seccomp: add support for SECCOMP_FILTER_FLAG_LOG

Signed-off-by: Alban Crequy <[email protected]>

libcontainer/configs/config.go

@@ -33,6 +33,7 @@ type IDMap struct {
 type Seccomp struct {
  DefaultAction Action `json:"default_action"`
  Architectures []string `json:"architectures"`
+ Flags []string `json:"flags"`
  Syscalls []*Syscall `json:"syscalls"`
  DefaultErrnoRet *uint `json:"default_errno_ret"`
  ListenerPath string `json:"listener_path,omitempty"`

libcontainer/seccomp/seccomp_linux.go

@@ -86,6 +86,18 @@ func InitSeccomp(config *configs.Seccomp) (int, error) {
  }
  }
 
+ // Add extra flags
+ for _, flag := range config.Flags {
+ switch flag {
+ case "SECCOMP_FILTER_FLAG_LOG":
+ if err := filter.SetLogBit(true); err != nil {
+ return -1, fmt.Errorf("error adding log flag to seccomp filter: %w", err)
+ }
+ default:
+ return -1, fmt.Errorf("seccomp flags %q not yet supported by runc", flag)
+ }
+ }
+
  // Unset no new privs bit
  if err := filter.SetNoNewPrivsBit(false); err != nil {
  return -1, fmt.Errorf("error setting no new privileges: %w", err)

libcontainer/specconv/spec_linux.go

@@ -1016,14 +1016,19 @@ func SetupSeccomp(config *specs.LinuxSeccomp) (*configs.Seccomp, error) {
  return nil, nil
  }
 
- // We don't currently support seccomp flags.
- if len(config.Flags) != 0 {
- return nil, errors.New("seccomp flags are not yet supported by runc")
- }
-
  newConfig := new(configs.Seccomp)
  newConfig.Syscalls = []*configs.Syscall{}
 
+ // We don't currently support all seccomp flags.
+ for _, flag := range config.Flags {
+ switch flag {
+ case "SECCOMP_FILTER_FLAG_LOG":
+ newConfig.Flags = append(newConfig.Flags, "SECCOMP_FILTER_FLAG_LOG")
+ default:
+ return nil, fmt.Errorf("seccomp flags %q not yet supported by runc", flag)
+ }
+ }
+
  if len(config.Architectures) > 0 {
  newConfig.Architectures = []string{}
  for _, arch := range config.Architectures {

tests/integration/seccomp.bats

@@ -66,6 +66,24 @@ function teardown() {
  [[ "$output" == *"Network is down"* ]]
 }
 
+@test "runc run [seccomp] (SECCOMP_FILTER_FLAG_LOG)" {
+ requires_kernel 4.14 # SECCOMP_FILTER_FLAG_LOG appeared in Linux 4.14
+ update_config ' .process.args = ["/bin/sh", "-c", "mkdir /dev/shm/foo"]
+ | .process.noNewPrivileges = false
+ | .linux.seccomp = {
+ "defaultAction":"SCMP_ACT_ALLOW",
+ "architectures":["SCMP_ARCH_X86","SCMP_ARCH_X32"],
+ "flags":["SECCOMP_FILTER_FLAG_LOG"],
+ "syscalls":[{"names":["mkdir"], "action":"SCMP_ACT_ERRNO"}]
+ }'
+
+ # This test checks that the log flag is accepted but does not check the
+ # audit log
+ runc run test_busybox
+ [ "$status" -ne 0 ]
+ [[ "$output" == *"mkdir:"*"/dev/shm/foo"*"Operation not permitted"* ]]
+}
+
 @test "runc run [seccomp] (SCMP_ACT_KILL)" {
  update_config ' .process.args = ["/bin/sh", "-c", "mkdir /dev/shm/foo"]
  | .process.noNewPrivileges = false