From a1a85daeb5689e3092e9918e95ec94266e5bc11b Mon Sep 17 00:00:00 2001 From: Sebastiaan van Stijn Date: Tue, 17 Nov 2020 22:00:25 +0100 Subject: [PATCH] executor: switch to docker seccomp profile While we try to keep the containerd and docker seccomp profiles in sync, they may not always be; this switches the executor to use the docker seccomp profile, so that buildkit (when vendored in docker) will use the same default seccomp profile as is used for containers. Signed-off-by: Sebastiaan van Stijn --- executor/oci/spec_unix.go | 17 +- executor/oci/spec_windows.go | 5 - .../containerd/contrib/seccomp/seccomp.go | 54 -- .../seccomp/seccomp_default_unsupported.go | 26 - .../docker/profiles/seccomp/default.json | 814 ++++++++++++++++++ .../docker/profiles/seccomp/default_linux.go} | 487 ++++++----- .../docker/profiles/seccomp/kernel_linux.go | 59 ++ .../docker/docker/profiles/seccomp/seccomp.go | 101 +++ .../docker/profiles/seccomp/seccomp_linux.go | 178 ++++ .../profiles/seccomp/seccomp_unsupported.go | 8 + vendor/modules.txt | 2 +- 11 files changed, 1441 insertions(+), 310 deletions(-) delete mode 100644 vendor/github.com/containerd/containerd/contrib/seccomp/seccomp.go delete mode 100644 vendor/github.com/containerd/containerd/contrib/seccomp/seccomp_default_unsupported.go create mode 100644 vendor/github.com/docker/docker/profiles/seccomp/default.json rename vendor/github.com/{containerd/containerd/contrib/seccomp/seccomp_default.go => docker/docker/profiles/seccomp/default_linux.go} (55%) create mode 100644 vendor/github.com/docker/docker/profiles/seccomp/kernel_linux.go create mode 100644 vendor/github.com/docker/docker/profiles/seccomp/seccomp.go create mode 100644 vendor/github.com/docker/docker/profiles/seccomp/seccomp_linux.go create mode 100644 vendor/github.com/docker/docker/profiles/seccomp/seccomp_unsupported.go diff --git a/executor/oci/spec_unix.go b/executor/oci/spec_unix.go index de36195c3..5c3f4c58c 100644 --- a/executor/oci/spec_unix.go +++ b/executor/oci/spec_unix.go @@ -3,9 +3,12 @@ package oci import ( - "github.com/containerd/containerd/contrib/seccomp" + "context" + + "github.com/containerd/containerd/containers" "github.com/containerd/containerd/oci" "github.com/docker/docker/pkg/idtools" + "github.com/docker/docker/profiles/seccomp" "github.com/moby/buildkit/solver/pb" "github.com/moby/buildkit/util/entitlements/security" "github.com/moby/buildkit/util/system" @@ -31,7 +34,7 @@ func generateSecurityOpts(mode pb.SecurityMode) ([]oci.SpecOpts, error) { oci.WithWriteableSysfs, }, nil } else if system.SeccompSupported() && mode == pb.SecurityMode_SANDBOX { - return []oci.SpecOpts{seccomp.WithDefaultProfile()}, nil + return []oci.SpecOpts{withDefaultProfile()}, nil } return nil, nil } @@ -56,3 +59,13 @@ func generateIDmapOpts(idmap *idtools.IdentityMapping) ([]oci.SpecOpts, error) { oci.WithUserNamespace(specMapping(idmap.UIDs()), specMapping(idmap.GIDs())), }, nil } + +// withDefaultProfile sets the default seccomp profile to the spec. +// Note: must follow the setting of process capabilities +func withDefaultProfile() oci.SpecOpts { + return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { + var err error + s.Linux.Seccomp, err = seccomp.GetDefaultProfile(s) + return err + } +} diff --git a/executor/oci/spec_windows.go b/executor/oci/spec_windows.go index 4589c9d98..850a3b873 100644 --- a/executor/oci/spec_windows.go +++ b/executor/oci/spec_windows.go @@ -3,11 +3,9 @@ package oci import ( - "github.com/containerd/containerd/contrib/seccomp" "github.com/containerd/containerd/oci" "github.com/docker/docker/pkg/idtools" "github.com/moby/buildkit/solver/pb" - "github.com/moby/buildkit/util/system" "github.com/pkg/errors" ) @@ -19,9 +17,6 @@ func generateMountOpts(resolvConf, hostsFile string) ([]oci.SpecOpts, error) { func generateSecurityOpts(mode pb.SecurityMode) ([]oci.SpecOpts, error) { if mode == pb.SecurityMode_INSECURE { return nil, errors.New("no support for running in insecure mode on Windows") - } else if system.SeccompSupported() && mode == pb.SecurityMode_SANDBOX { - // TODO: Can LCOW support seccomp? Does that even make sense? - return []oci.SpecOpts{seccomp.WithDefaultProfile()}, nil } return nil, nil } diff --git a/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp.go b/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp.go deleted file mode 100644 index b7cf1765d..000000000 --- a/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp.go +++ /dev/null @@ -1,54 +0,0 @@ -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package seccomp - -import ( - "context" - "encoding/json" - "fmt" - "io/ioutil" - - "github.com/containerd/containerd/containers" - "github.com/containerd/containerd/oci" - "github.com/opencontainers/runtime-spec/specs-go" -) - -// WithProfile receives the name of a file stored on disk comprising a json -// formatted seccomp profile, as specified by the opencontainers/runtime-spec. -// The profile is read from the file, unmarshaled, and set to the spec. -func WithProfile(profile string) oci.SpecOpts { - return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { - s.Linux.Seccomp = &specs.LinuxSeccomp{} - f, err := ioutil.ReadFile(profile) - if err != nil { - return fmt.Errorf("cannot load seccomp profile %q: %v", profile, err) - } - if err := json.Unmarshal(f, s.Linux.Seccomp); err != nil { - return fmt.Errorf("decoding seccomp profile failed %q: %v", profile, err) - } - return nil - } -} - -// WithDefaultProfile sets the default seccomp profile to the spec. -// Note: must follow the setting of process capabilities -func WithDefaultProfile() oci.SpecOpts { - return func(_ context.Context, _ oci.Client, _ *containers.Container, s *specs.Spec) error { - s.Linux.Seccomp = DefaultProfile(s) - return nil - } -} diff --git a/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp_default_unsupported.go b/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp_default_unsupported.go deleted file mode 100644 index 6d7051058..000000000 --- a/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp_default_unsupported.go +++ /dev/null @@ -1,26 +0,0 @@ -// +build !linux - -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package seccomp - -import specs "github.com/opencontainers/runtime-spec/specs-go" - -// DefaultProfile defines the allowed syscalls for the default seccomp profile. -func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { - return &specs.LinuxSeccomp{} -} diff --git a/vendor/github.com/docker/docker/profiles/seccomp/default.json b/vendor/github.com/docker/docker/profiles/seccomp/default.json new file mode 100644 index 000000000..edf8ee2d0 --- /dev/null +++ b/vendor/github.com/docker/docker/profiles/seccomp/default.json @@ -0,0 +1,814 @@ +{ + "defaultAction": "SCMP_ACT_ERRNO", + "archMap": [ + { + "architecture": "SCMP_ARCH_X86_64", + "subArchitectures": [ + "SCMP_ARCH_X86", + "SCMP_ARCH_X32" + ] + }, + { + "architecture": "SCMP_ARCH_AARCH64", + "subArchitectures": [ + "SCMP_ARCH_ARM" + ] + }, + { + "architecture": "SCMP_ARCH_MIPS64", + "subArchitectures": [ + "SCMP_ARCH_MIPS", + "SCMP_ARCH_MIPS64N32" + ] + }, + { + "architecture": "SCMP_ARCH_MIPS64N32", + "subArchitectures": [ + "SCMP_ARCH_MIPS", + "SCMP_ARCH_MIPS64" + ] + }, + { + "architecture": "SCMP_ARCH_MIPSEL64", + "subArchitectures": [ + "SCMP_ARCH_MIPSEL", + "SCMP_ARCH_MIPSEL64N32" + ] + }, + { + "architecture": "SCMP_ARCH_MIPSEL64N32", + "subArchitectures": [ + "SCMP_ARCH_MIPSEL", + "SCMP_ARCH_MIPSEL64" + ] + }, + { + "architecture": "SCMP_ARCH_S390X", + "subArchitectures": [ + "SCMP_ARCH_S390" + ] + } + ], + "syscalls": [ + { + "names": [ + "accept", + "accept4", + "access", + "adjtimex", + "alarm", + "bind", + "brk", + "capget", + "capset", + "chdir", + "chmod", + "chown", + "chown32", + "clock_adjtime", + "clock_adjtime64", + "clock_getres", + "clock_getres_time64", + "clock_gettime", + "clock_gettime64", + "clock_nanosleep", + "clock_nanosleep_time64", + "close", + "connect", + "copy_file_range", + "creat", + "dup", + "dup2", + "dup3", + "epoll_create", + "epoll_create1", + "epoll_ctl", + "epoll_ctl_old", + "epoll_pwait", + "epoll_wait", + "epoll_wait_old", + "eventfd", + "eventfd2", + "execve", + "execveat", + "exit", + "exit_group", + "faccessat", + "faccessat2", + "fadvise64", + "fadvise64_64", + "fallocate", + "fanotify_mark", + "fchdir", + "fchmod", + "fchmodat", + "fchown", + "fchown32", + "fchownat", + "fcntl", + "fcntl64", + "fdatasync", + "fgetxattr", + "flistxattr", + "flock", + "fork", + "fremovexattr", + "fsetxattr", + "fstat", + "fstat64", + "fstatat64", + "fstatfs", + "fstatfs64", + "fsync", + "ftruncate", + "ftruncate64", + "futex", + "futex_time64", + "futimesat", + "getcpu", + "getcwd", + "getdents", + "getdents64", + "getegid", + "getegid32", + "geteuid", + "geteuid32", + "getgid", + "getgid32", + "getgroups", + "getgroups32", + "getitimer", + "getpeername", + "getpgid", + "getpgrp", + "getpid", + "getppid", + "getpriority", + "getrandom", + "getresgid", + "getresgid32", + "getresuid", + "getresuid32", + "getrlimit", + "get_robust_list", + "getrusage", + "getsid", + "getsockname", + "getsockopt", + "get_thread_area", + "gettid", + "gettimeofday", + "getuid", + "getuid32", + "getxattr", + "inotify_add_watch", + "inotify_init", + "inotify_init1", + "inotify_rm_watch", + "io_cancel", + "ioctl", + "io_destroy", + "io_getevents", + "io_pgetevents", + "io_pgetevents_time64", + "ioprio_get", + "ioprio_set", + "io_setup", + "io_submit", + "io_uring_enter", + "io_uring_register", + "io_uring_setup", + "ipc", + "kill", + "lchown", + "lchown32", + "lgetxattr", + "link", + "linkat", + "listen", + "listxattr", + "llistxattr", + "_llseek", + "lremovexattr", + "lseek", + "lsetxattr", + "lstat", + "lstat64", + "madvise", + "membarrier", + "memfd_create", + "mincore", + "mkdir", + "mkdirat", + "mknod", + "mknodat", + "mlock", + "mlock2", + "mlockall", + "mmap", + "mmap2", + "mprotect", + "mq_getsetattr", + "mq_notify", + "mq_open", + "mq_timedreceive", + "mq_timedreceive_time64", + "mq_timedsend", + "mq_timedsend_time64", + "mq_unlink", + "mremap", + "msgctl", + "msgget", + "msgrcv", + "msgsnd", + "msync", + "munlock", + "munlockall", + "munmap", + "nanosleep", + "newfstatat", + "_newselect", + "open", + "openat", + "openat2", + "pause", + "pipe", + "pipe2", + "poll", + "ppoll", + "ppoll_time64", + "prctl", + "pread64", + "preadv", + "preadv2", + "prlimit64", + "pselect6", + "pselect6_time64", + "pwrite64", + "pwritev", + "pwritev2", + "read", + "readahead", + "readlink", + "readlinkat", + "readv", + "recv", + "recvfrom", + "recvmmsg", + "recvmmsg_time64", + "recvmsg", + "remap_file_pages", + "removexattr", + "rename", + "renameat", + "renameat2", + "restart_syscall", + "rmdir", + "rseq", + "rt_sigaction", + "rt_sigpending", + "rt_sigprocmask", + "rt_sigqueueinfo", + "rt_sigreturn", + "rt_sigsuspend", + "rt_sigtimedwait", + "rt_sigtimedwait_time64", + "rt_tgsigqueueinfo", + "sched_getaffinity", + "sched_getattr", + "sched_getparam", + "sched_get_priority_max", + "sched_get_priority_min", + "sched_getscheduler", + "sched_rr_get_interval", + "sched_rr_get_interval_time64", + "sched_setaffinity", + "sched_setattr", + "sched_setparam", + "sched_setscheduler", + "sched_yield", + "seccomp", + "select", + "semctl", + "semget", + "semop", + "semtimedop", + "semtimedop_time64", + "send", + "sendfile", + "sendfile64", + "sendmmsg", + "sendmsg", + "sendto", + "setfsgid", + "setfsgid32", + "setfsuid", + "setfsuid32", + "setgid", + "setgid32", + "setgroups", + "setgroups32", + "setitimer", + "setpgid", + "setpriority", + "setregid", + "setregid32", + "setresgid", + "setresgid32", + "setresuid", + "setresuid32", + "setreuid", + "setreuid32", + "setrlimit", + "set_robust_list", + "setsid", + "setsockopt", + "set_thread_area", + "set_tid_address", + "setuid", + "setuid32", + "setxattr", + "shmat", + "shmctl", + "shmdt", + "shmget", + "shutdown", + "sigaltstack", + "signalfd", + "signalfd4", + "sigprocmask", + "sigreturn", + "socket", + "socketcall", + "socketpair", + "splice", + "stat", + "stat64", + "statfs", + "statfs64", + "statx", + "symlink", + "symlinkat", + "sync", + "sync_file_range", + "syncfs", + "sysinfo", + "tee", + "tgkill", + "time", + "timer_create", + "timer_delete", + "timer_getoverrun", + "timer_gettime", + "timer_gettime64", + "timer_settime", + "timer_settime64", + "timerfd_create", + "timerfd_gettime", + "timerfd_gettime64", + "timerfd_settime", + "timerfd_settime64", + "times", + "tkill", + "truncate", + "truncate64", + "ugetrlimit", + "umask", + "uname", + "unlink", + "unlinkat", + "utime", + "utimensat", + "utimensat_time64", + "utimes", + "vfork", + "vmsplice", + "wait4", + "waitid", + "waitpid", + "write", + "writev" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "ptrace" + ], + "action": "SCMP_ACT_ALLOW", + "args": null, + "comment": "", + "includes": { + "minKernel": "4.8" + }, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 0, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 8, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 131072, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 131080, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "personality" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 4294967295, + "op": "SCMP_CMP_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": {} + }, + { + "names": [ + "sync_file_range2" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "ppc64le" + ] + }, + "excludes": {} + }, + { + "names": [ + "arm_fadvise64_64", + "arm_sync_file_range", + "sync_file_range2", + "breakpoint", + "cacheflush", + "set_tls" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "arm", + "arm64" + ] + }, + "excludes": {} + }, + { + "names": [ + "arch_prctl" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "amd64", + "x32" + ] + }, + "excludes": {} + }, + { + "names": [ + "modify_ldt" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "amd64", + "x32", + "x86" + ] + }, + "excludes": {} + }, + { + "names": [ + "s390_pci_mmio_read", + "s390_pci_mmio_write", + "s390_runtime_instr" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "arches": [ + "s390", + "s390x" + ] + }, + "excludes": {} + }, + { + "names": [ + "open_by_handle_at" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_DAC_READ_SEARCH" + ] + }, + "excludes": {} + }, + { + "names": [ + "bpf", + "clone", + "fanotify_init", + "lookup_dcookie", + "mount", + "name_to_handle_at", + "perf_event_open", + "quotactl", + "setdomainname", + "sethostname", + "setns", + "syslog", + "umount", + "umount2", + "unshare" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_ADMIN" + ] + }, + "excludes": {} + }, + { + "names": [ + "clone" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 0, + "value": 2114060288, + "op": "SCMP_CMP_MASKED_EQ" + } + ], + "comment": "", + "includes": {}, + "excludes": { + "caps": [ + "CAP_SYS_ADMIN" + ], + "arches": [ + "s390", + "s390x" + ] + } + }, + { + "names": [ + "clone" + ], + "action": "SCMP_ACT_ALLOW", + "args": [ + { + "index": 1, + "value": 2114060288, + "op": "SCMP_CMP_MASKED_EQ" + } + ], + "comment": "s390 parameter ordering for clone is different", + "includes": { + "arches": [ + "s390", + "s390x" + ] + }, + "excludes": { + "caps": [ + "CAP_SYS_ADMIN" + ] + } + }, + { + "names": [ + "reboot" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_BOOT" + ] + }, + "excludes": {} + }, + { + "names": [ + "chroot" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_CHROOT" + ] + }, + "excludes": {} + }, + { + "names": [ + "delete_module", + "init_module", + "finit_module" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_MODULE" + ] + }, + "excludes": {} + }, + { + "names": [ + "acct" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_PACCT" + ] + }, + "excludes": {} + }, + { + "names": [ + "kcmp", + "process_vm_readv", + "process_vm_writev", + "ptrace" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_PTRACE" + ] + }, + "excludes": {} + }, + { + "names": [ + "iopl", + "ioperm" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_RAWIO" + ] + }, + "excludes": {} + }, + { + "names": [ + "settimeofday", + "stime", + "clock_settime" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_TIME" + ] + }, + "excludes": {} + }, + { + "names": [ + "vhangup" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_TTY_CONFIG" + ] + }, + "excludes": {} + }, + { + "names": [ + "get_mempolicy", + "mbind", + "set_mempolicy" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYS_NICE" + ] + }, + "excludes": {} + }, + { + "names": [ + "syslog" + ], + "action": "SCMP_ACT_ALLOW", + "args": [], + "comment": "", + "includes": { + "caps": [ + "CAP_SYSLOG" + ] + }, + "excludes": {} + } + ] +} \ No newline at end of file diff --git a/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp_default.go b/vendor/github.com/docker/docker/profiles/seccomp/default_linux.go similarity index 55% rename from vendor/github.com/containerd/containerd/contrib/seccomp/seccomp_default.go rename to vendor/github.com/docker/docker/profiles/seccomp/default_linux.go index dcf6a75e9..18b5cb02b 100644 --- a/vendor/github.com/containerd/containerd/contrib/seccomp/seccomp_default.go +++ b/vendor/github.com/docker/docker/profiles/seccomp/default_linux.go @@ -1,55 +1,48 @@ -// +build linux +// +build seccomp -/* - Copyright The containerd Authors. - - Licensed under the Apache License, Version 2.0 (the "License"); - you may not use this file except in compliance with the License. - You may obtain a copy of the License at - - http://www.apache.org/licenses/LICENSE-2.0 - - Unless required by applicable law or agreed to in writing, software - distributed under the License is distributed on an "AS IS" BASIS, - WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - See the License for the specific language governing permissions and - limitations under the License. -*/ - -package seccomp +package seccomp // import "github.com/docker/docker/profiles/seccomp" import ( - "runtime" - - "golang.org/x/sys/unix" - "github.com/opencontainers/runtime-spec/specs-go" + "golang.org/x/sys/unix" ) -func arches() []specs.Arch { - switch runtime.GOARCH { - case "amd64": - return []specs.Arch{specs.ArchX86_64, specs.ArchX86, specs.ArchX32} - case "arm64": - return []specs.Arch{specs.ArchARM, specs.ArchAARCH64} - case "mips64": - return []specs.Arch{specs.ArchMIPS, specs.ArchMIPS64, specs.ArchMIPS64N32} - case "mips64n32": - return []specs.Arch{specs.ArchMIPS, specs.ArchMIPS64, specs.ArchMIPS64N32} - case "mipsel64": - return []specs.Arch{specs.ArchMIPSEL, specs.ArchMIPSEL64, specs.ArchMIPSEL64N32} - case "mipsel64n32": - return []specs.Arch{specs.ArchMIPSEL, specs.ArchMIPSEL64, specs.ArchMIPSEL64N32} - case "s390x": - return []specs.Arch{specs.ArchS390, specs.ArchS390X} - default: - return []specs.Arch{} +func arches() []Architecture { + return []Architecture{ + { + Arch: specs.ArchX86_64, + SubArches: []specs.Arch{specs.ArchX86, specs.ArchX32}, + }, + { + Arch: specs.ArchAARCH64, + SubArches: []specs.Arch{specs.ArchARM}, + }, + { + Arch: specs.ArchMIPS64, + SubArches: []specs.Arch{specs.ArchMIPS, specs.ArchMIPS64N32}, + }, + { + Arch: specs.ArchMIPS64N32, + SubArches: []specs.Arch{specs.ArchMIPS, specs.ArchMIPS64}, + }, + { + Arch: specs.ArchMIPSEL64, + SubArches: []specs.Arch{specs.ArchMIPSEL, specs.ArchMIPSEL64N32}, + }, + { + Arch: specs.ArchMIPSEL64N32, + SubArches: []specs.Arch{specs.ArchMIPSEL, specs.ArchMIPSEL64}, + }, + { + Arch: specs.ArchS390X, + SubArches: []specs.Arch{specs.ArchS390}, + }, } } // DefaultProfile defines the allowed syscalls for the default seccomp profile. -func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { - syscalls := []specs.LinuxSyscall{ +func DefaultProfile() *Seccomp { + syscalls := []*Syscall{ { Names: []string{ "accept", @@ -232,8 +225,6 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "openat", "openat2", "pause", - "pidfd_open", - "pidfd_send_signal", "pipe", "pipe2", "poll", @@ -392,12 +383,19 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "writev", }, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, + Args: []*specs.LinuxSeccompArg{}, + }, + { + Names: []string{"ptrace"}, + Action: specs.ActAllow, + Includes: Filter{ + MinKernel: &KernelVersion{4, 8}, + }, }, { Names: []string{"personality"}, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{ + Args: []*specs.LinuxSeccompArg{ { Index: 0, Value: 0x0, @@ -408,7 +406,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { { Names: []string{"personality"}, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{ + Args: []*specs.LinuxSeccompArg{ { Index: 0, Value: 0x0008, @@ -419,7 +417,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { { Names: []string{"personality"}, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{ + Args: []*specs.LinuxSeccompArg{ { Index: 0, Value: 0x20000, @@ -430,7 +428,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { { Names: []string{"personality"}, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{ + Args: []*specs.LinuxSeccompArg{ { Index: 0, Value: 0x20008, @@ -441,7 +439,7 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { { Names: []string{"personality"}, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{ + Args: []*specs.LinuxSeccompArg{ { Index: 0, Value: 0xffffffff, @@ -449,26 +447,17 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { }, }, }, - } - - s := &specs.LinuxSeccomp{ - DefaultAction: specs.ActErrno, - Architectures: arches(), - Syscalls: syscalls, - } - - // include by arch - switch runtime.GOARCH { - case "ppc64le": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ + { Names: []string{ "sync_file_range2", }, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "arm", "arm64": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Arches: []string{"ppc64le"}, + }, + }, + { Names: []string{ "arm_fadvise64_64", "arm_sync_file_range", @@ -478,177 +467,231 @@ func DefaultProfile(sp *specs.Spec) *specs.LinuxSeccomp { "set_tls", }, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "amd64": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Arches: []string{"arm", "arm64"}, + }, + }, + { Names: []string{ "arch_prctl", - "modify_ldt", }, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "386": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Arches: []string{"amd64", "x32"}, + }, + }, + { Names: []string{ "modify_ldt", }, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "s390", "s390x": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Arches: []string{"amd64", "x32", "x86"}, + }, + }, + { Names: []string{ "s390_pci_mmio_read", "s390_pci_mmio_write", "s390_runtime_instr", }, Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Arches: []string{"s390", "s390x"}, + }, + }, + { + Names: []string{ + "open_by_handle_at", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_DAC_READ_SEARCH"}, + }, + }, + { + Names: []string{ + "bpf", + "clone", + "fanotify_init", + "lookup_dcookie", + "mount", + "name_to_handle_at", + "perf_event_open", + "quotactl", + "setdomainname", + "sethostname", + "setns", + "syslog", + "umount", + "umount2", + "unshare", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_ADMIN"}, + }, + }, + { + Names: []string{ + "clone", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{ + { + Index: 0, + Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, + ValueTwo: 0, + Op: specs.OpMaskedEqual, + }, + }, + Excludes: Filter{ + Caps: []string{"CAP_SYS_ADMIN"}, + Arches: []string{"s390", "s390x"}, + }, + }, + { + Names: []string{ + "clone", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{ + { + Index: 1, + Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, + ValueTwo: 0, + Op: specs.OpMaskedEqual, + }, + }, + Comment: "s390 parameter ordering for clone is different", + Includes: Filter{ + Arches: []string{"s390", "s390x"}, + }, + Excludes: Filter{ + Caps: []string{"CAP_SYS_ADMIN"}, + }, + }, + { + Names: []string{ + "reboot", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_BOOT"}, + }, + }, + { + Names: []string{ + "chroot", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_CHROOT"}, + }, + }, + { + Names: []string{ + "delete_module", + "init_module", + "finit_module", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_MODULE"}, + }, + }, + { + Names: []string{ + "acct", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_PACCT"}, + }, + }, + { + Names: []string{ + "kcmp", + "process_vm_readv", + "process_vm_writev", + "ptrace", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_PTRACE"}, + }, + }, + { + Names: []string{ + "iopl", + "ioperm", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_RAWIO"}, + }, + }, + { + Names: []string{ + "settimeofday", + "stime", + "clock_settime", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_TIME"}, + }, + }, + { + Names: []string{ + "vhangup", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_TTY_CONFIG"}, + }, + }, + { + Names: []string{ + "get_mempolicy", + "mbind", + "set_mempolicy", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYS_NICE"}, + }, + }, + { + Names: []string{ + "syslog", + }, + Action: specs.ActAllow, + Args: []*specs.LinuxSeccompArg{}, + Includes: Filter{ + Caps: []string{"CAP_SYSLOG"}, + }, + }, } - admin := false - for _, c := range sp.Process.Capabilities.Bounding { - switch c { - case "CAP_DAC_READ_SEARCH": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{"open_by_handle_at"}, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_ADMIN": - admin = true - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{ - "bpf", - "clone", - "fanotify_init", - "lookup_dcookie", - "mount", - "name_to_handle_at", - "perf_event_open", - "quotactl", - "setdomainname", - "sethostname", - "setns", - "syslog", - "umount", - "umount2", - "unshare", - }, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_BOOT": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{"reboot"}, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_CHROOT": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{"chroot"}, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_MODULE": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{ - "delete_module", - "init_module", - "finit_module", - }, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_PACCT": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{"acct"}, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_PTRACE": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{ - "kcmp", - "pidfd_getfd", - "process_vm_readv", - "process_vm_writev", - "ptrace", - }, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_RAWIO": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{ - "iopl", - "ioperm", - }, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_TIME": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{ - "settimeofday", - "stime", - "clock_settime", - }, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYS_TTY_CONFIG": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{"vhangup"}, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - case "CAP_SYSLOG": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{"syslog"}, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{}, - }) - } + return &Seccomp{ + DefaultAction: specs.ActErrno, + ArchMap: arches(), + Syscalls: syscalls, } - - if !admin { - switch runtime.GOARCH { - case "s390", "s390x": - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{ - "clone", - }, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{ - { - Index: 1, - Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, - ValueTwo: 0, - Op: specs.OpMaskedEqual, - }, - }, - }) - default: - s.Syscalls = append(s.Syscalls, specs.LinuxSyscall{ - Names: []string{ - "clone", - }, - Action: specs.ActAllow, - Args: []specs.LinuxSeccompArg{ - { - Index: 0, - Value: unix.CLONE_NEWNS | unix.CLONE_NEWUTS | unix.CLONE_NEWIPC | unix.CLONE_NEWUSER | unix.CLONE_NEWPID | unix.CLONE_NEWNET | unix.CLONE_NEWCGROUP, - ValueTwo: 0, - Op: specs.OpMaskedEqual, - }, - }, - }) - } - } - - return s } diff --git a/vendor/github.com/docker/docker/profiles/seccomp/kernel_linux.go b/vendor/github.com/docker/docker/profiles/seccomp/kernel_linux.go new file mode 100644 index 000000000..558eabda3 --- /dev/null +++ b/vendor/github.com/docker/docker/profiles/seccomp/kernel_linux.go @@ -0,0 +1,59 @@ +package seccomp + +import ( + "bytes" + "fmt" + "sync" + + "golang.org/x/sys/unix" +) + +var ( + currentKernelVersion *KernelVersion + kernelVersionError error + once sync.Once +) + +// getKernelVersion gets the current kernel version. +func getKernelVersion() (*KernelVersion, error) { + once.Do(func() { + var uts unix.Utsname + if err := unix.Uname(&uts); err != nil { + return + } + // Remove the \x00 from the release for Atoi to parse correctly + currentKernelVersion, kernelVersionError = parseRelease(string(uts.Release[:bytes.IndexByte(uts.Release[:], 0)])) + }) + return currentKernelVersion, kernelVersionError +} + +// parseRelease parses a string and creates a KernelVersion based on it. +func parseRelease(release string) (*KernelVersion, error) { + var version = KernelVersion{} + + // We're only make sure we get the "kernel" and "major revision". Sometimes we have + // 3.12.25-gentoo, but sometimes we just have 3.12-1-amd64. + _, err := fmt.Sscanf(release, "%d.%d", &version.Kernel, &version.Major) + if err != nil { + return nil, fmt.Errorf("failed to parse kernel version %q: %w", release, err) + } + return &version, nil +} + +// kernelGreaterEqualThan checks if the host's kernel version is greater than, or +// equal to the given kernel version v. Only "kernel version" and "major revision" +// can be specified (e.g., "3.12") and will be taken into account, which means +// that 3.12.25-gentoo and 3.12-1-amd64 are considered equal (kernel: 3, major: 12). +func kernelGreaterEqualThan(minVersion KernelVersion) (bool, error) { + kv, err := getKernelVersion() + if err != nil { + return false, err + } + if kv.Kernel > minVersion.Kernel { + return true, nil + } + if kv.Kernel == minVersion.Kernel && kv.Major >= minVersion.Major { + return true, nil + } + return false, nil +} diff --git a/vendor/github.com/docker/docker/profiles/seccomp/seccomp.go b/vendor/github.com/docker/docker/profiles/seccomp/seccomp.go new file mode 100644 index 000000000..d2a21cddc --- /dev/null +++ b/vendor/github.com/docker/docker/profiles/seccomp/seccomp.go @@ -0,0 +1,101 @@ +package seccomp // import "github.com/docker/docker/profiles/seccomp" + +import ( + "encoding/json" + "fmt" + "strconv" + "strings" + + "github.com/opencontainers/runtime-spec/specs-go" +) + +// Seccomp represents the config for a seccomp profile for syscall restriction. +type Seccomp struct { + DefaultAction specs.LinuxSeccompAction `json:"defaultAction"` + // Architectures is kept to maintain backward compatibility with the old + // seccomp profile. + Architectures []specs.Arch `json:"architectures,omitempty"` + ArchMap []Architecture `json:"archMap,omitempty"` + Syscalls []*Syscall `json:"syscalls"` +} + +// Architecture is used to represent a specific architecture +// and its sub-architectures +type Architecture struct { + Arch specs.Arch `json:"architecture"` + SubArches []specs.Arch `json:"subArchitectures"` +} + +// Filter is used to conditionally apply Seccomp rules +type Filter struct { + Caps []string `json:"caps,omitempty"` + Arches []string `json:"arches,omitempty"` + + // MinKernel describes the minimum kernel version the rule must be applied + // on, in the format "." (e.g. "3.12"). + // + // When matching the kernel version of the host, minor revisions, and distro- + // specific suffixes are ignored, which means that "3.12.25-gentoo", "3.12-1-amd64", + // "3.12", and "3.12-rc5" are considered equal (kernel 3, major revision 12). + MinKernel *KernelVersion `json:"minKernel,omitempty"` +} + +// Syscall is used to match a group of syscalls in Seccomp +type Syscall struct { + Name string `json:"name,omitempty"` + Names []string `json:"names,omitempty"` + Action specs.LinuxSeccompAction `json:"action"` + Args []*specs.LinuxSeccompArg `json:"args"` + Comment string `json:"comment"` + Includes Filter `json:"includes"` + Excludes Filter `json:"excludes"` +} + +// KernelVersion holds information about the kernel. +type KernelVersion struct { + Kernel uint64 // Version of the Kernel (i.e., the "4" in "4.1.2-generic") + Major uint64 // Major revision of the Kernel (i.e., the "1" in "4.1.2-generic") +} + +// String implements fmt.Stringer for KernelVersion +func (k *KernelVersion) String() string { + if k.Kernel > 0 || k.Major > 0 { + return fmt.Sprintf("%d.%d", k.Kernel, k.Major) + } + return "" +} + +// MarshalJSON implements json.Unmarshaler for KernelVersion +func (k *KernelVersion) MarshalJSON() ([]byte, error) { + return json.Marshal(k.String()) +} + +// UnmarshalJSON implements json.Marshaler for KernelVersion +func (k *KernelVersion) UnmarshalJSON(version []byte) error { + var ( + ver string + err error + ) + + // make sure we have a string + if err = json.Unmarshal(version, &ver); err != nil { + return fmt.Errorf(`invalid kernel version: %s, expected ".": %v`, string(version), err) + } + if ver == "" { + return nil + } + parts := strings.SplitN(ver, ".", 3) + if len(parts) != 2 { + return fmt.Errorf(`invalid kernel version: %s, expected "."`, string(version)) + } + if k.Kernel, err = strconv.ParseUint(parts[0], 10, 8); err != nil { + return fmt.Errorf(`invalid kernel version: %s, expected ".": %v`, string(version), err) + } + if k.Major, err = strconv.ParseUint(parts[1], 10, 8); err != nil { + return fmt.Errorf(`invalid kernel version: %s, expected ".": %v`, string(version), err) + } + if k.Kernel == 0 && k.Major == 0 { + return fmt.Errorf(`invalid kernel version: %s, expected ".": version cannot be 0.0`, string(version)) + } + return nil +} diff --git a/vendor/github.com/docker/docker/profiles/seccomp/seccomp_linux.go b/vendor/github.com/docker/docker/profiles/seccomp/seccomp_linux.go new file mode 100644 index 000000000..566f173ac --- /dev/null +++ b/vendor/github.com/docker/docker/profiles/seccomp/seccomp_linux.go @@ -0,0 +1,178 @@ +//go:generate go run -tags 'seccomp' generate.go + +package seccomp // import "github.com/docker/docker/profiles/seccomp" + +import ( + "encoding/json" + "errors" + "fmt" + "runtime" + + specs "github.com/opencontainers/runtime-spec/specs-go" +) + +// GetDefaultProfile returns the default seccomp profile. +func GetDefaultProfile(rs *specs.Spec) (*specs.LinuxSeccomp, error) { + return setupSeccomp(DefaultProfile(), rs) +} + +// LoadProfile takes a json string and decodes the seccomp profile. +func LoadProfile(body string, rs *specs.Spec) (*specs.LinuxSeccomp, error) { + var config Seccomp + if err := json.Unmarshal([]byte(body), &config); err != nil { + return nil, fmt.Errorf("Decoding seccomp profile failed: %v", err) + } + return setupSeccomp(&config, rs) +} + +// libseccomp string => seccomp arch +var nativeToSeccomp = map[string]specs.Arch{ + "x86": specs.ArchX86, + "amd64": specs.ArchX86_64, + "arm": specs.ArchARM, + "arm64": specs.ArchAARCH64, + "mips64": specs.ArchMIPS64, + "mips64n32": specs.ArchMIPS64N32, + "mipsel64": specs.ArchMIPSEL64, + "mips3l64n32": specs.ArchMIPSEL64N32, + "mipsle": specs.ArchMIPSEL, + "ppc": specs.ArchPPC, + "ppc64": specs.ArchPPC64, + "ppc64le": specs.ArchPPC64LE, + "s390": specs.ArchS390, + "s390x": specs.ArchS390X, +} + +// GOARCH => libseccomp string +var goToNative = map[string]string{ + "386": "x86", + "amd64": "amd64", + "arm": "arm", + "arm64": "arm64", + "mips64": "mips64", + "mips64p32": "mips64n32", + "mips64le": "mipsel64", + "mips64p32le": "mips3l64n32", + "mipsle": "mipsel", + "ppc": "ppc", + "ppc64": "ppc64", + "ppc64le": "ppc64le", + "s390": "s390", + "s390x": "s390x", +} + +// inSlice tests whether a string is contained in a slice of strings or not. +// Comparison is case sensitive +func inSlice(slice []string, s string) bool { + for _, ss := range slice { + if s == ss { + return true + } + } + return false +} + +func setupSeccomp(config *Seccomp, rs *specs.Spec) (*specs.LinuxSeccomp, error) { + if config == nil { + return nil, nil + } + + // No default action specified, no syscalls listed, assume seccomp disabled + if config.DefaultAction == "" && len(config.Syscalls) == 0 { + return nil, nil + } + + newConfig := &specs.LinuxSeccomp{} + + if len(config.Architectures) != 0 && len(config.ArchMap) != 0 { + return nil, errors.New("'architectures' and 'archMap' were specified in the seccomp profile, use either 'architectures' or 'archMap'") + } + + // if config.Architectures == 0 then libseccomp will figure out the architecture to use + if len(config.Architectures) != 0 { + newConfig.Architectures = config.Architectures + } + + arch := goToNative[runtime.GOARCH] + seccompArch, archExists := nativeToSeccomp[arch] + + if len(config.ArchMap) != 0 && archExists { + for _, a := range config.ArchMap { + if a.Arch == seccompArch { + newConfig.Architectures = append(newConfig.Architectures, a.Arch) + newConfig.Architectures = append(newConfig.Architectures, a.SubArches...) + break + } + } + } + + newConfig.DefaultAction = config.DefaultAction + +Loop: + // Loop through all syscall blocks and convert them to libcontainer format after filtering them + for _, call := range config.Syscalls { + if len(call.Excludes.Arches) > 0 { + if inSlice(call.Excludes.Arches, arch) { + continue Loop + } + } + if len(call.Excludes.Caps) > 0 { + for _, c := range call.Excludes.Caps { + if inSlice(rs.Process.Capabilities.Bounding, c) { + continue Loop + } + } + } + if call.Excludes.MinKernel != nil { + if ok, err := kernelGreaterEqualThan(*call.Excludes.MinKernel); err != nil { + return nil, err + } else if ok { + continue Loop + } + } + if len(call.Includes.Arches) > 0 { + if !inSlice(call.Includes.Arches, arch) { + continue Loop + } + } + if len(call.Includes.Caps) > 0 { + for _, c := range call.Includes.Caps { + if !inSlice(rs.Process.Capabilities.Bounding, c) { + continue Loop + } + } + } + if call.Includes.MinKernel != nil { + if ok, err := kernelGreaterEqualThan(*call.Includes.MinKernel); err != nil { + return nil, err + } else if !ok { + continue Loop + } + } + + if call.Name != "" && len(call.Names) != 0 { + return nil, errors.New("'name' and 'names' were specified in the seccomp profile, use either 'name' or 'names'") + } + + if call.Name != "" { + newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall([]string{call.Name}, call.Action, call.Args)) + } else { + newConfig.Syscalls = append(newConfig.Syscalls, createSpecsSyscall(call.Names, call.Action, call.Args)) + } + } + + return newConfig, nil +} + +func createSpecsSyscall(names []string, action specs.LinuxSeccompAction, args []*specs.LinuxSeccompArg) specs.LinuxSyscall { + newCall := specs.LinuxSyscall{ + Names: names, + Action: action, + } + + // Loop through all the arguments of the syscall and convert them + for _, arg := range args { + newCall.Args = append(newCall.Args, *arg) + } + return newCall +} diff --git a/vendor/github.com/docker/docker/profiles/seccomp/seccomp_unsupported.go b/vendor/github.com/docker/docker/profiles/seccomp/seccomp_unsupported.go new file mode 100644 index 000000000..01f3eb96f --- /dev/null +++ b/vendor/github.com/docker/docker/profiles/seccomp/seccomp_unsupported.go @@ -0,0 +1,8 @@ +// +build linux,!seccomp + +package seccomp // import "github.com/docker/docker/profiles/seccomp" + +// DefaultProfile returns a nil pointer on unsupported systems. +func DefaultProfile() *Seccomp { + return nil +} diff --git a/vendor/modules.txt b/vendor/modules.txt index c6181a7e3..fbdc561c1 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -59,7 +59,6 @@ github.com/containerd/containerd/containers github.com/containerd/containerd/content github.com/containerd/containerd/content/local github.com/containerd/containerd/content/proxy -github.com/containerd/containerd/contrib/seccomp github.com/containerd/containerd/defaults github.com/containerd/containerd/diff github.com/containerd/containerd/diff/apply @@ -191,6 +190,7 @@ github.com/docker/docker/pkg/reexec github.com/docker/docker/pkg/signal github.com/docker/docker/pkg/stringid github.com/docker/docker/pkg/system +github.com/docker/docker/profiles/seccomp github.com/docker/docker/testutil/daemon github.com/docker/docker/testutil/environment github.com/docker/docker/testutil/fixtures/load