Gentoo Archives: gentoo-commits

From: "Manuel Rüger" <mrueg@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] repo/gentoo:master commit in: app-emulation/docker/, app-emulation/docker/files/
Date: Sun, 28 Oct 2018 17:30:21
Message-Id: 1540747729.bf1218d4bcf8d5909886ccee0177cd92b68f01e0.mrueg@gentoo
1 commit: bf1218d4bcf8d5909886ccee0177cd92b68f01e0
2 Author: Manuel Rüger <mrueg <AT> gentoo <DOT> org>
3 AuthorDate: Sun Oct 28 17:26:09 2018 +0000
4 Commit: Manuel Rüger <mrueg <AT> gentoo <DOT> org>
5 CommitDate: Sun Oct 28 17:28:49 2018 +0000
6 URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bf1218d4
7
8 app-emulation/docker: Add new version of apparmor profile patch
9
10 Signed-off-by: Manuel Rüger <mrueg <AT> gentoo.org>
11 Package-Manager: Portage-2.3.51, Repoman-2.3.11
12
13 app-emulation/docker/docker-18.03.1-r1.ebuild | 303 +++++++++++++++++++++
14 .../bsc1073877-docker-apparmor-add-signal-r2.patch | 72 +++++
15 2 files changed, 375 insertions(+)
16
17 diff --git a/app-emulation/docker/docker-18.03.1-r1.ebuild b/app-emulation/docker/docker-18.03.1-r1.ebuild
18 new file mode 100644
19 index 00000000000..0af07da23fd
20 --- /dev/null
21 +++ b/app-emulation/docker/docker-18.03.1-r1.ebuild
22 @@ -0,0 +1,303 @@
23 +# Copyright 1999-2018 Gentoo Authors
24 +# Distributed under the terms of the GNU General Public License v2
25 +
26 +EAPI=6
27 +
28 +EGO_PN="github.com/docker/docker-ce"
29 +
30 +if [[ ${PV} = *9999* ]]; then
31 + # Docker cannot be fetched via "go get", thanks to autogenerated code
32 + EGIT_REPO_URI="https://${EGO_PN}.git"
33 + EGIT_CHECKOUT_DIR="${WORKDIR}/${P}/src/${EGO_PN}"
34 + inherit git-r3
35 +else
36 + inherit versionator
37 + if [ "$(get_version_component_count)" = 4 ]; then
38 + MY_PV="$(replace_version_separator 3 '-ce-')"
39 + else
40 + MY_PV="$PV-ce"
41 + fi
42 + DOCKER_GITCOMMIT="9ee9f40"
43 + EGIT_COMMIT="v${MY_PV}"
44 + SRC_URI="https://${EGO_PN}/archive/${EGIT_COMMIT}.tar.gz -> ${P}.tar.gz"
45 + KEYWORDS="~amd64 ~arm"
46 + [ "$DOCKER_GITCOMMIT" ] || die "DOCKER_GITCOMMIT must be added manually for each bump!"
47 + inherit golang-vcs-snapshot
48 +fi
49 +inherit bash-completion-r1 golang-base linux-info systemd udev user
50 +
51 +DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
52 +HOMEPAGE="https://dockerproject.org"
53 +LICENSE="Apache-2.0"
54 +SLOT="0"
55 +IUSE="apparmor aufs btrfs +container-init +device-mapper hardened +overlay pkcs11 seccomp"
56 +
57 +# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
58 +CDEPEND="
59 + >=dev-db/sqlite-3.7.9:3
60 + device-mapper? (
61 + >=sys-fs/lvm2-2.02.89[thin]
62 + )
63 + seccomp? ( >=sys-libs/libseccomp-2.2.1 )
64 + apparmor? ( sys-libs/libapparmor )
65 +"
66 +
67 +DEPEND="
68 + ${CDEPEND}
69 +
70 + dev-go/go-md2man
71 +
72 + btrfs? (
73 + >=sys-fs/btrfs-progs-3.16.1
74 + )
75 +"
76 +
77 +# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#runtime-dependencies
78 +# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#optional-dependencies
79 +RDEPEND="
80 + ${CDEPEND}
81 + >=net-firewall/iptables-1.4
82 + sys-process/procps
83 + >=dev-vcs/git-1.7
84 + >=app-arch/xz-utils-4.9
85 + dev-libs/libltdl
86 + ~app-emulation/containerd-1.0.3
87 + ~app-emulation/runc-1.0.0_rc5[apparmor?,seccomp?]
88 + ~app-emulation/docker-proxy-0.8.0_p20180411
89 + container-init? ( >=sys-process/tini-0.16.1[static] )
90 +"
91 +
92 +RESTRICT="installsources strip"
93 +
94 +S="${WORKDIR}/${P}/src/${EGO_PN}"
95 +
96 +PATCHES=( "${FILESDIR}"/bsc1073877-docker-apparmor-add-signal-r1.patch )
97 +
98 +# see "contrib/check-config.sh" from upstream's sources
99 +CONFIG_CHECK="
100 + ~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
101 + ~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
102 + ~KEYS
103 + ~VETH ~BRIDGE ~BRIDGE_NETFILTER
104 + ~NF_NAT_IPV4 ~IP_NF_FILTER ~IP_NF_TARGET_MASQUERADE
105 + ~NETFILTER_XT_MATCH_ADDRTYPE ~NETFILTER_XT_MATCH_CONNTRACK ~NETFILTER_XT_MATCH_IPVS
106 + ~IP_NF_NAT ~NF_NAT ~NF_NAT_NEEDED
107 + ~POSIX_MQUEUE
108 +
109 + ~USER_NS
110 + ~SECCOMP
111 + ~CGROUP_PIDS
112 + ~MEMCG_SWAP ~MEMCG_SWAP_ENABLED
113 +
114 + ~BLK_CGROUP ~BLK_DEV_THROTTLING ~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
115 + ~CGROUP_PERF
116 + ~CGROUP_HUGETLB
117 + ~NET_CLS_CGROUP
118 + ~CFS_BANDWIDTH ~FAIR_GROUP_SCHED ~RT_GROUP_SCHED
119 + ~IP_VS ~IP_VS_PROTO_TCP ~IP_VS_PROTO_UDP ~IP_VS_NFCT ~IP_VS_RR
120 +
121 + ~VXLAN
122 + ~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH ~XFRM_ALGO ~XFRM_USER
123 + ~IPVLAN
124 + ~MACVLAN ~DUMMY
125 +"
126 +
127 +ERROR_KEYS="CONFIG_KEYS: is mandatory"
128 +ERROR_MEMCG_SWAP="CONFIG_MEMCG_SWAP: is required if you wish to limit swap usage of containers"
129 +ERROR_RESOURCE_COUNTERS="CONFIG_RESOURCE_COUNTERS: is optional for container statistics gathering"
130 +
131 +ERROR_BLK_CGROUP="CONFIG_BLK_CGROUP: is optional for container statistics gathering"
132 +ERROR_IOSCHED_CFQ="CONFIG_IOSCHED_CFQ: is optional for container statistics gathering"
133 +ERROR_CGROUP_PERF="CONFIG_CGROUP_PERF: is optional for container statistics gathering"
134 +ERROR_CFS_BANDWIDTH="CONFIG_CFS_BANDWIDTH: is optional for container statistics gathering"
135 +ERROR_XFRM_ALGO="CONFIG_XFRM_ALGO: is optional for secure networks"
136 +ERROR_XFRM_USER="CONFIG_XFRM_USER: is optional for secure networks"
137 +
138 +pkg_setup() {
139 + if kernel_is lt 3 10; then
140 + ewarn ""
141 + ewarn "Using Docker with kernels older than 3.10 is unstable and unsupported."
142 + ewarn " - http://docs.docker.com/engine/installation/binaries/#check-kernel-dependencies"
143 + fi
144 +
145 + if kernel_is le 3 18; then
146 + CONFIG_CHECK+="
147 + ~RESOURCE_COUNTERS
148 + "
149 + fi
150 +
151 + if kernel_is le 3 13; then
152 + CONFIG_CHECK+="
153 + ~NETPRIO_CGROUP
154 + "
155 + else
156 + CONFIG_CHECK+="
157 + ~CGROUP_NET_PRIO
158 + "
159 + fi
160 +
161 + if kernel_is lt 4 5; then
162 + CONFIG_CHECK+="
163 + ~MEMCG_KMEM
164 + "
165 + ERROR_MEMCG_KMEM="CONFIG_MEMCG_KMEM: is optional"
166 + fi
167 +
168 + if kernel_is lt 4 7; then
169 + CONFIG_CHECK+="
170 + ~DEVPTS_MULTIPLE_INSTANCES
171 + "
172 + fi
173 +
174 + if use aufs; then
175 + CONFIG_CHECK+="
176 + ~AUFS_FS
177 + ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
178 + "
179 + ERROR_AUFS_FS="CONFIG_AUFS_FS: is required to be set if and only if aufs-sources are used instead of aufs4/aufs3"
180 + fi
181 +
182 + if use btrfs; then
183 + CONFIG_CHECK+="
184 + ~BTRFS_FS
185 + ~BTRFS_FS_POSIX_ACL
186 + "
187 + fi
188 +
189 + if use device-mapper; then
190 + CONFIG_CHECK+="
191 + ~BLK_DEV_DM ~DM_THIN_PROVISIONING ~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
192 + "
193 + fi
194 +
195 + if use overlay; then
196 + CONFIG_CHECK+="
197 + ~OVERLAY_FS ~EXT4_FS_SECURITY ~EXT4_FS_POSIX_ACL
198 + "
199 + fi
200 +
201 + linux-info_pkg_setup
202 +
203 + # create docker group for the code checking for it in /etc/group
204 + enewgroup docker
205 +}
206 +
207 +src_compile() {
208 + export GOPATH="${WORKDIR}/${P}"
209 +
210 + # setup CFLAGS and LDFLAGS for separate build target
211 + # see https://github.com/tianon/docker-overlay/pull/10
212 + export CGO_CFLAGS="-I${ROOT}/usr/include"
213 + export CGO_LDFLAGS="-L${ROOT}/usr/$(get_libdir)"
214 +
215 + # if we're building from a tarball, we need the GITCOMMIT value
216 + [ "$DOCKER_GITCOMMIT" ] && export DOCKER_GITCOMMIT
217 +
218 + # fake golang layout
219 + ln -s docker-ce/components/engine ../docker || die
220 + ln -s docker-ce/components/cli ../cli || die
221 +
222 + # let's set up some optional features :)
223 + export DOCKER_BUILDTAGS=''
224 + for gd in aufs btrfs device-mapper overlay; do
225 + if ! use $gd; then
226 + DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
227 + fi
228 + done
229 +
230 + for tag in apparmor pkcs11 seccomp; do
231 + if use $tag; then
232 + DOCKER_BUILDTAGS+=" $tag"
233 + fi
234 + done
235 +
236 + pushd components/engine || die
237 +
238 + if use hardened; then
239 + sed -i "s/EXTLDFLAGS_STATIC='/&-fno-PIC /" hack/make.sh || die
240 + grep -q -- '-fno-PIC' hack/make.sh || die 'hardened sed failed'
241 + sed "s/LDFLAGS_STATIC_DOCKER='/&-extldflags -fno-PIC /" \
242 + -i hack/make/dynbinary-daemon || die
243 + grep -q -- '-fno-PIC' hack/make/dynbinary-daemon || die 'hardened sed failed'
244 + fi
245 +
246 + # build daemon
247 + VERSION="$(cat ../../VERSION)" \
248 + ./hack/make.sh dynbinary || die 'dynbinary failed'
249 +
250 + popd || die # components/engine
251 +
252 + pushd components/cli || die
253 +
254 + # build cli
255 + emake \
256 + LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
257 + VERSION="$(cat ../../VERSION)" \
258 + GITCOMMIT="${DOCKER_GITCOMMIT}" \
259 + DISABLE_WARN_OUTSIDE_CONTAINER=1 \
260 + dynbinary || die
261 +
262 + # build man pages
263 + go build -o gen-manpages github.com/docker/cli/man || die
264 + ./gen-manpages --root . --target ./man/man1 || die
265 + ./man/md2man-all.sh -q || die
266 + rm gen-manpages || die
267 + # see "components/cli/scripts/docs/generate-man.sh" (which also does "go get" for go-md2man)
268 +
269 + popd || die # components/cli
270 +}
271 +
272 +src_install() {
273 + dosym containerd /usr/bin/docker-containerd
274 + dosym containerd-shim /usr/bin/docker-containerd-shim
275 + dosym runc /usr/bin/docker-runc
276 + use container-init && dosym tini /usr/bin/docker-init
277 +
278 + pushd components/engine || die
279 + newbin "$(readlink -f bundles/latest/dynbinary-daemon/dockerd)" dockerd
280 +
281 + newinitd contrib/init/openrc/docker.initd docker
282 + newconfd contrib/init/openrc/docker.confd docker
283 +
284 + systemd_dounit contrib/init/systemd/docker.{service,socket}
285 +
286 + udev_dorules contrib/udev/*.rules
287 +
288 + dodoc AUTHORS CONTRIBUTING.md CHANGELOG.md NOTICE README.md
289 + dodoc -r docs/*
290 +
291 + insinto /usr/share/vim/vimfiles
292 + doins -r contrib/syntax/vim/ftdetect
293 + doins -r contrib/syntax/vim/syntax
294 +
295 + # note: intentionally not using "doins" so that we preserve +x bits
296 + dodir /usr/share/${PN}/contrib
297 + cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
298 + popd || die # components/engine
299 +
300 + pushd components/cli || die
301 +
302 + newbin build/docker-* docker
303 +
304 + doman man/man*/*
305 +
306 + dobashcomp contrib/completion/bash/*
307 + insinto /usr/share/zsh/site-functions
308 + doins contrib/completion/zsh/_*
309 + popd || die # components/cli
310 +}
311 +
312 +pkg_postinst() {
313 + udev_reload
314 +
315 + elog
316 + elog "To use Docker, the Docker daemon must be running as root. To automatically"
317 + elog "start the Docker daemon at boot, add Docker to the default runlevel:"
318 + elog " rc-update add docker default"
319 + elog "Similarly for systemd:"
320 + elog " systemctl enable docker.service"
321 + elog
322 + elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
323 + elog " usermod -aG docker youruser"
324 + elog
325 +}
326
327 diff --git a/app-emulation/docker/files/bsc1073877-docker-apparmor-add-signal-r2.patch b/app-emulation/docker/files/bsc1073877-docker-apparmor-add-signal-r2.patch
328 new file mode 100644
329 index 00000000000..fd365425fb9
330 --- /dev/null
331 +++ b/app-emulation/docker/files/bsc1073877-docker-apparmor-add-signal-r2.patch
332 @@ -0,0 +1,72 @@
333 +From 4822fb1e2423d88cdf0ad5d039b8fd3274b05401 Mon Sep 17 00:00:00 2001
334 +From: Aleksa Sarai <asarai@××××.de>
335 +Date: Sun, 8 Apr 2018 20:21:30 +1000
336 +Subject: [PATCH] apparmor: allow receiving of signals from 'docker kill'
337 +
338 +In newer kernels, AppArmor will reject attempts to send signals to a
339 +container because the signal originated from outside of that AppArmor
340 +profile. Correct this by allowing all unconfined signals to be received.
341 +
342 +Signed-off-by: Goldwyn Rodrigues <rgoldwyn@××××.com>
343 +Signed-off-by: Aleksa Sarai <asarai@××××.de>
344 +---
345 + profiles/apparmor/apparmor.go | 21 +++++++++++++++++++++
346 + profiles/apparmor/template.go | 6 ++++++
347 + 2 files changed, 27 insertions(+)
348 +
349 +diff --git a/components/engine/profiles/apparmor/apparmor.go b/components/engine/profiles/apparmor/apparmor.go
350 +index b021668c8e4c..2f58ee852cab 100644
351 +--- a/components/engine/profiles/apparmor/apparmor.go
352 ++++ b/components/engine/profiles/apparmor/apparmor.go
353 +@@ -23,6 +23,8 @@ var (
354 + type profileData struct {
355 + // Name is profile name.
356 + Name string
357 ++ // DaemonProfile is the profile name of our daemon.
358 ++ DaemonProfile string
359 + // Imports defines the apparmor functions to import, before defining the profile.
360 + Imports []string
361 + // InnerImports defines the apparmor functions to import in the profile.
362 +@@ -70,6 +72,25 @@ func InstallDefault(name string) error {
363 + Name: name,
364 + }
365 +
366 ++ // Figure out the daemon profile.
367 ++ currentProfile, err := ioutil.ReadFile("/proc/self/attr/current")
368 ++ if err != nil {
369 ++ // If we couldn't get the daemon profile, assume we are running
370 ++ // unconfined which is generally the default.
371 ++ currentProfile = nil
372 ++ }
373 ++ daemonProfile := string(currentProfile)
374 ++ // Normally profiles are suffixed by " (enforcing)" or similar. AppArmor
375 ++ // profiles cannot contain spaces so this doesn't restrict daemon profile
376 ++ // names.
377 ++ if parts := strings.SplitN(daemonProfile, " ", 2); len(parts) >= 1 {
378 ++ daemonProfile = parts[0]
379 ++ }
380 ++ if daemonProfile == "" {
381 ++ daemonProfile = "unconfined"
382 ++ }
383 ++ p.DaemonProfile = daemonProfile
384 ++
385 + // Install to a temporary directory.
386 + f, err := ioutil.TempFile("", name)
387 + if err != nil {
388 +diff --git a/components/engine/profiles/apparmor/template.go b/components/engine/profiles/apparmor/template.go
389 +index c00a3f70e993..400b3bd50a11 100644
390 +--- a/components/engine/profiles/apparmor/template.go
391 ++++ b/components/engine/profiles/apparmor/template.go
392 +@@ -17,6 +17,12 @@ profile {{.Name}} flags=(attach_disconnected,mediate_deleted) {
393 + capability,
394 + file,
395 + umount,
396 ++{{if ge .Version 208096}}
397 ++{{/* Allow 'docker kill' to actually send signals to container processes. */}}
398 ++ signal (receive) peer={{.DaemonProfile}},
399 ++{{/* Allow container processes to send signals amongst themselves. */}}
400 ++ signal (send,receive) peer={{.Name}},
401 ++{{end}}
402 +
403 + deny @{PROC}/* w, # deny write for all files directly in /proc (not in a subdir)
404 + # deny write to files not in /proc/<number>/** or /proc/sys/**