{"action":"created","comment":{"url":"https://api.github.com/repos/coreos/rkt/pulls/comments/72628118","id":72628118,"diff_hunk":"@@ -23,21 +23,44 @@ const (\n \tinsecureOnDisk\n \tinsecureHTTP\n \tinsecurePubKey\n+\tinsecureCapabilities\n+\tinsecurePaths\n+\tinsecureSeccomp\n \n-\tinsecureAll = (insecureImage | insecureTLS | insecureOnDisk | insecureHTTP | insecurePubKey)\n+\tinsecureAllFetch = (insecureImage | insecureTLS | insecureHTTP | insecurePubKey)\n+\tinsecureAllRun   = (insecureOnDisk | insecureCapabilities | insecurePaths | insecureSeccomp)\n+\tinsecureAll      = (insecureAllFetch | insecureAllRun)\n )\n \n var (\n-\tinsecureOptions = []string{\"none\", \"image\", \"tls\", \"ondisk\", \"http\", \"pubkey\", \"all\"}\n+\tinsecureOptions = []string{\n+\t\t\"none\",\n+\t\t\"image\",\n+\t\t\"tls\",\n+\t\t\"ondisk\",\n+\t\t\"http\",\n+\t\t\"pubkey\",\n+\t\t\"capabilities\",\n+\t\t\"paths\",\n+\t\t\"seccomp\",\n+\t\t\"all-fetch\",\n+\t\t\"all-run\",\n+\t\t\"all\",\n+\t}\n \n \tinsecureOptionsMap = map[string]int{\n-\t\tinsecureOptions[0]: insecureNone,\n-\t\tinsecureOptions[1]: insecureImage,\n-\t\tinsecureOptions[2]: insecureTLS,\n-\t\tinsecureOptions[3]: insecureOnDisk,\n-\t\tinsecureOptions[4]: insecureHTTP,\n-\t\tinsecureOptions[5]: insecurePubKey,\n-\t\tinsecureOptions[6]: insecureAll,\n+\t\tinsecureOptions[0]:  insecureNone,\n+\t\tinsecureOptions[1]:  insecureImage,\n+\t\tinsecureOptions[2]:  insecureTLS,\n+\t\tinsecureOptions[3]:  insecureOnDisk,\n+\t\tinsecureOptions[4]:  insecureHTTP,\n+\t\tinsecureOptions[5]:  insecurePubKey,\n+\t\tinsecureOptions[6]:  insecureCapabilities,","path":"rkt/flag/secflags.go","position":45,"original_position":45,"commit_id":"3972e3ab51012b03a458a3059d2a99d13fba0ac1","original_commit_id":"3972e3ab51012b03a458a3059d2a99d13fba0ac1","user":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"body":"FYI, I am removing `--insecure-options=seccomp` from this PR because https://github.com/coreos/rkt/pull/2753 is not merged yet.","created_at":"2016-07-28T14:06:47Z","updated_at":"2016-07-28T14:06:47Z","html_url":"https://github.com/coreos/rkt/pull/2983#discussion_r72628118","pull_request_url":"https://api.github.com/repos/coreos/rkt/pulls/2983","_links":{"self":{"href":"https://api.github.com/repos/coreos/rkt/pulls/comments/72628118"},"html":{"href":"https://github.com/coreos/rkt/pull/2983#discussion_r72628118"},"pull_request":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2983"}}},"pull_request":{"url":"https://api.github.com/repos/coreos/rkt/pulls/2983","id":78875596,"html_url":"https://github.com/coreos/rkt/pull/2983","diff_url":"https://github.com/coreos/rkt/pull/2983.diff","patch_url":"https://github.com/coreos/rkt/pull/2983.patch","issue_url":"https://api.github.com/repos/coreos/rkt/issues/2983","number":2983,"state":"open","locked":false,"title":"rkt: implements --insecure-options={capabilities,paths,seccomp}","user":{"login":"alban","id":27575,"avatar_url":"https://avatars.githubusercontent.com/u/27575?v=3","gravatar_id":"","url":"https://api.github.com/users/alban","html_url":"https://github.com/alban","followers_url":"https://api.github.com/users/alban/followers","following_url":"https://api.github.com/users/alban/following{/other_user}","gists_url":"https://api.github.com/users/alban/gists{/gist_id}","starred_url":"https://api.github.com/users/alban/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alban/subscriptions","organizations_url":"https://api.github.com/users/alban/orgs","repos_url":"https://api.github.com/users/alban/repos","events_url":"https://api.github.com/users/alban/events{/privacy}","received_events_url":"https://api.github.com/users/alban/received_events","type":"User","site_admin":false},"body":"Add the following options: `--insecure-options={capabilities,paths,seccomp}`\r\n\r\n* capabilities:\r\n * remove the `CapabilityBoundingSet` option from the .service file\r\n * call nspawn `--capability=all` so the pod will have all caps\r\n* paths: skip options like `ReadOnlyDirectories` and InaccessibleDirectories\r\n* seccomp: does not do anything. It will be up to @lucab's https://github.com/coreos/rkt/pull/2753 to do something with that\r\n\r\nThis also includes:\r\n- all-fetch: for the fetch related insecure options\r\n- all-run: for the run related insecure options\r\n- all: for all insecure options\r\n\r\nThis is implemented using a new option `--disable-{paths,seccomp,capabilities}` in the stage1's run entrypoint.\r\n\r\nThis feature will be useful for:\r\n- rkt in rkt https://github.com/coreos/rkt/issues/2158 (for getting access to /sys/fs/)\r\n- allow changes on sysctl (e.g. with `--net=host`) https://github.com/coreos/rkt/issues/2694\r\n\r\nFixes https://github.com/coreos/rkt/issues/2962\r\n\r\n-----\r\n\r\nTODO:\r\n- [x] tests\r\n- [ ] check other flavors\r\n\r\n/cc @lucab @iaguis @s-urbaniak @Quentin-M ","created_at":"2016-07-26T15:43:23Z","updated_at":"2016-07-28T14:06:47Z","closed_at":null,"merged_at":null,"merge_commit_sha":"4ae89a6e93069ef49d136329dfca8a0bddca8475","assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/coreos/rkt/milestones/45","html_url":"https://github.com/coreos/rkt/milestones/v1.12.0","labels_url":"https://api.github.com/repos/coreos/rkt/milestones/45/labels","id":1867460,"number":45,"title":"v1.12.0","description":"","creator":{"login":"iaguis","id":507354,"avatar_url":"https://avatars.githubusercontent.com/u/507354?v=3","gravatar_id":"","url":"https://api.github.com/users/iaguis","html_url":"https://github.com/iaguis","followers_url":"https://api.github.com/users/iaguis/followers","following_url":"https://api.github.com/users/iaguis/following{/other_user}","gists_url":"https://api.github.com/users/iaguis/gists{/gist_id}","starred_url":"https://api.github.com/users/iaguis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iaguis/subscriptions","organizations_url":"https://api.github.com/users/iaguis/orgs","repos_url":"https://api.github.com/users/iaguis/repos","events_url":"https://api.github.com/users/iaguis/events{/privacy}","received_events_url":"https://api.github.com/users/iaguis/received_events","type":"User","site_admin":false},"open_issues":41,"closed_issues":19,"state":"open","created_at":"2016-07-06T12:45:49Z","updated_at":"2016-07-28T12:34:00Z","due_on":"2016-08-04T00:00:00Z","closed_at":null},"commits_url":"https://api.github.com/repos/coreos/rkt/pulls/2983/commits","review_comments_url":"https://api.github.com/repos/coreos/rkt/pulls/2983/comments","review_comment_url":"https://api.github.com/repos/coreos/rkt/pulls/comments{/number}","comments_url":"https://api.github.com/repos/coreos/rkt/issues/2983/comments","statuses_url":"https://api.github.com/repos/coreos/rkt/statuses/3972e3ab51012b03a458a3059d2a99d13fba0ac1","head":{"label":"kinvolk:alban/privileged-1","ref":"alban/privileged-1","sha":"3972e3ab51012b03a458a3059d2a99d13fba0ac1","user":{"login":"kinvolk","id":14073052,"avatar_url":"https://avatars.githubusercontent.com/u/14073052?v=3","gravatar_id":"","url":"https://api.github.com/users/kinvolk","html_url":"https://github.com/kinvolk","followers_url":"https://api.github.com/users/kinvolk/followers","following_url":"https://api.github.com/users/kinvolk/following{/other_user}","gists_url":"https://api.github.com/users/kinvolk/gists{/gist_id}","starred_url":"https://api.github.com/users/kinvolk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kinvolk/subscriptions","organizations_url":"https://api.github.com/users/kinvolk/orgs","repos_url":"https://api.github.com/users/kinvolk/repos","events_url":"https://api.github.com/users/kinvolk/events{/privacy}","received_events_url":"https://api.github.com/users/kinvolk/received_events","type":"Organization","site_admin":false},"repo":{"id":45149715,"name":"rkt","full_name":"kinvolk/rkt","owner":{"login":"kinvolk","id":14073052,"avatar_url":"https://avatars.githubusercontent.com/u/14073052?v=3","gravatar_id":"","url":"https://api.github.com/users/kinvolk","html_url":"https://github.com/kinvolk","followers_url":"https://api.github.com/users/kinvolk/followers","following_url":"https://api.github.com/users/kinvolk/following{/other_user}","gists_url":"https://api.github.com/users/kinvolk/gists{/gist_id}","starred_url":"https://api.github.com/users/kinvolk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kinvolk/subscriptions","organizations_url":"https://api.github.com/users/kinvolk/orgs","repos_url":"https://api.github.com/users/kinvolk/repos","events_url":"https://api.github.com/users/kinvolk/events{/privacy}","received_events_url":"https://api.github.com/users/kinvolk/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/kinvolk/rkt","description":"rkt is an App Container runtime for Linux","fork":true,"url":"https://api.github.com/repos/kinvolk/rkt","forks_url":"https://api.github.com/repos/kinvolk/rkt/forks","keys_url":"https://api.github.com/repos/kinvolk/rkt/keys{/key_id}","collaborators_url":"https://api.github.com/repos/kinvolk/rkt/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/kinvolk/rkt/teams","hooks_url":"https://api.github.com/repos/kinvolk/rkt/hooks","issue_events_url":"https://api.github.com/repos/kinvolk/rkt/issues/events{/number}","events_url":"https://api.github.com/repos/kinvolk/rkt/events","assignees_url":"https://api.github.com/repos/kinvolk/rkt/assignees{/user}","branches_url":"https://api.github.com/repos/kinvolk/rkt/branches{/branch}","tags_url":"https://api.github.com/repos/kinvolk/rkt/tags","blobs_url":"https://api.github.com/repos/kinvolk/rkt/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/kinvolk/rkt/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/kinvolk/rkt/git/refs{/sha}","trees_url":"https://api.github.com/repos/kinvolk/rkt/git/trees{/sha}","statuses_url":"https://api.github.com/repos/kinvolk/rkt/statuses/{sha}","languages_url":"https://api.github.com/repos/kinvolk/rkt/languages","stargazers_url":"https://api.github.com/repos/kinvolk/rkt/stargazers","contributors_url":"https://api.github.com/repos/kinvolk/rkt/contributors","subscribers_url":"https://api.github.com/repos/kinvolk/rkt/subscribers","subscription_url":"https://api.github.com/repos/kinvolk/rkt/subscription","commits_url":"https://api.github.com/repos/kinvolk/rkt/commits{/sha}","git_commits_url":"https://api.github.com/repos/kinvolk/rkt/git/commits{/sha}","comments_url":"https://api.github.com/repos/kinvolk/rkt/comments{/number}","issue_comment_url":"https://api.github.com/repos/kinvolk/rkt/issues/comments{/number}","contents_url":"https://api.github.com/repos/kinvolk/rkt/contents/{+path}","compare_url":"https://api.github.com/repos/kinvolk/rkt/compare/{base}...{head}","merges_url":"https://api.github.com/repos/kinvolk/rkt/merges","archive_url":"https://api.github.com/repos/kinvolk/rkt/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/kinvolk/rkt/downloads","issues_url":"https://api.github.com/repos/kinvolk/rkt/issues{/number}","pulls_url":"https://api.github.com/repos/kinvolk/rkt/pulls{/number}","milestones_url":"https://api.github.com/repos/kinvolk/rkt/milestones{/number}","notifications_url":"https://api.github.com/repos/kinvolk/rkt/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/kinvolk/rkt/labels{/name}","releases_url":"https://api.github.com/repos/kinvolk/rkt/releases{/id}","deployments_url":"https://api.github.com/repos/kinvolk/rkt/deployments","created_at":"2015-10-29T00:17:06Z","updated_at":"2016-06-06T12:54:39Z","pushed_at":"2016-07-28T14:03:19Z","git_url":"git://github.com/kinvolk/rkt.git","ssh_url":"git@github.com:kinvolk/rkt.git","clone_url":"https://github.com/kinvolk/rkt.git","svn_url":"https://github.com/kinvolk/rkt","homepage":"","size":22640,"stargazers_count":1,"watchers_count":1,"language":"Go","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"coreos:master","ref":"master","sha":"31c693a8a12cc1046c18b5f677b38e3c1dfcb02a","user":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"repo":{"id":26509369,"name":"rkt","full_name":"coreos/rkt","owner":{"login":"coreos","id":3730757,"avatar_url":"https://avatars.githubusercontent.com/u/3730757?v=3","gravatar_id":"","url":"https://api.github.com/users/coreos","html_url":"https://github.com/coreos","followers_url":"https://api.github.com/users/coreos/followers","following_url":"https://api.github.com/users/coreos/following{/other_user}","gists_url":"https://api.github.com/users/coreos/gists{/gist_id}","starred_url":"https://api.github.com/users/coreos/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/coreos/subscriptions","organizations_url":"https://api.github.com/users/coreos/orgs","repos_url":"https://api.github.com/users/coreos/repos","events_url":"https://api.github.com/users/coreos/events{/privacy}","received_events_url":"https://api.github.com/users/coreos/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/coreos/rkt","description":"rkt is an App Container runtime for Linux","fork":false,"url":"https://api.github.com/repos/coreos/rkt","forks_url":"https://api.github.com/repos/coreos/rkt/forks","keys_url":"https://api.github.com/repos/coreos/rkt/keys{/key_id}","collaborators_url":"https://api.github.com/repos/coreos/rkt/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/coreos/rkt/teams","hooks_url":"https://api.github.com/repos/coreos/rkt/hooks","issue_events_url":"https://api.github.com/repos/coreos/rkt/issues/events{/number}","events_url":"https://api.github.com/repos/coreos/rkt/events","assignees_url":"https://api.github.com/repos/coreos/rkt/assignees{/user}","branches_url":"https://api.github.com/repos/coreos/rkt/branches{/branch}","tags_url":"https://api.github.com/repos/coreos/rkt/tags","blobs_url":"https://api.github.com/repos/coreos/rkt/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/coreos/rkt/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/coreos/rkt/git/refs{/sha}","trees_url":"https://api.github.com/repos/coreos/rkt/git/trees{/sha}","statuses_url":"https://api.github.com/repos/coreos/rkt/statuses/{sha}","languages_url":"https://api.github.com/repos/coreos/rkt/languages","stargazers_url":"https://api.github.com/repos/coreos/rkt/stargazers","contributors_url":"https://api.github.com/repos/coreos/rkt/contributors","subscribers_url":"https://api.github.com/repos/coreos/rkt/subscribers","subscription_url":"https://api.github.com/repos/coreos/rkt/subscription","commits_url":"https://api.github.com/repos/coreos/rkt/commits{/sha}","git_commits_url":"https://api.github.com/repos/coreos/rkt/git/commits{/sha}","comments_url":"https://api.github.com/repos/coreos/rkt/comments{/number}","issue_comment_url":"https://api.github.com/repos/coreos/rkt/issues/comments{/number}","contents_url":"https://api.github.com/repos/coreos/rkt/contents/{+path}","compare_url":"https://api.github.com/repos/coreos/rkt/compare/{base}...{head}","merges_url":"https://api.github.com/repos/coreos/rkt/merges","archive_url":"https://api.github.com/repos/coreos/rkt/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/coreos/rkt/downloads","issues_url":"https://api.github.com/repos/coreos/rkt/issues{/number}","pulls_url":"https://api.github.com/repos/coreos/rkt/pulls{/number}","milestones_url":"https://api.github.com/repos/coreos/rkt/milestones{/number}","notifications_url":"https://api.github.com/repos/coreos/rkt/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/coreos/rkt/labels{/name}","releases_url":"https://api.github.com/repos/coreos/rkt/releases{/id}","deployments_url":"https://api.github.com/repos/coreos/rkt/deployments","created_at":"2014-11-11T23:13:18Z","updated_at":"2016-07-28T13:04:25Z","pushed_at":"2016-07-28T13:20:22Z","git_url":"git://github.com/coreos/rkt.git","ssh_url":"git@github.com:coreos/rkt.git","clone_url":"https://github.com/coreos/rkt.git","svn_url":"https://github.com/coreos/rkt","homepage":"","size":32073,"stargazers_count":5729,"watchers_count":5729,"language":"Go","has_issues":true,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":548,"mirror_url":null,"open_issues_count":363,"forks":548,"open_issues":363,"watchers":5729,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2983"},"html":{"href":"https://github.com/coreos/rkt/pull/2983"},"issue":{"href":"https://api.github.com/repos/coreos/rkt/issues/2983"},"comments":{"href":"https://api.github.com/repos/coreos/rkt/issues/2983/comments"},"review_comments":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2983/comments"},"review_comment":{"href":"https://api.github.com/repos/coreos/rkt/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/coreos/rkt/pulls/2983/commits"},"statuses":{"href":"https://api.github.com/repos/coreos/rkt/statuses/3972e3ab51012b03a458a3059d2a99d13fba0ac1"}}}}
{"actor":{"display_login":"alban"}}