Skip to content

Commit 22752db

Browse files
grantseltzergrantseltzer
committed
Use seccomp library for adding seccomp configuration flags
Signed-off-by: Grantseltzer <[email protected]>
1 parent 3c2125c commit 22752db

File tree

10 files changed

+550
-369
lines changed

10 files changed

+550
-369
lines changed

‎cmd/ocitools/generate.go‎

Lines changed: 67 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package main
33
import (
44
"os"
55
"runtime"
6+
"strings"
67

78
"github.com/opencontainers/ocitools/generate"
89
rspec "github.com/opencontainers/runtime-spec/specs-go"
@@ -48,11 +49,14 @@ var generateFlags = []cli.Flag{
4849
cli.StringSliceFlag{Name: "gidmappings", Usage: "add GIDMappings e.g HostID:ContainerID:Size"},
4950
cli.StringSliceFlag{Name: "sysctl", Usage: "add sysctl settings e.g net.ipv4.forward=1"},
5051
cli.StringFlag{Name: "apparmor", Usage: "specifies the the apparmor profile for the container"},
51-
cli.StringFlag{Name: "seccomp-default", Usage: "specifies the the defaultaction of Seccomp syscall restrictions"},
52-
cli.StringSliceFlag{Name: "seccomp-arch", Usage: "specifies Additional architectures permitted to be used for system calls"},
53-
cli.StringSliceFlag{Name: "seccomp-syscalls", Usage: "specifies Additional architectures permitted to be used for system calls, e.g Name:Action:Arg1_index/Arg1_value/Arg1_valuetwo/Arg1_op, Arg2_index/Arg2_value/Arg2_valuetwo/Arg2_op "},
54-
cli.StringSliceFlag{Name: "seccomp-allow", Usage: "specifies syscalls to be added to allowed"},
55-
cli.StringSliceFlag{Name: "seccomp-errno", Usage: "specifies syscalls to be added to list that returns an error"},
52+
cli.BoolFlag{Name: "seccomp-only", Usage: "specifies to export just a seccomp configuration file"},
53+
cli.StringFlag{Name: "seccomp-arch", Usage: "specifies additional architectures permitted to be used for system calls"},
54+
cli.StringFlag{Name: "seccomp-default", Usage: "specifies default action to be used for system calls"},
55+
cli.StringFlag{Name: "seccomp-allow", Usage: "specifies syscalls to respond with allow"},
56+
cli.StringFlag{Name: "seccomp-trap", Usage: "specifies syscalls to respond with trap"},
57+
cli.StringFlag{Name: "seccomp-errno", Usage: "specifies syscalls to respond with errno"},
58+
cli.StringFlag{Name: "seccomp-trace", Usage: "specifies syscalls to respond with trace"},
59+
cli.StringFlag{Name: "seccomp-kill", Usage: "specifies syscalls to respond with kill"},
5660
cli.StringFlag{Name: "template", Usage: "base template to use for creating the configuration"},
5761
cli.StringSliceFlag{Name: "label", Usage: "add annotations to the configuration e.g. key=value"},
5862
}
@@ -82,13 +86,15 @@ var generateCommand = cli.Command{
8286
if err != nil {
8387
return err
8488
}
89+
var exportOpts generate.ExportOptions
90+
exportOpts.Seccomp = context.Bool("seccomp-only")
8591

8692
if context.IsSet("output") {
87-
output := context.String("output")
88-
err = specgen.SaveToFile(output)
93+
err = specgen.SaveToFile(context.String("output"), exportOpts)
8994
} else {
90-
err = specgen.Save(os.Stdout)
95+
err = specgen.Save(os.Stdout, exportOpts)
9196
}
97+
9298
if err != nil {
9399
return err
94100
}
@@ -305,61 +311,81 @@ func setupSpec(g *generate.Generator, context *cli.Context) error {
305311
}
306312
}
307313

308-
var sd string
309-
var sa, ss []string
314+
err := addSeccomp(*g, context)
315+
if err != nil {
316+
return err
317+
}
318+
319+
return nil
320+
}
321+
322+
func addSeccomp(g generate.Generator, context *cli.Context) error {
323+
seccompDefault := context.String("seccomp-default")
324+
seccompArch := context.String("seccomp-arch")
325+
seccompKill := context.String("seccomp-kill")
326+
seccompTrace := context.String("seccomp-trace")
327+
seccompErrno := context.String("seccomp-errno")
328+
seccompTrap := context.String("seccomp-trap")
329+
seccompAllow := context.String("seccomp-allow")
310330

311-
if context.IsSet("seccomp-default") {
312-
sd = context.String("seccomp-default")
331+
// Set the DefaultAction of seccomp
332+
if seccompDefault == "" {
333+
seccompDefault = "errno"
313334
}
314335

315-
if context.IsSet("seccomp-arch") {
316-
sa = context.StringSlice("seccomp-arch")
336+
err := g.SetDefaultSeccompAction(seccompDefault)
337+
if err != nil {
338+
return err
317339
}
318340

319-
if context.IsSet("seccomp-syscalls") {
320-
ss = context.StringSlice("seccomp-syscalls")
341+
// Add the additional architectures permitted to be used for system calls
342+
if seccompArch == "" {
343+
seccompArch = "amd64,x86,x32" // Default Architectures
321344
}
322345

323-
if sd == "" && len(sa) == 0 && len(ss) == 0 {
324-
return nil
346+
architectureArgs := strings.Split(seccompArch, ",")
347+
err = g.SetSeccompArchitectures(architectureArgs)
348+
if err != nil {
349+
return err
325350
}
326351

327-
// Set the DefaultAction of seccomp
328-
if context.IsSet("seccomp-default") {
329-
if err := g.SetLinuxSeccompDefault(sd); err != nil {
352+
if seccompKill != "" {
353+
killArgs := strings.Split(seccompKill, ",")
354+
err = g.SetSyscallActions("kill", killArgs)
355+
if err != nil {
330356
return err
331357
}
332358
}
333359

334-
// Add the additional architectures permitted to be used for system calls
335-
if context.IsSet("seccomp-arch") {
336-
for _, arch := range sa {
337-
if err := g.AddLinuxSeccompArch(arch); err != nil {
338-
return err
339-
}
360+
if seccompTrace != "" {
361+
traceArgs := strings.Split(seccompTrace, ",")
362+
err = g.SetSyscallActions("trace", traceArgs)
363+
if err != nil {
364+
return err
340365
}
341366
}
342367

343-
// Set syscall restrict in Seccomp
344-
if context.IsSet("seccomp-syscalls") {
345-
for _, syscall := range ss {
346-
if err := g.AddLinuxSeccompSyscall(syscall); err != nil {
347-
return err
348-
}
368+
if seccompErrno != "" {
369+
errnoArgs := strings.Split(seccompErrno, ",")
370+
err = g.SetSyscallActions("errno", errnoArgs)
371+
if err != nil {
372+
return err
349373
}
350374
}
351375

352-
if context.IsSet("seccomp-allow") {
353-
seccompAllows := context.StringSlice("seccomp-allow")
354-
for _, s := range seccompAllows {
355-
g.AddLinuxSeccompSyscallAllow(s)
376+
if seccompTrap != "" {
377+
trapArgs := strings.Split(seccompTrap, ",")
378+
err = g.SetSyscallActions("trap", trapArgs)
379+
if err != nil {
380+
return err
356381
}
357382
}
358383

359-
if context.IsSet("seccomp-errno") {
360-
seccompErrnos := context.StringSlice("seccomp-errno")
361-
for _, s := range seccompErrnos {
362-
g.AddLinuxSeccompSyscallErrno(s)
384+
if seccompAllow != "" {
385+
allowArgs := strings.Split(seccompAllow, ",")
386+
err = g.SetSyscallActions("allow", allowArgs)
387+
if err != nil {
388+
return err
363389
}
364390
}
365391

0 commit comments

Comments
 (0)