1/*
2Copyright 2014 The Kubernetes Authors.
3
4Licensed under the Apache License, Version 2.0 (the "License");
5you may not use this file except in compliance with the License.
6You may obtain a copy of the License at
7
8    http://www.apache.org/licenses/LICENSE-2.0
9
10Unless required by applicable law or agreed to in writing, software
11distributed under the License is distributed on an "AS IS" BASIS,
12WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13See the License for the specific language governing permissions and
14limitations under the License.
15*/
16
17package capabilities
18
19import (
20	"sync"
21)
22
23// Capabilities defines the set of capabilities available within the system.
24// For now these are global.  Eventually they may be per-user
25type Capabilities struct {
26	AllowPrivileged bool
27
28	// Pod sources from which to allow privileged capabilities like host networking, sharing the host
29	// IPC namespace, and sharing the host PID namespace.
30	PrivilegedSources PrivilegedSources
31
32	// PerConnectionBandwidthLimitBytesPerSec limits the throughput of each connection (currently only used for proxy, exec, attach)
33	PerConnectionBandwidthLimitBytesPerSec int64
34}
35
36// PrivilegedSources defines the pod sources allowed to make privileged requests for certain types
37// of capabilities like host networking, sharing the host IPC namespace, and sharing the host PID namespace.
38type PrivilegedSources struct {
39	// List of pod sources for which using host network is allowed.
40	HostNetworkSources []string
41
42	// List of pod sources for which using host pid namespace is allowed.
43	HostPIDSources []string
44
45	// List of pod sources for which using host ipc is allowed.
46	HostIPCSources []string
47}
48
49var capInstance struct {
50	once         sync.Once
51	lock         sync.Mutex
52	capabilities *Capabilities
53}
54
55// Initialize the capability set.  This can only be done once per binary, subsequent calls are ignored.
56func Initialize(c Capabilities) {
57	// Only do this once
58	capInstance.once.Do(func() {
59		capInstance.capabilities = &c
60	})
61}
62
63// Setup the capability set.  It wraps Initialize for improving usability.
64func Setup(allowPrivileged bool, perConnectionBytesPerSec int64) {
65	Initialize(Capabilities{
66		AllowPrivileged:                        allowPrivileged,
67		PerConnectionBandwidthLimitBytesPerSec: perConnectionBytesPerSec,
68	})
69}
70
71// SetForTests sets capabilities for tests.  Convenience method for testing.  This should only be called from tests.
72func SetForTests(c Capabilities) {
73	capInstance.lock.Lock()
74	defer capInstance.lock.Unlock()
75	capInstance.capabilities = &c
76}
77
78// Get returns a read-only copy of the system capabilities.
79func Get() Capabilities {
80	capInstance.lock.Lock()
81	defer capInstance.lock.Unlock()
82	// This check prevents clobbering of capabilities that might've been set via SetForTests
83	if capInstance.capabilities == nil {
84		Initialize(Capabilities{
85			AllowPrivileged: false,
86			PrivilegedSources: PrivilegedSources{
87				HostNetworkSources: []string{},
88				HostPIDSources:     []string{},
89				HostIPCSources:     []string{},
90			},
91		})
92	}
93	return *capInstance.capabilities
94}
95