-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
hasher: hash security.capability attributes (#1994)
In Dockerfile, if there is something like: ``` RUN setcap cap_net_raw=+ep /path/to/binary ``` kaniko won't detect that there is a change on file `/path/to/binary` and thus discards this layer. This patch allows the hasher function to actually look at `security.capability` extended attributes.
- Loading branch information
1 parent
76a54a0
commit 96a8ee0
Showing
1 changed file
with
30 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -31,6 +31,7 @@ import ( | |
|
||
"github.com/minio/highwayhash" | ||
"github.com/sirupsen/logrus" | ||
"golang.org/x/sys/unix" | ||
) | ||
|
||
// Hasher returns a hash function, used in snapshotting to determine if a file has changed | ||
|
@@ -56,6 +57,10 @@ func Hasher() func(string) (string, error) { | |
h.Write([]byte(strconv.FormatUint(uint64(fi.Sys().(*syscall.Stat_t).Gid), 36))) | ||
|
||
if fi.Mode().IsRegular() { | ||
capability, _ := Lgetxattr(p, "security.capability") | ||
This comment has been minimized.
Sorry, something went wrong.
This comment has been minimized.
Sorry, something went wrong.
zhouhaibing089
Author
Contributor
|
||
if capability != nil { | ||
h.Write(capability) | ||
} | ||
f, err := os.Open(p) | ||
if err != nil { | ||
return "", err | ||
|
@@ -172,3 +177,28 @@ func Retry(operation retryFunc, retryCount int, initialDelayMilliseconds int) er | |
|
||
return err | ||
} | ||
|
||
func Lgetxattr(path string, attr string) ([]byte, error) { | ||
// Start with a 128 length byte array | ||
dest := make([]byte, 128) | ||
sz, errno := unix.Lgetxattr(path, attr, dest) | ||
|
||
for errno == unix.ERANGE { | ||
// Buffer too small, use zero-sized buffer to get the actual size | ||
sz, errno = unix.Lgetxattr(path, attr, []byte{}) | ||
if errno != nil { | ||
return nil, errno | ||
} | ||
dest = make([]byte, sz) | ||
sz, errno = unix.Lgetxattr(path, attr, dest) | ||
} | ||
|
||
switch { | ||
case errno == unix.ENODATA: | ||
return nil, nil | ||
case errno != nil: | ||
return nil, errno | ||
} | ||
|
||
return dest[:sz], nil | ||
} |
@zhouhaibing089: Do you know why here Symlinks are not handled?
Where is the place where Symlink Content (the pointed path) is handled?
This answer would greatly improve my understanding of the Symlinkbug: #1944