Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

seccomp: refactor flags support; add flags to features, set SPEC_ALLOW by default #3588

Merged
merged 4 commits into from
Jan 20, 2023
Merged

seccomp: refactor flags support; add flags to features, set SPEC_ALLOW by default #3588

merged 4 commits into from
Jan 20, 2023

Commits on Nov 30, 2022

  1. types/features: fix docstrings 

    Fix a few copy-paste errors.

Fixes: 520702d
Signed-off-by: Kir Kolyshkin <[email protected]>
    @kolyshkin
    kolyshkin committed Nov 30, 2022
    Configuration menu
    Copy the full SHA
    ab84808 View commit details
    Browse the repository at this point in the history

  2. runc features: add seccomp filter flags 

    Amend runc features to print seccomp flags. Two set of flags are added:
 * known flags are those that this version of runc is aware of;
 * supported flags are those that can be set; normally, this is the same
   set as known flags, but due to older version of kernel and/or
   libseccomp, some known flags might be unsupported.

This commit also consolidates three different switch statements dealing
with flags into one, in func setFlag. A note is added to this function
telling what else to look for when adding new flags.

Unfortunately, it also adds a list of known flags, that should be
kept in sync with the switch statement.

Signed-off-by: Kir Kolyshkin <[email protected]>
    @kolyshkin
    kolyshkin committed Nov 30, 2022
    Configuration menu
    Copy the full SHA
    076745a View commit details
    Browse the repository at this point in the history

  3. seccomp: set SPEC_ALLOW by default 

    If no seccomps flags are set in OCI runtime spec (not even the empty
set), set SPEC_ALLOW as the default (if it's supported).

Otherwise, use the flags as they are set (that includes no flags for
empty seccomp.Flags array).

This mimics the crun behavior, and makes runc seccomp performance on par
with crun.

Signed-off-by: Kir Kolyshkin <[email protected]>
    @kolyshkin
    kolyshkin committed Nov 30, 2022
    Configuration menu
    Copy the full SHA
    ac04154 View commit details
    Browse the repository at this point in the history

  4. tests/int: use runc features in seccomp flags test 

    This test (initially added by commit 58ea21d and later amended in
commit 26dc55e) currently has two major deficiencies:

1. All possible flag combinations, and their respective numeric values,
   have to be explicitly listed. Currently we support 3 flags, so
   there is only 2^3 - 1 = 7 combinations, but adding more flags will
   become increasingly difficult (for example, 5 flags will result in
   31 combinations).

2. The test requires kernel 4.17 (for SECCOMP_FILTER_FLAG_SPEC_ALLOW),
   and not doing any tests when running on an older kernel. This, too,
   will make it more difficult to add extra flags in the future.

Both issues can be solved by using runc features which now prints all
known and supported runc flags. We still have to hardcode the numeric
values of all flags, but most of the other work is coded now.

In particular:

 * The test only uses supported flags, meaning it can be used with
   older kernels, removing the limitation (2) above.

 * The test calculates the powerset (all possible combinations) of
   flags and their numeric values. This makes it easier to add more
   flags, removing the limitation (1) above.

 * The test will fail (in flags_value) if any new flags will be added
   to runc but the test itself is not amended.

Signed-off-by: Kir Kolyshkin <[email protected]>
    @kolyshkin
    kolyshkin committed Nov 30, 2022
    Configuration menu
    Copy the full SHA
    19a9d9f View commit details
    Browse the repository at this point in the history