oci: mount whitelist of devices on insecure security mode

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>

executor/oci/spec_unix.go

@@ -18,7 +18,7 @@ import (
 	"github.com/moby/buildkit/executor"
 	"github.com/moby/buildkit/snapshot"
 	"github.com/moby/buildkit/solver/pb"
-	"github.com/moby/buildkit/util/entitlements"
+	"github.com/moby/buildkit/util/entitlements/security"
 	"github.com/moby/buildkit/util/network"
 	"github.com/moby/buildkit/util/system"
 	specs "github.com/opencontainers/runtime-spec/specs-go"
@@ -38,7 +38,7 @@ func GenerateSpec(ctx context.Context, meta executor.Meta, mounts []executor.Mou
 		ctx = namespaces.WithNamespace(ctx, "buildkit")
 	}
 	if meta.SecurityMode == pb.SecurityMode_INSECURE {
-		opts = append(opts, entitlements.WithInsecureSpec())
+		opts = append(opts, security.WithInsecureSpec())
 	} else if system.SeccompSupported() && meta.SecurityMode == pb.SecurityMode_SANDBOX {
 		opts = append(opts, seccomp.WithDefaultProfile())
 	}

solver/pb/caps.go

@@ -45,6 +45,8 @@ const (
 	CapExecMountSSH                  apicaps.CapID = "exec.mount.ssh"
 	CapExecCgroupsMounted            apicaps.CapID = "exec.cgroup"
 
+	CapExecMetaSecurityDeviceWhitelistV1 apicaps.CapID = "exec.meta.security.devices.v1"
+
 	CapFileBase       apicaps.CapID = "file.base"
 	CapFileRmWildcard apicaps.CapID = "file.rm.wildcard"
 
@@ -189,6 +191,12 @@ func init() {
 		Status:  apicaps.CapStatusExperimental,
 	})
 
+	Caps.Init(apicaps.Cap{
+		ID:      CapExecMetaSecurityDeviceWhitelistV1,
+		Enabled: true,
+		Status:  apicaps.CapStatusExperimental,
+	})
+
 	Caps.Init(apicaps.Cap{
 		ID:      CapExecMountBind,
 		Enabled: true,

util/entitlements/security/security_linux.go

@@ -1,7 +1,8 @@
-package entitlements
+package security
 
 import (
 	"context"
+	"fmt"
 
 	"github.com/containerd/containerd/containers"
 	"github.com/containerd/containerd/oci"
@@ -62,6 +63,74 @@ func WithInsecureSpec() oci.SpecOpts {
 		s.Linux.MaskedPaths = []string{}
 		s.Process.ApparmorProfile = ""
 
+		s.Linux.Resources.Devices = []specs.LinuxDeviceCgroup{
+			{
+				Allow:  true,
+				Type:   "c",
+				Access: "rwm",
+			},
+			{
+				Allow:  false,
+				Type:   "b",
+				Access: "rwm",
+			},
+		}
+
+		// Devices automatically mounted on insecure mode
+		s.Linux.Devices = append(s.Linux.Devices, []specs.LinuxDevice{
+			// Writes to this come out as printk's, reads export the buffered printk records. (dmesg)
+			{
+				Path:  "/dev/kmsg",
+				Type:  "c",
+				Major: 1,
+				Minor: 11,
+			},
+			// Cuse (character device in user-space)
+			{
+				Path:  "/dev/cuse",
+				Type:  "c",
+				Major: 10,
+				Minor: 203,
+			},
+			// Fuse (virtual filesystem in user-space)
+			{
+				Path:  "/dev/fuse",
+				Type:  "c",
+				Major: 10,
+				Minor: 229,
+			},
+			// Kernel-based virtual machine (hardware virtualization extensions)
+			{
+				Path:  "/dev/kvm",
+				Type:  "c",
+				Major: 10,
+				Minor: 232,
+			},
+			// TAP/TUN network device
+			{
+				Path:  "/dev/net/tun",
+				Type:  "c",
+				Major: 10,
+				Minor: 200,
+			},
+			// Loopback control device
+			{
+				Path:  "/dev/loop-control",
+				Type:  "c",
+				Major: 10,
+				Minor: 237,
+			},
+		}...)
+
+		for i := 0; i <= 7; i++ {
+			s.Linux.Devices = append(s.Linux.Devices, specs.LinuxDevice{
+				Path:  fmt.Sprintf("/dev/loop%d", i),
+				Type:  "b",
+				Major: 7,
+				Minor: int64(i),
+			})
+		}
+
 		return nil
 	}
 }