mirror of
https://github.com/podman-container-tools/podman.git
synced 2026-09-13 11:07:50 +00:00
ba1871dac0
Use github.com/containers/psgo instead of execing `ps (1)`. The psgo library enables a much more flexible interface with respect to which data to be printed (e.g., capabilities, seccomp mode, PID, PCPU, etc.) while the output can be parsed reliably. The library does not use ps (1) but parses /proc and /dev instead. To list the processes of a given container, psgo will join the mount namespace of the given container and extract all data from there. Notice that this commit breaks compatibility with docker-top. Signed-off-by: Valentin Rothberg <vrothberg@suse.com> Closes: #1113 Approved by: rhatdan
71 lines
1.6 KiB
Go
71 lines
1.6 KiB
Go
package ps
|
|
|
|
var (
|
|
// capabilities are a mapping from a numerical value to the textual
|
|
// representation of a given capability. A map allows to easily check
|
|
// if a given value is included or not.
|
|
//
|
|
// NOTE: this map must be maintained and kept in sync with the
|
|
// ./include/uapi/linux/capability.h kernel header.
|
|
capabilities = map[uint]string{
|
|
0: "CHOWN",
|
|
1: "DAC_OVERRIDE",
|
|
2: "DAC_READ_SEARCH",
|
|
3: "FOWNER",
|
|
4: "FSETID",
|
|
5: "KILL",
|
|
6: "SETGID",
|
|
7: "SETUID",
|
|
8: "SETPCAP",
|
|
9: "LINUX_IMMUTABLE",
|
|
10: "NET_BIND_SERVICE",
|
|
11: "NET_BROADCAST",
|
|
12: "NET_ADMIN",
|
|
13: "NET_RAW",
|
|
14: "IPC_LOCK",
|
|
15: "IPC_OWNER",
|
|
16: "SYS_MODULE",
|
|
17: "SYS_RAWIO",
|
|
18: "SYS_CHROOT",
|
|
19: "SYS_PTRACE",
|
|
20: "SYS_PACCT",
|
|
21: "SYS_ADMIN",
|
|
22: "SYS_BOOT",
|
|
23: "SYS_NICE",
|
|
24: "SYS_RESOURCE",
|
|
25: "SYS_TIME",
|
|
26: "SYS_TTY_CONFIG",
|
|
27: "MKNOD",
|
|
28: "LEASE",
|
|
29: "AUDIT_WRITE",
|
|
30: "AUDIT_CONTROL",
|
|
31: "SETFCAP",
|
|
32: "MAC_OVERRIDE",
|
|
33: "MAC_ADMIN",
|
|
34: "SYSLOG",
|
|
35: "WAKE_ALARM",
|
|
36: "BLOCK_SUSPEND",
|
|
37: "AUDIT_READ",
|
|
}
|
|
// fullCAPs represents the value of a bitmask with a full capability
|
|
// set.
|
|
fullCAPs = uint64(0x3FFFFFFFFF)
|
|
)
|
|
|
|
// maskToCaps iterates over mask and returns a slice of corresponding
|
|
// capabilities. If a bit is out of range of known capabilities, it is set as
|
|
// "unknown" to catch potential regressions when new capabilities are added to
|
|
// the kernel.
|
|
func maskToCaps(mask uint64) []string {
|
|
caps := []string{}
|
|
for i := uint(0); i < 64; i++ {
|
|
if (mask>>i)&0x1 == 1 {
|
|
c, known := capabilities[i]
|
|
if !known {
|
|
c = "unknown"
|
|
}
|
|
caps = append(caps, c)
|
|
}
|
|
}
|
|
return caps
|
|
}
|