Skip to content

Commit d927397

Browse files
thaJeztahthaJeztah
committed
seccomp.Syscall: embed runtime-spec Syscall type
This makes the type better reflect the difference with the "runtime" profile; our local type is used to generate a runtime-spec seccomp profile and extends the runtime-spec type with additional fields; adding a "Name" field for backward compatibility with older JSON representations, additional "Comment" metadata, and conditional rules ("Includes", "Excludes") used during generation to adjust the profile based on the container (capabilities) and host's (architecture, kernel) configuration. This change introduces one change in the type; the "runtime-spec" type uses a `[]LinuxSeccompArg` for the `Args` field, whereas the local type used pointers; `[]*LinuxSeccompArg`. In addition, the runtime-spec Syscall type brings a new `ErrnoRet` field, allowing the profile to specify the errno code returned for the syscall, which allows changing the default EPERM for specific syscalls. Signed-off-by: Sebastiaan van Stijn <[email protected]>
1 parent b9ad7b9 commit d927397

6 files changed

Lines changed: 609 additions & 563 deletions

File tree

‎profiles/seccomp/default.json‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -394,7 +394,6 @@
394394
"writev"
395395
],
396396
"action": "SCMP_ACT_ALLOW",
397-
"args": [],
398397
"comment": "",
399398
"includes": {},
400399
"excludes": {}
@@ -406,7 +405,6 @@
406405
"ptrace"
407406
],
408407
"action": "SCMP_ACT_ALLOW",
409-
"args": null,
410408
"comment": "",
411409
"includes": {
412410
"minKernel": "4.8"
@@ -498,7 +496,6 @@
498496
"sync_file_range2"
499497
],
500498
"action": "SCMP_ACT_ALLOW",
501-
"args": [],
502499
"comment": "",
503500
"includes": {
504501
"arches": [
@@ -517,7 +514,6 @@
517514
"set_tls"
518515
],
519516
"action": "SCMP_ACT_ALLOW",
520-
"args": [],
521517
"comment": "",
522518
"includes": {
523519
"arches": [
@@ -532,7 +528,6 @@
532528
"arch_prctl"
533529
],
534530
"action": "SCMP_ACT_ALLOW",
535-
"args": [],
536531
"comment": "",
537532
"includes": {
538533
"arches": [
@@ -547,7 +542,6 @@
547542
"modify_ldt"
548543
],
549544
"action": "SCMP_ACT_ALLOW",
550-
"args": [],
551545
"comment": "",
552546
"includes": {
553547
"arches": [
@@ -565,7 +559,6 @@
565559
"s390_runtime_instr"
566560
],
567561
"action": "SCMP_ACT_ALLOW",
568-
"args": [],
569562
"comment": "",
570563
"includes": {
571564
"arches": [
@@ -580,7 +573,6 @@
580573
"open_by_handle_at"
581574
],
582575
"action": "SCMP_ACT_ALLOW",
583-
"args": [],
584576
"comment": "",
585577
"includes": {
586578
"caps": [
@@ -614,7 +606,6 @@
614606
"unshare"
615607
],
616608
"action": "SCMP_ACT_ALLOW",
617-
"args": [],
618609
"comment": "",
619610
"includes": {
620611
"caps": [
@@ -677,7 +668,6 @@
677668
"reboot"
678669
],
679670
"action": "SCMP_ACT_ALLOW",
680-
"args": [],
681671
"comment": "",
682672
"includes": {
683673
"caps": [
@@ -691,7 +681,6 @@
691681
"chroot"
692682
],
693683
"action": "SCMP_ACT_ALLOW",
694-
"args": [],
695684
"comment": "",
696685
"includes": {
697686
"caps": [
@@ -707,7 +696,6 @@
707696
"finit_module"
708697
],
709698
"action": "SCMP_ACT_ALLOW",
710-
"args": [],
711699
"comment": "",
712700
"includes": {
713701
"caps": [
@@ -721,7 +709,6 @@
721709
"acct"
722710
],
723711
"action": "SCMP_ACT_ALLOW",
724-
"args": [],
725712
"comment": "",
726713
"includes": {
727714
"caps": [
@@ -740,7 +727,6 @@
740727
"ptrace"
741728
],
742729
"action": "SCMP_ACT_ALLOW",
743-
"args": [],
744730
"comment": "",
745731
"includes": {
746732
"caps": [
@@ -755,7 +741,6 @@
755741
"ioperm"
756742
],
757743
"action": "SCMP_ACT_ALLOW",
758-
"args": [],
759744
"comment": "",
760745
"includes": {
761746
"caps": [
@@ -771,7 +756,6 @@
771756
"clock_settime"
772757
],
773758
"action": "SCMP_ACT_ALLOW",
774-
"args": [],
775759
"comment": "",
776760
"includes": {
777761
"caps": [
@@ -785,7 +769,6 @@
785769
"vhangup"
786770
],
787771
"action": "SCMP_ACT_ALLOW",
788-
"args": [],
789772
"comment": "",
790773
"includes": {
791774
"caps": [
@@ -801,7 +784,6 @@
801784
"set_mempolicy"
802785
],
803786
"action": "SCMP_ACT_ALLOW",
804-
"args": [],
805787
"comment": "",
806788
"includes": {
807789
"caps": [
@@ -815,7 +797,6 @@
815797
"syslog"
816798
],
817799
"action": "SCMP_ACT_ALLOW",
818-
"args": [],
819800
"comment": "",
820801
"includes": {
821802
"caps": [

0 commit comments

Comments
 (0)