libcontainer: newContainerCapList() refactor to reduce duplicated code
@@ -25,62 +25,45 @@ func init() {
}
func newContainerCapList(capConfig *configs.Capabilities) (*containerCapabilities, error) {
- bounding := make([]capability.Cap, len(capConfig.Bounding))
- for i, c := range capConfig.Bounding {
- v, ok := capabilityMap[c]
- if !ok {
- return nil, fmt.Errorf("unknown capability %q", c)
+ var (
+ err error
+ caps containerCapabilities
+ )
+
+ if caps.bounding, err = capSlice(capConfig.Bounding); err != nil {
+ return nil, err
}
- bounding[i] = v
+ if caps.effective, err = capSlice(capConfig.Effective); err != nil {
+ return nil, err
}
- effective := make([]capability.Cap, len(capConfig.Effective))
- for i, c := range capConfig.Effective {
- v, ok := capabilityMap[c]
- if !ok {
- return nil, fmt.Errorf("unknown capability %q", c)
+ if caps.inheritable, err = capSlice(capConfig.Inheritable); err != nil {
+ return nil, err
}
- effective[i] = v
+ if caps.permitted, err = capSlice(capConfig.Permitted); err != nil {
+ return nil, err
}
- inheritable := make([]capability.Cap, len(capConfig.Inheritable))
- for i, c := range capConfig.Inheritable {
- v, ok := capabilityMap[c]
- if !ok {
- return nil, fmt.Errorf("unknown capability %q", c)
+ if caps.ambient, err = capSlice(capConfig.Ambient); err != nil {
+ return nil, err
}
- inheritable[i] = v
+ if caps.pid, err = capability.NewPid2(0); err != nil {
+ return nil, err
}
- permitted := make([]capability.Cap, len(capConfig.Permitted))
- for i, c := range capConfig.Permitted {
- v, ok := capabilityMap[c]
- if !ok {
- return nil, fmt.Errorf("unknown capability %q", c)
+ if err = caps.pid.Load(); err != nil {
+ return nil, err
}
- permitted[i] = v
+ return &caps, nil
}
- ambient := make([]capability.Cap, len(capConfig.Ambient))
- for i, c := range capConfig.Ambient {
+
+func capSlice(caps []string) ([]capability.Cap, error) {
+ out := make([]capability.Cap, len(caps))
+ for i, c := range caps {
v, ok := capabilityMap[c]
if !ok {
return nil, fmt.Errorf("unknown capability %q", c)
}
- ambient[i] = v
- }
- pid, err := capability.NewPid2(0)
- if err != nil {
- return nil, err
- }
- err = pid.Load()
- if err != nil {
- return nil, err
+ out[i] = v
}
- return &containerCapabilities{
- bounding: bounding,
- effective: effective,
- inheritable: inheritable,
- permitted: permitted,
- ambient: ambient,
- pid: pid,
- }, nil
+ return out, nil
}
type containerCapabilities struct {
