer/apparmor/apparmor_linux.go b/libcontainer/apparmor/apparmor_linux.go | ||
| index 5da14fb3..93ede183 100644 | ||
| --- a/libcontainer/apparmor/apparmor_linux.go | ||
| +++ b/libcontainer/apparmor/apparmor_linux.go | ||
| @@ -49,9 +49,9 @@ func setProcAttr(attr, value string) error { | ||
| return err | ||
| } | ||
|
|
||
| -// changeOnExec reimplements aa_change_onexec from libapparmor in Go | ||
| -func changeOnExec(name string) error { | ||
| - if err := setProcAttr("exec", "exec "+name); err != nil { | ||
| +// changeProfile reimplements aa_change_profile from libapparmor in Go | ||
| +func changeProfile(name string) error { | ||
| + if err := setProcAttr("current", "changeprofile "+name); err != nil { | ||
| return fmt.Errorf("apparmor failed to apply profile: %s", err) | ||
| } | ||
| return nil | ||
| @@ -64,5 +64,5 @@ func ApplyProfile(name string) error { | ||
| return nil | ||
| } | ||
|
|
||
| - return changeOnExec(name) | ||
| + return changeProfile(name) | ||
| } | ||
| -- | ||
| 2.25.1 | ||
|
|
44 changes: 44 additions & 0 deletions
44
build-scripts/patches/runc/0002-setns_init_linux-set-the-NNP-flag-after-changing-the.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| From 66fd3c5129599834de8262ee90a1ab2bf6b68ff0 Mon Sep 17 00:00:00 2001 | ||
| From: Alberto Mardegan <[email protected]> | ||
| Date: Wed, 16 Jun 2021 15:04:40 +0300 | ||
| Subject: [PATCH 2/3] setns_init_linux: set the NNP flag after changing the | ||
| apparmor profile | ||
|
|
||
| With the current version of the AppArmor kernel module, it's not | ||
| possible to switch the AppArmor profile if the NoNewPrivileges flag is | ||
| set. So, we invert the order of the two operations. | ||
| --- | ||
| libcontainer/setns_init_linux.go | 10 +++++----- | ||
| 1 file changed, 5 insertions(+), 5 deletions(-) | ||
|
|
||
| diff --git a/libcontainer/setns_init_linux.go b/libcontainer/setns_init_linux.go | ||
| index 97987f1d..eec427a0 100644 | ||
| --- a/libcontainer/setns_init_linux.go | ||
| +++ b/libcontainer/setns_init_linux.go | ||
| @@ -57,11 +57,6 @@ func (l *linuxSetnsInit) Init() error { | ||
| return err | ||
| } | ||
| } | ||
| - if l.config.NoNewPrivileges { | ||
| - if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { | ||
| - return err | ||
| - } | ||
| - } | ||
| if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil { | ||
| return err | ||
| } | ||
| @@ -80,6 +75,11 @@ func (l *linuxSetnsInit) Init() error { | ||
| if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil { | ||
| return err | ||
| } | ||
| + if l.config.NoNewPrivileges { | ||
| + if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { | ||
| + return err | ||
| + } | ||
| + } | ||
| // Set seccomp as close to execve as possible, so as few syscalls take | ||
| // place afterward (reducing the amount of syscalls that users need to | ||
| // enable in their seccomp profiles). | ||
| -- | ||
| 2.25.1 | ||
|
|
55 changes: 55 additions & 0 deletions
55
build-scripts/patches/runc/0003-standard_init_linux-change-AppArmor-profile-as-late-.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| From 728d989c7643a87ca9d57e3135e35c7af833bae0 Mon Sep 17 00:00:00 2001 | ||
| From: Alberto Mardegan <[email protected]> | ||
| Date: Thu, 17 Jun 2021 14:31:35 +0300 | ||
| Subject: [PATCH 3/3] standard_init_linux: change AppArmor profile as late as | ||
| possible | ||
|
|
||
| --- | ||
| libcontainer/standard_init_linux.go | 18 +++++++++--------- | ||
| 1 file changed, 9 insertions(+), 9 deletions(-) | ||
|
|
||
| diff --git a/libcontainer/standard_init_linux.go b/libcontainer/standard_init_linux.go | ||
| index d77022ad..6f43da5f 100644 | ||
| --- a/libcontainer/standard_init_linux.go | ||
| +++ b/libcontainer/standard_init_linux.go | ||
| @@ -114,10 +114,6 @@ func (l *linuxStandardInit) Init() error { | ||
| return errors.Wrap(err, "sethostname") | ||
| } | ||
| } | ||
| - if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil { | ||
| - return errors.Wrap(err, "apply apparmor profile") | ||
| - } | ||
| - | ||
| for key, value := range l.config.Config.Sysctl { | ||
| if err := writeSystemProperty(key, value); err != nil { | ||
| return errors.Wrapf(err, "write sysctl key %s", key) | ||
| @@ -137,17 +133,21 @@ func (l *linuxStandardInit) Init() error { | ||
| if err != nil { | ||
| return errors.Wrap(err, "get pdeath signal") | ||
| } | ||
| - if l.config.NoNewPrivileges { | ||
| - if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { | ||
| - return errors.Wrap(err, "set nonewprivileges") | ||
| - } | ||
| - } | ||
| // Tell our parent that we're ready to Execv. This must be done before the | ||
| // Seccomp rules have been applied, because we need to be able to read and | ||
| // write to a socket. | ||
| if err := syncParentReady(l.pipe); err != nil { | ||
| return errors.Wrap(err, "sync ready") | ||
| } | ||
| + if err := apparmor.ApplyProfile(l.config.AppArmorProfile); err != nil { | ||
| + return errors.Wrap(err, "apply apparmor profile") | ||
| + } | ||
| + if l.config.NoNewPrivileges { | ||
| + if err := unix.Prctl(unix.PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0); err != nil { | ||
| + return errors.Wrap(err, "set nonewprivileges") | ||
| + } | ||
| + } | ||
| + | ||
| if err := selinux.SetExecLabel(l.config.ProcessLabel); err != nil { | ||
| return errors.Wrap(err, "set process label") | ||
| } | ||
| -- | ||
| 2.25.1 | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.