libct/seccomp/patchbpf: support SPEC_ALLOW

Commit 58ea21d added support for seccomp flags such as SPEC_ALLOW, but it does not work as expected, because since commit 7a8d716 we do not use libseccomp-golang's Load(), but handle flags separately in patchbfp. This fixes setting SPEC_ALLOW flag. Add a comment to not forget to amend filterFlags when adding new flags. Signed-off-by: Kir Kolyshkin <[email protected]> (cherry picked from commit c7dc8b1) Signed-off-by: Kir Kolyshkin <[email protected]>
projectatomic · Aug 29, 2022 · b44b590 · b44b590
1 parent a8e4cf3
commit b44b590
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 2 deletions.
diff --git a/libcontainer/seccomp/patchbpf/enosys_linux.go b/libcontainer/seccomp/patchbpf/enosys_linux.go
@@ -43,6 +43,11 @@ const uintptr_t C_SET_MODE_FILTER = SECCOMP_SET_MODE_FILTER;
 #endif
 const uintptr_t C_FILTER_FLAG_LOG = SECCOMP_FILTER_FLAG_LOG;
 
+#ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW
+# define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2)
+#endif
+const uintptr_t C_FILTER_FLAG_SPEC_ALLOW = SECCOMP_FILTER_FLAG_SPEC_ALLOW;
+
 #ifndef SECCOMP_FILTER_FLAG_NEW_LISTENER
 # define SECCOMP_FILTER_FLAG_NEW_LISTENER (1UL << 3)
 #endif
@@ -629,8 +634,13 @@ func filterFlags(config *configs.Seccomp, filter *libseccomp.ScmpFilter) (flags
  flags |= uint(C.C_FILTER_FLAG_LOG)
  }
  }
-
- // TODO: Support seccomp flags not yet added to libseccomp-golang...
+ if apiLevel >= 4 {
+ if ssb, err := filter.GetSSB(); err != nil {
+ return 0, false, fmt.Errorf("unable to fetch SECCOMP_FILTER_FLAG_SPEC_ALLOW bit: %w", err)
+ } else if ssb {
+ flags |= uint(C.C_FILTER_FLAG_SPEC_ALLOW)
+ }
+ }
 
  for _, call := range config.Syscalls {
  if call.Action == configs.Notify {

diff --git a/libcontainer/seccomp/seccomp_linux.go b/libcontainer/seccomp/seccomp_linux.go
@@ -105,6 +105,7 @@ func InitSeccomp(config *configs.Seccomp) (int, error) {
  if err := filter.SetSSB(true); err != nil {
  return -1, fmt.Errorf("error adding SSB flag to seccomp filter: %w", err)
  }
+ // NOTE when adding more flags, make sure to also modify filterFlags in patchbpf.
  default:
  return -1, fmt.Errorf("seccomp flags %q not yet supported by runc", flag)
  }