Skip to content

Commit cbd3a2e

Browse files
grantseltzergrantseltzer
committed
Use oci-seccomp-gen library for adding seccomp configurations
Signed-off-by: Grantseltzer <[email protected]>
1 parent 3334d03 commit cbd3a2e

11 files changed

Lines changed: 528 additions & 382 deletions

File tree

‎Godeps/Godeps.json‎

Lines changed: 2 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎cmd/ocitools/generate.go‎

Lines changed: 60 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ import (
55
"runtime"
66

77
"github.com/opencontainers/ocitools/generate"
8+
"github.com/opencontainers/ocitools/generate/seccomp"
89
rspec "github.com/opencontainers/runtime-spec/specs-go"
910
"github.com/urfave/cli"
1011
)
@@ -48,11 +49,14 @@ var generateFlags = []cli.Flag{
4849
cli.StringSliceFlag{Name: "gidmappings", Usage: "add GIDMappings e.g HostID:ContainerID:Size"},
4950
cli.StringSliceFlag{Name: "sysctl", Usage: "add sysctl settings e.g net.ipv4.forward=1"},
5051
cli.StringFlag{Name: "apparmor", Usage: "specifies the the apparmor profile for the container"},
51-
cli.StringFlag{Name: "seccomp-default", Usage: "specifies the the defaultaction of Seccomp syscall restrictions"},
52-
cli.StringSliceFlag{Name: "seccomp-arch", Usage: "specifies Additional architectures permitted to be used for system calls"},
53-
cli.StringSliceFlag{Name: "seccomp-syscalls", Usage: "specifies Additional architectures permitted to be used for system calls, e.g Name:Action:Arg1_index/Arg1_value/Arg1_valuetwo/Arg1_op, Arg2_index/Arg2_value/Arg2_valuetwo/Arg2_op "},
54-
cli.StringSliceFlag{Name: "seccomp-allow", Usage: "specifies syscalls to be added to allowed"},
55-
cli.StringSliceFlag{Name: "seccomp-errno", Usage: "specifies syscalls to be added to list that returns an error"},
52+
cli.BoolFlag{Name: "seccomp-only", Usage: "specifies to export just a seccomp configuration file"},
53+
cli.StringFlag{Name: "seccomp-arch", Usage: "specifies additional architectures permitted to be used for system calls"},
54+
cli.StringFlag{Name: "seccomp-default", Usage: "specifies default action to be used for system calls"},
55+
cli.StringFlag{Name: "seccomp-allow", Usage: "specifies syscalls to respond with allow"},
56+
cli.StringFlag{Name: "seccomp-trap", Usage: "specifies syscalls to respond with trap"},
57+
cli.StringFlag{Name: "seccomp-errno", Usage: "specifies syscalls to respond with errno"},
58+
cli.StringFlag{Name: "seccomp-trace", Usage: "specifies syscalls to respond with trace"},
59+
cli.StringFlag{Name: "seccomp-kill", Usage: "specifies syscalls to respond with kill"},
5660
cli.StringFlag{Name: "template", Usage: "base template to use for creating the configuration"},
5761
cli.StringSliceFlag{Name: "label", Usage: "add annotations to the configuration e.g. key=value"},
5862
}
@@ -82,13 +86,15 @@ var generateCommand = cli.Command{
8286
if err != nil {
8387
return err
8488
}
89+
var exportOpts generate.ExportOptions
90+
exportOpts.Seccomp = context.Bool("seccomp-only")
8591

8692
if context.IsSet("output") {
87-
output := context.String("output")
88-
err = specgen.SaveToFile(output)
93+
err = specgen.SaveToFile(context.String("output"), exportOpts)
8994
} else {
90-
err = specgen.Save(os.Stdout)
95+
err = specgen.Save(os.Stdout, exportOpts)
9196
}
97+
9298
if err != nil {
9399
return err
94100
}
@@ -301,64 +307,69 @@ func setupSpec(g generate.Generator, context *cli.Context) error {
301307
}
302308
}
303309

304-
var sd string
305-
var sa, ss []string
306-
307-
if context.IsSet("seccomp-default") {
308-
sd = context.String("seccomp-default")
310+
err := addSeccomp(spec, context)
311+
if err != nil {
312+
return err
309313
}
310314

311-
if context.IsSet("seccomp-arch") {
312-
sa = context.StringSlice("seccomp-arch")
313-
}
315+
return nil
316+
}
314317

315-
if context.IsSet("seccomp-syscalls") {
316-
ss = context.StringSlice("seccomp-syscalls")
317-
}
318+
func addSeccomp(spec *rspec.Spec, context *cli.Context) error {
319+
var secc rspec.Seccomp
318320

319-
if sd == "" && len(sa) == 0 && len(ss) == 0 {
320-
return nil
321-
}
321+
seccompDefault := context.String("seccomp-default")
322+
seccompArch := context.String("seccomp-arch")
323+
seccompKill := context.String("seccomp-kill")
324+
seccompTrace := context.String("seccomp-trace")
325+
seccompErrno := context.String("seccomp-errno")
326+
seccompTrap := context.String("seccomp-trap")
327+
seccompAllow := context.String("seccomp-allow")
322328

323329
// Set the DefaultAction of seccomp
324-
if context.IsSet("seccomp-default") {
325-
if err := g.SetLinuxSeccompDefault(sd); err != nil {
326-
return err
327-
}
330+
if seccompDefault == "" {
331+
seccompDefault = "errno"
332+
}
333+
err := seccomp.ParseDefaultAction(seccompDefault, &secc)
334+
if err != nil {
335+
return err
328336
}
329337

330338
// Add the additional architectures permitted to be used for system calls
331-
if context.IsSet("seccomp-arch") {
332-
for _, arch := range sa {
333-
if err := g.AddLinuxSeccompArch(arch); err != nil {
334-
return err
335-
}
336-
}
339+
if seccompArch == "" {
340+
seccompArch = "amd64,x86,x32"
341+
}
342+
err = seccomp.ParseArchitectureFlag(seccompArch, &secc)
343+
if err != nil {
344+
return err
337345
}
338346

339-
// Set syscall restrict in Seccomp
340-
if context.IsSet("seccomp-syscalls") {
341-
for _, syscall := range ss {
342-
if err := g.AddLinuxSeccompSyscall(syscall); err != nil {
343-
return err
344-
}
345-
}
347+
err = seccomp.ParseSyscallFlag("kill", seccompKill, &secc)
348+
if err != nil {
349+
return err
346350
}
347351

348-
if context.IsSet("seccomp-allow") {
349-
seccompAllows := context.StringSlice("seccomp-allow")
350-
for _, s := range seccompAllows {
351-
g.AddLinuxSeccompSyscallAllow(s)
352-
}
352+
err = seccomp.ParseSyscallFlag("trace", seccompTrace, &secc)
353+
if err != nil {
354+
return err
353355
}
354356

355-
if context.IsSet("seccomp-errno") {
356-
seccompErrnos := context.StringSlice("seccomp-errno")
357-
for _, s := range seccompErrnos {
358-
g.AddLinuxSeccompSyscallErrno(s)
359-
}
357+
err = seccomp.ParseSyscallFlag("errno", seccompErrno, &secc)
358+
if err != nil {
359+
return err
360+
}
361+
362+
err = seccomp.ParseSyscallFlag("trap", seccompTrap, &secc)
363+
if err != nil {
364+
return err
365+
}
366+
367+
err = seccomp.ParseSyscallFlag("allow", seccompAllow, &secc)
368+
if err != nil {
369+
return err
360370
}
361371

372+
spec.Linux.Seccomp = &secc
362373
return nil
363374
}
364375

0 commit comments

Comments
 (0)