Skip to content

Commit ca6b300

Browse files
DomAyreindusridhar
DomAyre
authored and
indusridhar
committed
Fix --infrastructure-svn and --fragments-json combo (Azure#9264)
1 parent 2295409 commit ca6b300

19 files changed

Lines changed: 1067 additions & 6 deletions

‎src/confcom/azext_confcom/oras_proxy.py‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -191,7 +191,10 @@ def pull_all_standalone_fragments(fragment_imports):
191191
proxy = CoseSignToolProxy()
192192

193193
for fragment in fragment_imports:
194-
if fragment in DEFAULT_REGO_FRAGMENTS:
194+
if any(
195+
fragment["feed"] == default["feed"] and fragment["issuer"] == default["issuer"]
196+
for default in DEFAULT_REGO_FRAGMENTS
197+
):
195198
continue
196199
path = fragment.get("path")
197200
feed = fragment.get("feed")

‎src/confcom/azext_confcom/tests/latest/test_confcom_acipolicygen_arm.py‎

Lines changed: 10 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,11 @@
3333
"include_fragments": True,
3434
"fragments_json": os.path.join(FRAGMENTS_DIR, "fragment.json"),
3535
},
36+
"policy_fragment_plus_infrastructure_svn.rego": {
37+
"infrastructure_svn": "99",
38+
"include_fragments": True,
39+
"fragments_json": os.path.join(FRAGMENTS_DIR, "fragment.json"),
40+
},
3641
}
3742

3843

@@ -47,13 +52,13 @@ def test_acipolicygen(sample_directory, generated_policy_path):
4752
# absolute paths
4853
os.chdir(CONFCOM_DIR)
4954

50-
for failing_sample_directory, failing_generated_policy_path in [
51-
("multi_container_groups", "policy_fragment.rego"), # TODO: https://github.com/Azure/azure-cli-extensions/issues/9229
52-
(None, "policy_exclude_default_fragment.rego"), # TODO: https://github.com/Azure/azure-cli-extensions/issues/9198
55+
for failing_sample_directory, failing_generated_policy_paths in [
56+
("multi_container_groups", ("policy_fragment.rego", "policy_fragment_plus_infrastructure_svn.rego")), # TODO: https://github.com/Azure/azure-cli-extensions/issues/9229
57+
(None, ("policy_exclude_default_fragment.rego",)), # TODO: https://github.com/Azure/azure-cli-extensions/issues/9198
5358
]:
5459
if (
55-
failing_sample_directory in (None, sample_directory)
56-
and failing_generated_policy_path in (None, generated_policy_path)
60+
(sample_directory == failing_sample_directory or failing_sample_directory is None)
61+
and (generated_policy_path in failing_generated_policy_paths or failing_generated_policy_paths is None)
5762
):
5863
pytest.skip("Skipping test due to known issue")
5964

‎src/confcom/samples/aci/command/policy_fragment_plus_infrastructure_svn.rego‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package policy
2+
3+
import future.keywords.every
4+
import future.keywords.in
5+
6+
api_version := "0.10.0"
7+
framework_version := "0.2.3"
8+
9+
fragments := [
10+
{
11+
"feed": "mcr.microsoft.com/aci/aci-cc-infra-fragment",
12+
"includes": [
13+
"containers",
14+
"fragments"
15+
],
16+
"issuer": "did:x509:0:sha256:I__iuL25oXEVFdTP_aBLx_eT1RPHbCQ_ECBQfYZpt9s::eku:1.3.6.1.4.1.311.76.59.1.3",
17+
"minimum_svn": "99"
18+
},
19+
{
20+
"feed": "mcr.microsoft.com/acc/samples/aci/helloworld",
21+
"includes": [
22+
"containers",
23+
"fragments"
24+
],
25+
"issuer": "did:x509:0:sha256:8OhuTqQPbrbDMXV9QentXIIRWqcmU_B88n8jPr1WsBc::subject:CN:Contoso",
26+
"minimum_svn": "1"
27+
}
28+
]
29+
30+
containers := [{"allow_elevated":false,"allow_stdio_access":true,"capabilities":{"ambient":[],"bounding":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"],"effective":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"],"inheritable":[],"permitted":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"]},"command":["/bin/sh","-c","while true; do echo hello; sleep 10; done"],"env_rules":[{"pattern":"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":false,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"},{"pattern":"(?i)(FABRIC)_.+=.+","required":false,"strategy":"re2"},{"pattern":"HOSTNAME=.+","required":false,"strategy":"re2"},{"pattern":"T(E)?MP=.+","required":false,"strategy":"re2"},{"pattern":"FabricPackageFileName=.+","required":false,"strategy":"re2"},{"pattern":"HostedServiceName=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_API_VERSION=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_HEADER=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_SERVER_THUMBPRINT=.+","required":false,"strategy":"re2"},{"pattern":"azurecontainerinstance_restarted_by=.+","required":false,"strategy":"re2"}],"exec_processes":[],"id":"mcr.microsoft.com/azurelinux/distroless/base@sha256:1e77d97e1e39f22ed9c52f49b3508b4c1044cec23743df9098ac44e025f654f2","layers":["243e1b3ce08093f2f0d9cd6a9eafde8737f64fec105ed59c346d309fbe760b58"],"mounts":[{"destination":"/etc/resolv.conf","options":["rbind","rshared","rw"],"source":"sandbox:///tmp/atlas/resolvconf/.+","type":"bind"}],"name":"container1","no_new_privileges":false,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/"},{"allow_elevated":false,"allow_stdio_access":true,"capabilities":{"ambient":[],"bounding":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"],"effective":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"],"inheritable":[],"permitted":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"]},"command":["/pause"],"env_rules":[{"pattern":"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"}],"exec_processes":[],"layers":["16b514057a06ad665f92c02863aca074fd5976c755d26bff16365299169e8415"],"mounts":[],"name":"pause-container","no_new_privileges":false,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/"}]
31+
32+
allow_properties_access := true
33+
allow_dump_stacks := false
34+
allow_runtime_logging := false
35+
allow_environment_variable_dropping := true
36+
allow_unencrypted_scratch := false
37+
allow_capability_dropping := true
38+
39+
mount_device := data.framework.mount_device
40+
unmount_device := data.framework.unmount_device
41+
mount_overlay := data.framework.mount_overlay
42+
unmount_overlay := data.framework.unmount_overlay
43+
create_container := data.framework.create_container
44+
exec_in_container := data.framework.exec_in_container
45+
exec_external := data.framework.exec_external
46+
shutdown_container := data.framework.shutdown_container
47+
signal_container_process := data.framework.signal_container_process
48+
plan9_mount := data.framework.plan9_mount
49+
plan9_unmount := data.framework.plan9_unmount
50+
get_properties := data.framework.get_properties
51+
dump_stacks := data.framework.dump_stacks
52+
runtime_logging := data.framework.runtime_logging
53+
load_fragment := data.framework.load_fragment
54+
scratch_mount := data.framework.scratch_mount
55+
scratch_unmount := data.framework.scratch_unmount
56+
57+
reason := {"errors": data.framework.errors}
58+
59+

‎src/confcom/samples/aci/conflicting_variables/policy_fragment_plus_infrastructure_svn.rego‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package policy
2+
3+
import future.keywords.every
4+
import future.keywords.in
5+
6+
api_version := "0.10.0"
7+
framework_version := "0.2.3"
8+
9+
fragments := [
10+
{
11+
"feed": "mcr.microsoft.com/aci/aci-cc-infra-fragment",
12+
"includes": [
13+
"containers",
14+
"fragments"
15+
],
16+
"issuer": "did:x509:0:sha256:I__iuL25oXEVFdTP_aBLx_eT1RPHbCQ_ECBQfYZpt9s::eku:1.3.6.1.4.1.311.76.59.1.3",
17+
"minimum_svn": "99"
18+
},
19+
{
20+
"feed": "mcr.microsoft.com/acc/samples/aci/helloworld",
21+
"includes": [
22+
"containers",
23+
"fragments"
24+
],
25+
"issuer": "did:x509:0:sha256:8OhuTqQPbrbDMXV9QentXIIRWqcmU_B88n8jPr1WsBc::subject:CN:Contoso",
26+
"minimum_svn": "1"
27+
}
28+
]
29+
30+
containers := [{"allow_elevated":false,"allow_stdio_access":true,"capabilities":{"ambient":[],"bounding":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"],"effective":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"],"inheritable":[],"permitted":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"]},"command":["python3","main.py"],"env_rules":[{"pattern":"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":false,"strategy":"string"},{"pattern":"PYTHONUNBUFFERED=1","required":false,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"},{"pattern":"(?i)(FABRIC)_.+=.+","required":false,"strategy":"re2"},{"pattern":"HOSTNAME=.+","required":false,"strategy":"re2"},{"pattern":"T(E)?MP=.+","required":false,"strategy":"re2"},{"pattern":"FabricPackageFileName=.+","required":false,"strategy":"re2"},{"pattern":"HostedServiceName=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_API_VERSION=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_HEADER=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_SERVER_THUMBPRINT=.+","required":false,"strategy":"re2"},{"pattern":"azurecontainerinstance_restarted_by=.+","required":false,"strategy":"re2"}],"exec_processes":[],"id":"mcr.microsoft.com/acc/samples/aci/helloworld@sha256:86da7a2c5e55b72bf6bc7cf465b860e49c075395d854877124de63a9342ac777","layers":["4e74440c7b0e6e6c1cc9e6eb9b779e1ffde807122ed8a16bb0422a1d64fd5aa8","4cf856bcde8e1fa71f57d2218e21dd7c1a6a12c6d930d2bdb4bdb13a46fed9e4","41a52f45506177737caec5d57fe6160b6c8942dcac1bc7834fc0e94e62ff6b4d","b8ea8eae7795453b5e3dcfafe3f11fb2d68efb1062308e4d2411d44dd19fa97c","a0df1939f552483286c45204e7f583c9a6146963a79556fe22578d7b7e63e7a1","3ccbd6b119e951f3f2586339e9d10168b064a5852fd87cfae94af47a89f4d6c6","8348c9d4357db6a600aa4c5116ed9755a230d274096706a7d214c02105d0b256"],"mounts":[{"destination":"/etc/resolv.conf","options":["rbind","rshared","rw"],"source":"sandbox:///tmp/atlas/resolvconf/.+","type":"bind"}],"name":"container1","no_new_privileges":false,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/app"},{"allow_elevated":false,"allow_stdio_access":true,"capabilities":{"ambient":[],"bounding":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"],"effective":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"],"inheritable":[],"permitted":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"]},"command":["/pause"],"env_rules":[{"pattern":"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"}],"exec_processes":[],"layers":["16b514057a06ad665f92c02863aca074fd5976c755d26bff16365299169e8415"],"mounts":[],"name":"pause-container","no_new_privileges":false,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/"}]
31+
32+
allow_properties_access := true
33+
allow_dump_stacks := false
34+
allow_runtime_logging := false
35+
allow_environment_variable_dropping := true
36+
allow_unencrypted_scratch := false
37+
allow_capability_dropping := true
38+
39+
mount_device := data.framework.mount_device
40+
unmount_device := data.framework.unmount_device
41+
mount_overlay := data.framework.mount_overlay
42+
unmount_overlay := data.framework.unmount_overlay
43+
create_container := data.framework.create_container
44+
exec_in_container := data.framework.exec_in_container
45+
exec_external := data.framework.exec_external
46+
shutdown_container := data.framework.shutdown_container
47+
signal_container_process := data.framework.signal_container_process
48+
plan9_mount := data.framework.plan9_mount
49+
plan9_unmount := data.framework.plan9_unmount
50+
get_properties := data.framework.get_properties
51+
dump_stacks := data.framework.dump_stacks
52+
runtime_logging := data.framework.runtime_logging
53+
load_fragment := data.framework.load_fragment
54+
scratch_mount := data.framework.scratch_mount
55+
scratch_unmount := data.framework.scratch_unmount
56+
57+
reason := {"errors": data.framework.errors}
58+
59+

‎src/confcom/samples/aci/container_group_profiles/policy_fragment_plus_infrastructure_svn.rego‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
package policy
2+
3+
import future.keywords.every
4+
import future.keywords.in
5+
6+
api_version := "0.10.0"
7+
framework_version := "0.2.3"
8+
9+
fragments := [
10+
{
11+
"feed": "mcr.microsoft.com/aci/aci-cc-infra-fragment",
12+
"includes": [
13+
"containers",
14+
"fragments"
15+
],
16+
"issuer": "did:x509:0:sha256:I__iuL25oXEVFdTP_aBLx_eT1RPHbCQ_ECBQfYZpt9s::eku:1.3.6.1.4.1.311.76.59.1.3",
17+
"minimum_svn": "99"
18+
},
19+
{
20+
"feed": "mcr.microsoft.com/acc/samples/aci/helloworld",
21+
"includes": [
22+
"containers",
23+
"fragments"
24+
],
25+
"issuer": "did:x509:0:sha256:8OhuTqQPbrbDMXV9QentXIIRWqcmU_B88n8jPr1WsBc::subject:CN:Contoso",
26+
"minimum_svn": "1"
27+
}
28+
]
29+
30+
containers := [{"allow_elevated":false,"allow_stdio_access":true,"capabilities":{"ambient":[],"bounding":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"],"effective":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"],"inheritable":[],"permitted":["CAP_AUDIT_WRITE","CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_MKNOD","CAP_NET_BIND_SERVICE","CAP_NET_RAW","CAP_SETFCAP","CAP_SETGID","CAP_SETPCAP","CAP_SETUID","CAP_SYS_CHROOT"]},"command":null,"env_rules":[{"pattern":"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":false,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"},{"pattern":"(?i)(FABRIC)_.+=.+","required":false,"strategy":"re2"},{"pattern":"HOSTNAME=.+","required":false,"strategy":"re2"},{"pattern":"T(E)?MP=.+","required":false,"strategy":"re2"},{"pattern":"FabricPackageFileName=.+","required":false,"strategy":"re2"},{"pattern":"HostedServiceName=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_API_VERSION=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_HEADER=.+","required":false,"strategy":"re2"},{"pattern":"IDENTITY_SERVER_THUMBPRINT=.+","required":false,"strategy":"re2"},{"pattern":"azurecontainerinstance_restarted_by=.+","required":false,"strategy":"re2"}],"exec_processes":[],"id":"mcr.microsoft.com/azurelinux/distroless/base@sha256:1e77d97e1e39f22ed9c52f49b3508b4c1044cec23743df9098ac44e025f654f2","layers":["243e1b3ce08093f2f0d9cd6a9eafde8737f64fec105ed59c346d309fbe760b58"],"mounts":[{"destination":"/etc/resolv.conf","options":["rbind","rshared","rw"],"source":"sandbox:///tmp/atlas/resolvconf/.+","type":"bind"}],"name":"container1","no_new_privileges":false,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/"},{"allow_elevated":false,"allow_stdio_access":true,"capabilities":{"ambient":[],"bounding":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"],"effective":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"],"inheritable":[],"permitted":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_FSETID","CAP_FOWNER","CAP_MKNOD","CAP_NET_RAW","CAP_SETGID","CAP_SETUID","CAP_SETFCAP","CAP_SETPCAP","CAP_NET_BIND_SERVICE","CAP_SYS_CHROOT","CAP_KILL","CAP_AUDIT_WRITE"]},"command":["/pause"],"env_rules":[{"pattern":"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin","required":true,"strategy":"string"},{"pattern":"TERM=xterm","required":false,"strategy":"string"}],"exec_processes":[],"layers":["16b514057a06ad665f92c02863aca074fd5976c755d26bff16365299169e8415"],"mounts":[],"name":"pause-container","no_new_privileges":false,"seccomp_profile_sha256":"","signals":[],"user":{"group_idnames":[{"pattern":"","strategy":"any"}],"umask":"0022","user_idname":{"pattern":"","strategy":"any"}},"working_dir":"/"}]
31+
32+
allow_properties_access := true
33+
allow_dump_stacks := false
34+
allow_runtime_logging := false
35+
allow_environment_variable_dropping := true
36+
allow_unencrypted_scratch := false
37+
allow_capability_dropping := true
38+
39+
mount_device := data.framework.mount_device
40+
unmount_device := data.framework.unmount_device
41+
mount_overlay := data.framework.mount_overlay
42+
unmount_overlay := data.framework.unmount_overlay
43+
create_container := data.framework.create_container
44+
exec_in_container := data.framework.exec_in_container
45+
exec_external := data.framework.exec_external
46+
shutdown_container := data.framework.shutdown_container
47+
signal_container_process := data.framework.signal_container_process
48+
plan9_mount := data.framework.plan9_mount
49+
plan9_unmount := data.framework.plan9_unmount
50+
get_properties := data.framework.get_properties
51+
dump_stacks := data.framework.dump_stacks
52+
runtime_logging := data.framework.runtime_logging
53+
load_fragment := data.framework.load_fragment
54+
scratch_mount := data.framework.scratch_mount
55+
scratch_unmount := data.framework.scratch_unmount
56+
57+
reason := {"errors": data.framework.errors}
58+
59+

0 commit comments

Comments
 (0)