builder: Set xattr attributes inside tar archives
Avoid the need during the build to require additional privileges by
setting file capabilities on virt-launcher and libvirtd for non-root
runs on the tar files instead of doing this on a real filesystem.
load("@io_bazel_rules_go//go:def.bzl", "go_binary", "go_library")
+load("@bazeldnf//:deps.bzl", "xattrs")
go_library(
name = "go_default_library",
@@ -46,14 +47,6 @@ go_binary(
x_defs = version_x_defs(),
)
-genrule(
- name = "setcaps",
- srcs = [":virt-launcher"],
- outs = ["virt-launcher.tar.gz"],
- cmd = "path=$$(readlink -f $(location virt-launcher)) && cp $$path virt-launcher && setcap 'cap_net_bind_service+eip' virt-launcher && (chcon -t container_file_t virt-launcher || true) && tar --xattrs -czvf virt-launcher.tar.gz virt-launcher && mv virt-launcher.tar.gz $@",
- visibility = ["//visibility:public"],
-)
-
load(
"@io_bazel_rules_docker//container:container.bzl",
"container_image",
@@ -62,6 +55,31 @@ load("@io_bazel_rules_docker//contrib:group.bzl", "group_entry", "group_file")
load("@io_bazel_rules_docker//contrib:passwd.bzl", "passwd_entry", "passwd_file")
load("@bazel_tools//tools/build_defs/pkg:pkg.bzl", "pkg_tar")
+pkg_tar(
+ name = "virt-launcher-tar",
+ srcs = [
+ "node-labeller/node-labeller.sh",
+ ":virt-launcher",
+ "//cmd/container-disk-v2alpha:container-disk",
+ "//cmd/virt-freezer",
+ "//cmd/virt-probe",
+ ],
+ package_dir = "/usr/bin",
+)
+
+xattrs(
+ name = "setcaps",
+ capabilities = {
+ "/usr/bin/virt-launcher": [
+ "cap_net_bind_service",
+ ],
+ },
+ selinux_labels = {
+ "/usr/bin/virt-launcher": "system_u:object_r:container_file_t:s0",
+ },
+ tar = ":virt-launcher-tar",
+)
+
passwd_entry(
name = "root-user",
gid = 0,
@@ -165,14 +183,7 @@ container_image(
"//conditions:default": "amd64",
}),
base = ":version-container",
- directory = "/usr/bin",
entrypoint = ["/usr/bin/virt-launcher"],
- files = [
- "node-labeller/node-labeller.sh",
- "//cmd/container-disk-v2alpha:container-disk",
- "//cmd/virt-freezer",
- "//cmd/virt-probe",
- ],
tars = [":setcaps"],
visibility = ["//visibility:public"],
)
