1 /* 2 Copyright 2014 The Kubernetes Authors. 3 4 Licensed under the Apache License, Version 2.0 (the "License"); 5 you may not use this file except in compliance with the License. 6 You may obtain a copy of the License at 7 8 http://www.apache.org/licenses/LICENSE-2.0 9 10 Unless required by applicable law or agreed to in writing, software 11 distributed under the License is distributed on an "AS IS" BASIS, 12 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 13 See the License for the specific language governing permissions and 14 limitations under the License. 15 */ 16 17 package capabilities 18 19 import ( 20 "sync" 21 ) 22 23 // Capabilities defines the set of capabilities available within the system. 24 // For now these are global. Eventually they may be per-user 25 type Capabilities struct { 26 AllowPrivileged bool 27 28 // Pod sources from which to allow privileged capabilities like host networking, sharing the host 29 // IPC namespace, and sharing the host PID namespace. 30 PrivilegedSources PrivilegedSources 31 32 // PerConnectionBandwidthLimitBytesPerSec limits the throughput of each connection (currently only used for proxy, exec, attach) 33 PerConnectionBandwidthLimitBytesPerSec int64 34 } 35 36 // PrivilegedSources defines the pod sources allowed to make privileged requests for certain types 37 // of capabilities like host networking, sharing the host IPC namespace, and sharing the host PID namespace. 38 type PrivilegedSources struct { 39 // List of pod sources for which using host network is allowed. 40 HostNetworkSources []string 41 42 // List of pod sources for which using host pid namespace is allowed. 43 HostPIDSources []string 44 45 // List of pod sources for which using host ipc is allowed. 46 HostIPCSources []string 47 } 48 49 var capInstance struct { 50 once sync.Once 51 lock sync.Mutex 52 capabilities *Capabilities 53 } 54 55 // Initialize the capability set. This can only be done once per binary, subsequent calls are ignored. 56 func Initialize(c Capabilities) { 57 // Only do this once 58 capInstance.once.Do(func() { 59 capInstance.capabilities = &c 60 }) 61 } 62 63 // Setup the capability set. It wraps Initialize for improving usability. 64 func Setup(allowPrivileged bool, perConnectionBytesPerSec int64) { 65 Initialize(Capabilities{ 66 AllowPrivileged: allowPrivileged, 67 PerConnectionBandwidthLimitBytesPerSec: perConnectionBytesPerSec, 68 }) 69 } 70 71 // SetForTests sets capabilities for tests. Convenience method for testing. This should only be called from tests. 72 func SetForTests(c Capabilities) { 73 capInstance.lock.Lock() 74 defer capInstance.lock.Unlock() 75 capInstance.capabilities = &c 76 } 77 78 // Get returns a read-only copy of the system capabilities. 79 func Get() Capabilities { 80 capInstance.lock.Lock() 81 defer capInstance.lock.Unlock() 82 // This check prevents clobbering of capabilities that might've been set via SetForTests 83 if capInstance.capabilities == nil { 84 Initialize(Capabilities{ 85 AllowPrivileged: false, 86 PrivilegedSources: PrivilegedSources{ 87 HostNetworkSources: []string{}, 88 HostPIDSources: []string{}, 89 HostIPCSources: []string{}, 90 }, 91 }) 92 } 93 return *capInstance.capabilities 94 } 95