libcontainer: honor seccomp defaultErrnoRet

giuseppe · giuseppe · commit c61f6062547d · 2021-05-17T09:23:32.000+02:00
opencontainers/runtime-spec#1087 added support for defaultErrnoRet to the OCI runtime specs. If a defaultErrnoRet is specified, disable patching the generated libseccomp cBPF. Closes: #2943 Signed-off-by: Giuseppe Scrivano <gscrivan@redhat.com>
diff --git a/libcontainer/configs/config.go b/libcontainer/configs/config.go
@@ -31,9 +31,10 @@ type IDMap struct {
 // for syscalls. Additional architectures can be added by specifying them in
 // Architectures.
 type Seccomp struct {
-	DefaultAction Action     `json:"default_action"`
-	Architectures []string   `json:"architectures"`
-	Syscalls      []*Syscall `json:"syscalls"`
+	DefaultAction   Action     `json:"default_action"`
+	Architectures   []string   `json:"architectures"`
+	Syscalls        []*Syscall `json:"syscalls"`
+	DefaultErrnoRet *uint      `json:"default_errno_ret"`
 }
 
 // Action is taken upon rule match in Seccomp
diff --git a/libcontainer/seccomp/patchbpf/enosys_linux.go b/libcontainer/seccomp/patchbpf/enosys_linux.go
@@ -523,6 +523,11 @@ func assemble(program []bpf.Instruction) ([]unix.SockFilter, error) {
 }
 
 func generatePatch(config *configs.Seccomp) ([]bpf.Instruction, error) {
+	// Patch the generated cBPF only when there is not a defaultErrnoRet set
+	// and it is different from ENOSYS
+	if config.DefaultErrnoRet != nil && *config.DefaultErrnoRet == uint(retErrnoEnosys) {
+		return nil, nil
+	}
 	// We only add the stub if the default action is not permissive.
 	if isAllowAction(config.DefaultAction) {
 		logrus.Debugf("seccomp: skipping -ENOSYS stub filter generation")
diff --git a/libcontainer/seccomp/seccomp_linux.go b/libcontainer/seccomp/seccomp_linux.go
@@ -36,7 +36,7 @@ func InitSeccomp(config *configs.Seccomp) error {
 		return errors.New("cannot initialize Seccomp - nil config passed")
 	}
 
-	defaultAction, err := getAction(config.DefaultAction, nil)
+	defaultAction, err := getAction(config.DefaultAction, config.DefaultErrnoRet)
 	if err != nil {
 		return errors.New("error initializing seccomp - invalid default action")
 	}
diff --git a/libcontainer/specconv/spec_linux.go b/libcontainer/specconv/spec_linux.go
@@ -878,6 +878,7 @@ func SetupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error) {
 		return nil, err
 	}
 	newConfig.DefaultAction = newDefaultAction
+	newConfig.DefaultErrnoRet = config.DefaultErrnoRet
 
 	// Loop through all syscall blocks and convert them to libcontainer format
 	for _, call := range config.Syscalls {
diff --git a/tests/integration/seccomp.bats b/tests/integration/seccomp.bats
@@ -21,3 +21,15 @@ function teardown() {
 	runc run test_busybox
 	[ "$status" -eq 0 ]
 }
+
+@test "runc run [seccomp defaultErrnoRet=ENXIO]" {
+	TEST_NAME="seccomp_syscall_test2"
+
+	# Compile the test binary and update the config to run it.
+	gcc -static -o rootfs/seccomp_test2 "${TESTDATA}/${TEST_NAME}.c"
+	update_config ".linux.seccomp = $(<"${TESTDATA}/${TEST_NAME}.json")"
+	update_config '.process.args = ["/seccomp_test2"]'
+
+	runc run test_busybox
+	[ "$status" -eq 0 ]
+}
diff --git a/tests/integration/testdata/seccomp_syscall_test2.c b/tests/integration/testdata/seccomp_syscall_test2.c
@@ -0,0 +1,12 @@
+#include <unistd.h>
+#include <errno.h>
+#include <stdio.h>
+#include <stdlib.h>
+
+int main()
+{
+	if (chdir("/") < 0 && errno == ENXIO)
+		exit(EXIT_SUCCESS);
+	fprintf(stderr, "got errno=%m\n");
+	exit(EXIT_FAILURE);
+}
diff --git a/tests/integration/testdata/seccomp_syscall_test2.json b/tests/integration/testdata/seccomp_syscall_test2.json

Original file line number	Diff line number	Diff line change
`@@ -36,7 +36,7 @@ func InitSeccomp(config *configs.Seccomp) error {`
`36`	`36`	`return errors.New("cannot initialize Seccomp - nil config passed")`
`37`	`37`	`}`
`38`	`38`
`39`		`- defaultAction, err := getAction(config.DefaultAction, nil)`
	`39`	`+ defaultAction, err := getAction(config.DefaultAction, config.DefaultErrnoRet)`
`40`	`40`	`if err != nil {`
`41`	`41`	`return errors.New("error initializing seccomp - invalid default action")`
`42`	`42`	`}`
Original file line number	Diff line number	Diff line change
`@@ -878,6 +878,7 @@ func SetupSeccomp(config specs.LinuxSeccomp) (configs.Seccomp, error) {`
`878`	`878`	`return nil, err`
`879`	`879`	`}`
`880`	`880`	`newConfig.DefaultAction = newDefaultAction`
	`881`	`+ newConfig.DefaultErrnoRet = config.DefaultErrnoRet`
`881`	`882`
`882`	`883`	`// Loop through all syscall blocks and convert them to libcontainer format`
`883`	`884`	`for _, call := range config.Syscalls {`