Implement seccomp notify support #2682
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,62 @@ | ||
| # Seccomp Agent | ||
|
|
||
| ## Warning | ||
|
|
||
| Please note this is an example agent, as such it is possible that specially | ||
| crafted messages can produce bad behaviour. Please use it as an example only. | ||
|
|
||
| Also, this agent is used for integration tests. Be aware that changing the | ||
| behaviour can break the integration tests. | ||
|
|
||
| ## Get started | ||
|
|
||
| Compile runc and seccompagent: | ||
| ```bash | ||
| make all | ||
| ``` | ||
|
|
||
| Run the seccomp agent in the background: | ||
| ```bash | ||
| sudo ./contrib/cmd/seccompagent/seccompagent & | ||
| ``` | ||
|
|
||
| Prepare a container: | ||
| ```bash | ||
| mkdir container-seccomp-notify | ||
| cd container-seccomp-notify | ||
| mkdir rootfs | ||
| docker export $(docker create busybox) | tar -C rootfs -xvf - | ||
| ``` | ||
|
|
||
| Copy the example `config.json` file from the directory where this README.md is | ||
| to the container directory you prepared earlier (`container-seccomp-notify`). | ||
| This is a config.json as generated by `runc spec` at time of writing, with only | ||
| the `args` and `seccomp` sections modified. | ||
|
|
||
| Then start the container: | ||
| ```bash | ||
| runc run mycontainerid | ||
| ``` | ||
|
|
||
| The container will output something like this: | ||
| ```bash | ||
| + cd /dev/shm | ||
| + mkdir test-dir | ||
| + touch test-file | ||
| + chmod 777 test-file | ||
| chmod: changing permissions of 'test-file': No medium found | ||
| + ls -l /dev/shm | ||
| total 0 | ||
| drwxr-xr-x 2 root root 40 Jul 21 14:09 test-dir-foo | ||
| -rw-r--r-- 1 root root 0 Jul 21 14:09 test-file | ||
| + echo Note the agent added a suffix for the directory name and chmod fails | ||
| Note the agent added a suffix for the directory name and chmod fails | ||
| ``` | ||
|
|
||
| This shows a simple example that runs in /dev/shm just because it is a tmpfs in | ||
| the example config.json. | ||
|
|
||
| The agent makes all chmod calls fail with ENOMEDIUM, as the example output shows. | ||
|
|
||
| For mkdir, the agent adds a "-foo" suffix: the container runs "mkdir test-dir" | ||
| but the directory created is "test-dir-foo". | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,197 @@ | ||
| { | ||
| "ociVersion": "1.0.2-dev", | ||
| "process": { | ||
| "terminal": true, | ||
| "user": { | ||
| "uid": 0, | ||
| "gid": 0 | ||
| }, | ||
| "args": [ | ||
| "sh", | ||
| "-c", | ||
| "set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; ls -l /dev/shm; echo \"Note the agent added a suffix for the directory name and chmod fails\" " | ||
|
Comment on lines
+11
to
+12
Contributor
There was a problem hiding this comment. Perhaps it makes sense to add comments to at least mark those parts of the file that are specific to this demo. This includes this
Contributor
There was a problem hiding this comment. Or, add a short script instead that would modify config.json to achieve what you need. You can see lots of examples of how to do it with
Contributor
There was a problem hiding this comment. Either way is fine with me -- I just want to be able to find out in 15+ years which parts are specific to the test, and which are whatever
Member
There was a problem hiding this comment. yes, it is a config as generated by runc spec, with only the args and seccomp section modified. I stated that in the README so it is easy for our future selfs :-) (json can't include comments AFAIK).
Member
There was a problem hiding this comment. I think he meant that it would be nice if there was a simple script that did: % runc spec
% jq '.process.args = [...]' <config.json | sponge config.jsonAnother option would be to put the test commands in a script and execute the script (copying it into the rootfs in the integration test) which would be even cleaner. Then you could just follow the style of the other integration tests where you simply add the configuration settings in the integration test rather than having a saved But we can always fix that separately (and having an explanation in the readme is probably sufficient for now). EDIT: Ah this isn't used in tests at all. Yeah then it's fine (though a script to generate it would be nice).
Member
There was a problem hiding this comment. Sure, I can do that in a follow-up PR :) |
||
| ], | ||
| "env": [ | ||
| "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin", | ||
| "TERM=xterm" | ||
| ], | ||
| "cwd": "/", | ||
| "capabilities": { | ||
| "bounding": [ | ||
| "CAP_AUDIT_WRITE", | ||
| "CAP_KILL", | ||
| "CAP_NET_BIND_SERVICE" | ||
| ], | ||
| "effective": [ | ||
| "CAP_AUDIT_WRITE", | ||
| "CAP_KILL", | ||
| "CAP_NET_BIND_SERVICE" | ||
| ], | ||
| "inheritable": [ | ||
| "CAP_AUDIT_WRITE", | ||
| "CAP_KILL", | ||
| "CAP_NET_BIND_SERVICE" | ||
| ], | ||
| "permitted": [ | ||
| "CAP_AUDIT_WRITE", | ||
| "CAP_KILL", | ||
| "CAP_NET_BIND_SERVICE" | ||
| ], | ||
| "ambient": [ | ||
| "CAP_AUDIT_WRITE", | ||
| "CAP_KILL", | ||
| "CAP_NET_BIND_SERVICE" | ||
| ] | ||
| }, | ||
| "rlimits": [ | ||
| { | ||
| "type": "RLIMIT_NOFILE", | ||
| "hard": 1024, | ||
| "soft": 1024 | ||
| } | ||
| ], | ||
| "noNewPrivileges": true | ||
| }, | ||
| "root": { | ||
| "path": "rootfs", | ||
| "readonly": true | ||
| }, | ||
| "hostname": "runc", | ||
| "mounts": [ | ||
| { | ||
| "destination": "/proc", | ||
| "type": "proc", | ||
| "source": "proc" | ||
| }, | ||
| { | ||
| "destination": "/dev", | ||
| "type": "tmpfs", | ||
| "source": "tmpfs", | ||
| "options": [ | ||
| "nosuid", | ||
| "strictatime", | ||
| "mode=755", | ||
| "size=65536k" | ||
| ] | ||
| }, | ||
| { | ||
| "destination": "/dev/pts", | ||
| "type": "devpts", | ||
| "source": "devpts", | ||
| "options": [ | ||
| "nosuid", | ||
| "noexec", | ||
| "newinstance", | ||
| "ptmxmode=0666", | ||
| "mode=0620", | ||
| "gid=5" | ||
| ] | ||
| }, | ||
| { | ||
| "destination": "/dev/shm", | ||
| "type": "tmpfs", | ||
| "source": "shm", | ||
| "options": [ | ||
| "nosuid", | ||
| "noexec", | ||
| "nodev", | ||
| "mode=1777", | ||
| "size=65536k" | ||
| ] | ||
| }, | ||
| { | ||
| "destination": "/dev/mqueue", | ||
| "type": "mqueue", | ||
| "source": "mqueue", | ||
| "options": [ | ||
| "nosuid", | ||
| "noexec", | ||
| "nodev" | ||
| ] | ||
| }, | ||
| { | ||
| "destination": "/sys", | ||
| "type": "sysfs", | ||
| "source": "sysfs", | ||
| "options": [ | ||
| "nosuid", | ||
| "noexec", | ||
| "nodev", | ||
| "ro" | ||
| ] | ||
| }, | ||
| { | ||
| "destination": "/sys/fs/cgroup", | ||
| "type": "cgroup", | ||
| "source": "cgroup", | ||
| "options": [ | ||
| "nosuid", | ||
| "noexec", | ||
| "nodev", | ||
| "relatime", | ||
| "ro" | ||
| ] | ||
| } | ||
| ], | ||
| "linux": { | ||
| "seccomp": { | ||
| "defaultAction": "SCMP_ACT_ALLOW", | ||
| "listenerPath": "/run/seccomp-agent.socket", | ||
| "listenerMetadata": "foo", | ||
| "architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32" ], | ||
| "syscalls": [ | ||
| { | ||
| "names": [ "chmod", "fchmod", "fchmodat", "mkdir" ], | ||
| "action": "SCMP_ACT_NOTIFY" | ||
| } | ||
| ] | ||
| }, | ||
| "resources": { | ||
| "devices": [ | ||
| { | ||
| "allow": false, | ||
| "access": "rwm" | ||
| } | ||
| ] | ||
| }, | ||
| "namespaces": [ | ||
| { | ||
| "type": "pid" | ||
| }, | ||
| { | ||
| "type": "network" | ||
| }, | ||
| { | ||
| "type": "ipc" | ||
| }, | ||
| { | ||
| "type": "uts" | ||
| }, | ||
| { | ||
| "type": "mount" | ||
| }, | ||
| { | ||
| "type": "cgroup" | ||
| } | ||
| ], | ||
| "maskedPaths": [ | ||
| "/proc/acpi", | ||
| "/proc/asound", | ||
| "/proc/kcore", | ||
| "/proc/keys", | ||
| "/proc/latency_stats", | ||
| "/proc/timer_list", | ||
| "/proc/timer_stats", | ||
| "/proc/sched_debug", | ||
| "/sys/firmware", | ||
| "/proc/scsi" | ||
| ], | ||
| "readonlyPaths": [ | ||
| "/proc/bus", | ||
| "/proc/fs", | ||
| "/proc/irq", | ||
| "/proc/sys", | ||
| "/proc/sysrq-trigger" | ||
| ] | ||
| } | ||
| } | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can we explain what user should do after starting the container?
e.g., run mkdir, chmod, ...
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Right, will clarify that. Thanks!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Simplified this. I added a config.json to the directory, referenced that to be used, simplified the command that is run and added here the expected output with a brief explanation.
Thanks!