Skip to content

Commit 9a0419b

Browse files
cypharcyphar
committed
merge branch 'pr-2682'
Alban Crequy (3): vendoring: Use libseccomp with notify support Implement Seccomp Notify contrib: add sample seccomp agent Mauricio Vásquez (4): libcontainer/utils: introduce SendFds libcontainer/specconv: extend SetupSeccomp tests tests: add functional tests for seccomp tests: add functional tests for seccomp notify Co-developed-by: Rodrigo Campos LGTMs: kolyshkin cyphar
2 parents 110bdb0 + 00772ca commit 9a0419b

35 files changed

+2052
-218
lines changed

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ vendor/pkg
33
/runc-*
44
contrib/cmd/recvtty/recvtty
55
contrib/cmd/sd-helper/sd-helper
6+
contrib/cmd/seccompagent/seccompagent
67
man/man8
78
release
89
Vagrantfile

‎Makefile‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,11 +30,14 @@ GO_BUILD_STATIC := CGO_ENABLED=1 $(GO) build -trimpath $(EXTRA_FLAGS) -tags "$(B
3030
runc:
3131
$(GO_BUILD) -o runc .
3232

33-
all: runc recvtty sd-helper
33+
all: runc recvtty sd-helper seccompagent
3434

3535
recvtty sd-helper:
3636
$(GO_BUILD) -o contrib/cmd/$@/$@ ./contrib/cmd/$@
3737

38+
seccompagent:
39+
$(GO_BUILD) -o contrib/cmd/seccompagent/seccompagent ./contrib/cmd/seccompagent
40+
3841
static:
3942
$(GO_BUILD_STATIC) -o runc .
4043
$(GO_BUILD_STATIC) -o contrib/cmd/recvtty/recvtty ./contrib/cmd/recvtty

‎contrib/cmd/seccompagent/README.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Seccomp Agent
2+
3+
## Warning
4+
5+
Please note this is an example agent, as such it is possible that specially
6+
crafted messages can produce bad behaviour. Please use it as an example only.
7+
8+
Also, this agent is used for integration tests. Be aware that changing the
9+
behaviour can break the integration tests.
10+
11+
## Get started
12+
13+
Compile runc and seccompagent:
14+
```bash
15+
make all
16+
```
17+
18+
Run the seccomp agent in the background:
19+
```bash
20+
sudo ./contrib/cmd/seccompagent/seccompagent &
21+
```
22+
23+
Prepare a container:
24+
```bash
25+
mkdir container-seccomp-notify
26+
cd container-seccomp-notify
27+
mkdir rootfs
28+
docker export $(docker create busybox) | tar -C rootfs -xvf -
29+
```
30+
31+
Copy the example `config.json` file from the directory where this README.md is
32+
to the container directory you prepared earlier (`container-seccomp-notify`).
33+
This is a config.json as generated by `runc spec` at time of writing, with only
34+
the `args` and `seccomp` sections modified.
35+
36+
Then start the container:
37+
```bash
38+
runc run mycontainerid
39+
```
40+
41+
The container will output something like this:
42+
```bash
43+
+ cd /dev/shm
44+
+ mkdir test-dir
45+
+ touch test-file
46+
+ chmod 777 test-file
47+
chmod: changing permissions of 'test-file': No medium found
48+
+ ls -l /dev/shm
49+
total 0
50+
drwxr-xr-x 2 root root 40 Jul 21 14:09 test-dir-foo
51+
-rw-r--r-- 1 root root 0 Jul 21 14:09 test-file
52+
+ echo Note the agent added a suffix for the directory name and chmod fails
53+
Note the agent added a suffix for the directory name and chmod fails
54+
```
55+
56+
This shows a simple example that runs in /dev/shm just because it is a tmpfs in
57+
the example config.json.
58+
59+
The agent makes all chmod calls fail with ENOMEDIUM, as the example output shows.
60+
61+
For mkdir, the agent adds a "-foo" suffix: the container runs "mkdir test-dir"
62+
but the directory created is "test-dir-foo".

‎contrib/cmd/seccompagent/config.json‎

Lines changed: 197 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,197 @@
1+
{
2+
"ociVersion": "1.0.2-dev",
3+
"process": {
4+
"terminal": true,
5+
"user": {
6+
"uid": 0,
7+
"gid": 0
8+
},
9+
"args": [
10+
"sh",
11+
"-c",
12+
"set -x; cd /dev/shm; mkdir test-dir; touch test-file; chmod 777 test-file; ls -l /dev/shm; echo \"Note the agent added a suffix for the directory name and chmod fails\" "
13+
],
14+
"env": [
15+
"PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
16+
"TERM=xterm"
17+
],
18+
"cwd": "/",
19+
"capabilities": {
20+
"bounding": [
21+
"CAP_AUDIT_WRITE",
22+
"CAP_KILL",
23+
"CAP_NET_BIND_SERVICE"
24+
],
25+
"effective": [
26+
"CAP_AUDIT_WRITE",
27+
"CAP_KILL",
28+
"CAP_NET_BIND_SERVICE"
29+
],
30+
"inheritable": [
31+
"CAP_AUDIT_WRITE",
32+
"CAP_KILL",
33+
"CAP_NET_BIND_SERVICE"
34+
],
35+
"permitted": [
36+
"CAP_AUDIT_WRITE",
37+
"CAP_KILL",
38+
"CAP_NET_BIND_SERVICE"
39+
],
40+
"ambient": [
41+
"CAP_AUDIT_WRITE",
42+
"CAP_KILL",
43+
"CAP_NET_BIND_SERVICE"
44+
]
45+
},
46+
"rlimits": [
47+
{
48+
"type": "RLIMIT_NOFILE",
49+
"hard": 1024,
50+
"soft": 1024
51+
}
52+
],
53+
"noNewPrivileges": true
54+
},
55+
"root": {
56+
"path": "rootfs",
57+
"readonly": true
58+
},
59+
"hostname": "runc",
60+
"mounts": [
61+
{
62+
"destination": "/proc",
63+
"type": "proc",
64+
"source": "proc"
65+
},
66+
{
67+
"destination": "/dev",
68+
"type": "tmpfs",
69+
"source": "tmpfs",
70+
"options": [
71+
"nosuid",
72+
"strictatime",
73+
"mode=755",
74+
"size=65536k"
75+
]
76+
},
77+
{
78+
"destination": "/dev/pts",
79+
"type": "devpts",
80+
"source": "devpts",
81+
"options": [
82+
"nosuid",
83+
"noexec",
84+
"newinstance",
85+
"ptmxmode=0666",
86+
"mode=0620",
87+
"gid=5"
88+
]
89+
},
90+
{
91+
"destination": "/dev/shm",
92+
"type": "tmpfs",
93+
"source": "shm",
94+
"options": [
95+
"nosuid",
96+
"noexec",
97+
"nodev",
98+
"mode=1777",
99+
"size=65536k"
100+
]
101+
},
102+
{
103+
"destination": "/dev/mqueue",
104+
"type": "mqueue",
105+
"source": "mqueue",
106+
"options": [
107+
"nosuid",
108+
"noexec",
109+
"nodev"
110+
]
111+
},
112+
{
113+
"destination": "/sys",
114+
"type": "sysfs",
115+
"source": "sysfs",
116+
"options": [
117+
"nosuid",
118+
"noexec",
119+
"nodev",
120+
"ro"
121+
]
122+
},
123+
{
124+
"destination": "/sys/fs/cgroup",
125+
"type": "cgroup",
126+
"source": "cgroup",
127+
"options": [
128+
"nosuid",
129+
"noexec",
130+
"nodev",
131+
"relatime",
132+
"ro"
133+
]
134+
}
135+
],
136+
"linux": {
137+
"seccomp": {
138+
"defaultAction": "SCMP_ACT_ALLOW",
139+
"listenerPath": "/run/seccomp-agent.socket",
140+
"listenerMetadata": "foo",
141+
"architectures": [ "SCMP_ARCH_X86", "SCMP_ARCH_X32" ],
142+
"syscalls": [
143+
{
144+
"names": [ "chmod", "fchmod", "fchmodat", "mkdir" ],
145+
"action": "SCMP_ACT_NOTIFY"
146+
}
147+
]
148+
},
149+
"resources": {
150+
"devices": [
151+
{
152+
"allow": false,
153+
"access": "rwm"
154+
}
155+
]
156+
},
157+
"namespaces": [
158+
{
159+
"type": "pid"
160+
},
161+
{
162+
"type": "network"
163+
},
164+
{
165+
"type": "ipc"
166+
},
167+
{
168+
"type": "uts"
169+
},
170+
{
171+
"type": "mount"
172+
},
173+
{
174+
"type": "cgroup"
175+
}
176+
],
177+
"maskedPaths": [
178+
"/proc/acpi",
179+
"/proc/asound",
180+
"/proc/kcore",
181+
"/proc/keys",
182+
"/proc/latency_stats",
183+
"/proc/timer_list",
184+
"/proc/timer_stats",
185+
"/proc/sched_debug",
186+
"/sys/firmware",
187+
"/proc/scsi"
188+
],
189+
"readonlyPaths": [
190+
"/proc/bus",
191+
"/proc/fs",
192+
"/proc/irq",
193+
"/proc/sys",
194+
"/proc/sysrq-trigger"
195+
]
196+
}
197+
}

0 commit comments

Comments
 (0)