validate: optimize capabilites check

Signed-off-by: Ma Shimiao <mashimiao.fnst@cn.fujitsu.com>

Author: Ma Shimiao

cmd/oci-runtime-tool/validate.go

@@ -17,6 +17,7 @@ import (
 	"github.com/Sirupsen/logrus"
 	"github.com/blang/semver"
 	rspec "github.com/opencontainers/runtime-spec/specs-go"
+	"github.com/syndtr/gocapability/capability"
 	"github.com/urfave/cli"
 )
 
@@ -27,39 +28,23 @@ var bundleValidateFlags = []cli.Flag{
 }
 
 var (
-	defaultRlimits = []string{
+	validRlimits = []string{
+		"RLIMIT_AS",
+		"RLIMIT_CORE",
 		"RLIMIT_CPU",
-		"RLIMIT_FSIZE",
 		"RLIMIT_DATA",
-		"RLIMIT_STACK",
-		"RLIMIT_CORE",
-		"RLIMIT_RSS",
-		"RLIMIT_NPROC",
-		"RLIMIT_NOFILE",
-		"RLIMIT_MEMLOCK",
-		"RLIMIT_AS",
+		"RLIMIT_FSIZE",
 		"RLIMIT_LOCKS",
-		"RLIMIT_SIGPENDING",
+		"RLIMIT_MEMLOCK",
 		"RLIMIT_MSGQUEUE",
 		"RLIMIT_NICE",
+		"RLIMIT_NOFILE",
+		"RLIMIT_NPROC",
+		"RLIMIT_RSS",
 		"RLIMIT_RTPRIO",
 		"RLIMIT_RTTIME",
-	}
-	defaultCaps = []string{
-		"CAP_CHOWN",
-		"CAP_DAC_OVERRIDE",
-		"CAP_FSETID",
-		"CAP_FOWNER",
-		"CAP_MKNOD",
-		"CAP_NET_RAW",
-		"CAP_SETGID",
-		"CAP_SETUID",
-		"CAP_SETFCAP",
-		"CAP_SETPCAP",
-		"CAP_NET_BIND_SERVICE",
-		"CAP_SYS_CHROOT",
-		"CAP_KILL",
-		"CAP_AUDIT_WRITE",
+		"RLIMIT_SIGPENDING",
+		"RLIMIT_STACK",
 	}
 )
 
@@ -225,8 +210,8 @@ func checkProcess(spec rspec.Spec, rootfs string, hostCheck bool) (msgs []string
 
 	for index := 0; index < len(process.Capabilities); index++ {
 		capability := process.Capabilities[index]
-		if !capValid(capability) {
-			msgs = append(msgs, fmt.Sprintf("capability %q is not valid, man capabilities(7)", process.Capabilities[index]))
+		if !capValid(capability, hostCheck) {
+			msgs = append(msgs, fmt.Sprintf("capability %q is not valid, man capabilities(7)", capability))
 		}
 	}
 
@@ -465,17 +450,33 @@ func envValid(env string) bool {
 	return true
 }
 
-func capValid(capability string) bool {
-	for _, val := range defaultCaps {
-		if val == capability {
-			return true
-		}
-	}
+func capValid(c string, hostSpecific bool) bool {
+    cp := strings.ToUpper(c)
+
+    for _, cap := range capability.List() {
+        if cp == fmt.Sprintf("CAP_%s", strings.ToUpper(cap.String())) {
+            if hostSpecific && cap > lastCap() {
+				return false
+            }
+            return true
+        }
+    }
+
 	return false
 }
 
+func lastCap() capability.Cap {
+    last := capability.CAP_LAST_CAP
+    // hack for RHEL6 which has no /proc/sys/kernel/cap_last_cap
+    if last == capability.Cap(63) {
+        last = capability.CAP_BLOCK_SUSPEND
+    }
+
+    return last
+}
+
 func rlimitValid(rlimit string) bool {
-	for _, val := range defaultRlimits {
+	for _, val := range validRlimits {
 		if val == rlimit {
 			return true
 		}